Unscored severity · published Aug 8, 2015
CVE-2015-2745
Multiple cross-site scripting (XSS) vulnerabilities in the Search app in Gaia in Mozilla Firefox OS before 2.2 allow remote attackers to inject arbitrary HTML via the (1) name or…
–
CVSS
1.4%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Search app in Gaia in Mozilla Firefox OS before 2.2 allow remote attackers to inject arbitrary HTML via the (1) name or (2) title field in card content associated with a search link that is mishandled after a HOME button press or a Show Windows action, as demonstrated by embedding an arbitrary application or spoofing the account-creation page.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Firefox OS · Mozilla
through 2.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2745
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2745
Vendor Advisory
http://www.mozilla.org/security/announce/2015/mfsa2015-73.html
bugzilla.mozilla.org
https://bugzilla.mozilla.org/show_bug.cgi?id=1101158
github.com
https://github.com/mozilla-b2g/gaia/commit/0f72a8c31df9f3d8f609a7c58ca91139051d44eb
More from Firefox OS
8.8
CVE-2015-4495
Mozilla Firefox Security Feature Bypass Vulnerability
6.4
CVE-2015-8511
Race condition in the lockscreen feature in Mozilla Firefox OS before 2.5 allows physically proximate attackers to bypass an intended passcode requirement via unspecified vectors
6.1
CVE-2015-8510
Cross-site scripting (XSS) vulnerability in the internationalization feature in the default homescreen app in Mozilla Firefox OS before 2.5 allows user-assisted remote attackers…
4.6
CVE-2015-8512
The lockscreen feature in Mozilla Firefox OS before 2.5 does not properly restrict failed authentication attempts, which makes it easier for physically proximate attackers to…
3.7
CVE-2015-4000
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows…