CVE-2010-1125
UnknownEPSS 2.00%
Last modified
CVE-2010-1125 is a vulnerability of currently unknown severity. The JavaScript implementation in Mozilla Firefox 3.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, allows remote attackers to send selected keystrokes to a form field in a hidden frame, instead of the intended form field in a visible frame, via certain calls to the focus method.. EPSS estimates a 2.00% chance of exploitation in the next 30 days.
Description
The JavaScript implementation in Mozilla Firefox 3.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, allows remote attackers to send selected keystrokes to a form field in a hidden frame, instead of the intended form field in a visible frame, via certain calls to the focus method.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | 3.0 |
| Mozilla | Firefox | 3.0.1 |
| Mozilla | Firefox | 3.0.2 |
| Mozilla | Firefox | 3.0.3 |
| Mozilla | Firefox | 3.0.4 |
| Mozilla | Firefox | 3.0.5 |
| Mozilla | Firefox | 3.0.7 |
| Mozilla | Firefox | 3.0.8 |
| Mozilla | Firefox | 3.0.9 |
| Mozilla | Firefox | 3.0.10 |
| Mozilla | Firefox | 3.0.11 |
| Mozilla | Firefox | 3.0.12 |
| Mozilla | Firefox | 3.0.13 |
| Mozilla | Firefox | 3.0.14 |
| Mozilla | Firefox | 3.0.15 |
| Mozilla | Firefox | 3.5 |
| Mozilla | Firefox | 3.5.1 |
| Mozilla | Firefox | 3.5.2 |
| Mozilla | Firefox | 3.5.3 |
| Mozilla | Firefox | 3.5.4 |
| Mozilla | Firefox | 3.5.5 |
| Mozilla | Firefox | 3.5.6 |
| Mozilla | Firefox | 3.5.7 |
| Mozilla | Firefox | 3.5.9 |
| Mozilla | Firefox | 3.6 |
| Mozilla | Firefox | 3.6.2 |
| Mozilla | Firefox | 3.6.1 |
| Mozilla | Firefox | 3.6.3 |
| Mozilla | Seamonkey | <= 2.0.4 |
| Mozilla | Seamonkey | 1.0 |
| Mozilla | Seamonkey | 1.0.1 |
| Mozilla | Seamonkey | 1.0.2 |
| Mozilla | Seamonkey | 1.0.3 |
| Mozilla | Seamonkey | 1.0.4 |
| Mozilla | Seamonkey | 1.0.5 |
| Mozilla | Seamonkey | 1.0.6 |
| Mozilla | Seamonkey | 1.0.7 |
| Mozilla | Seamonkey | 1.0.8 |
| Mozilla | Seamonkey | 1.0.9 |
| Mozilla | Seamonkey | 1.1 |
| Mozilla | Seamonkey | 1.1.1 |
| Mozilla | Seamonkey | 1.1.2 |
| Mozilla | Seamonkey | 1.1.3 |
| Mozilla | Seamonkey | 1.1.4 |
| Mozilla | Seamonkey | 1.1.5 |
| Mozilla | Seamonkey | 1.1.6 |
| Mozilla | Seamonkey | 1.1.7 |
| Mozilla | Seamonkey | 1.1.8 |
| Mozilla | Seamonkey | 1.1.9 |
| Mozilla | Seamonkey | 1.1.10 |
Showing 50 of 65 affected configurations. See NVD for the full list.
References
- http://secunia.com/advisories/40326Vendor Advisory
- http://secunia.com/advisories/40401Vendor Advisory
- http://secunia.com/advisories/40481Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1551Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1557Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1640Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1773Vendor Advisory
- http://secunia.com/advisories/40326Vendor Advisory
- http://secunia.com/advisories/40401Vendor Advisory
- http://secunia.com/advisories/40481Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1551Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1557Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1640Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1773Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2010-1125?
The JavaScript implementation in Mozilla Firefox 3.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, allows remote attackers to send selected keystrokes to a form field in a hidden frame, instead of the intended form field in a visible frame, via certain calls to the focus method.
How severe is CVE-2010-1125?
Severity scoring for CVE-2010-1125 is pending analysis. The EPSS model estimates a 2.00% probability of exploitation in the next 30 days.
How do I fix CVE-2010-1125?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2010
- CVE-2010-1119Use-after-free vulnerability in WebKit in Apple Safari befor…
- CVE-2010-1120Unspecified vulnerability in Safari 4 on Apple Mac OS X 10.6…
- CVE-2010-1121Mozilla Firefox 3.6.x before 3.6.3 does not properly manage …
- CVE-2010-1122Unspecified vulnerability in Mozilla Firefox 3.5.x through 3…
- CVE-2010-1123Chip Salzenberg Deliver does not properly associate a lockfi…
- CVE-2010-1124bos.rte.libc 5.3.9.4 on IBM AIX 5.3 does not properly suppor…
- CVE-2010-1126The JavaScript implementation in WebKit allows remote attack…
- CVE-2010-1127Microsoft Internet Explorer 6 and 7 does not initialize cert…
- CVE-2010-1128The Linear Congruential Generator (LCG) in PHP before 5.2.13…
- CVE-2010-1129The safe_mode implementation in PHP before 5.2.13 does not p…
- CVE-2010-1130session.c in the session extension in PHP before 5.2.13, and…
- CVE-2010-1131JavaScriptCore.dll, as used in Apple Safari 4.0.5 on Windows…
Are you affected by CVE-2010-1125?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST