CVE-2012-1944

The Content Security Policy (CSP) implementation in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 does not block inline event handlers, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted HTML document.

• CWE-79

• http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html
• http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00015.html
• http://rhn.redhat.com/errata/RHSA-2012-0710.html
• http://rhn.redhat.com/errata/RHSA-2012-0715.html
• http://secunia.com/advisories/49981Permissions Required
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:088
• http://www.mozilla.org/security/announce/2012/mfsa2012-36.htmlVendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=751422Issue Tracking
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17005
• http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html
• http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00015.html
• http://rhn.redhat.com/errata/RHSA-2012-0710.html
• http://rhn.redhat.com/errata/RHSA-2012-0715.html
• http://secunia.com/advisories/49981Permissions Required
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:088
• http://www.mozilla.org/security/announce/2012/mfsa2012-36.htmlVendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=751422Issue Tracking
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17005

Published

Jun 5, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-1938Multiple unspecified vulnerabilities in the browser engine i…
• CVE-2012-1939jsinfer.cpp in Mozilla Firefox ESR 10.x before 10.0.5 and Th…
• CVE-2012-1940Use-after-free vulnerability in the nsFrameList::FirstChild …
• CVE-2012-1941Heap-based buffer overflow in the nsHTMLReflowState::Calcula…
• CVE-2012-1942The Mozilla Updater and Windows Updater Service in Mozilla F…
• CVE-2012-1943Untrusted search path vulnerability in Updater.exe in the Wi…
• CVE-2012-1945Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10…
• CVE-2012-1946Use-after-free vulnerability in the nsINode::ReplaceOrInsert…
• CVE-2012-1947Heap-based buffer overflow in the utf16_to_isolatin1 functio…
• CVE-2012-1948Multiple unspecified vulnerabilities in the browser engine i…
• CVE-2012-1949Multiple unspecified vulnerabilities in the browser engine i…
• CVE-2012-1950The drag-and-drop implementation in Mozilla Firefox 4.x thro…