CVE-2014-1561

Mozilla Firefox before 31.0 does not properly restrict use of drag-and-drop events to spoof customization events, which allows remote attackers to alter the placement of UI icons via crafted JavaScript code that is encountered during (1) page, (2) panel, or (3) toolbar customization.

• CWE-264

• http://secunia.com/advisories/59760
• http://secunia.com/advisories/60628
• http://www.mozilla.org/security/announce/2014/mfsa2014-60.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
• http://www.securitytracker.com/id/1030619
• https://bugzilla.mozilla.org/show_bug.cgi?id=1000514Issue Tracking
• https://bugzilla.mozilla.org/show_bug.cgi?id=910375Issue Tracking
• https://security.gentoo.org/glsa/201504-01
• http://secunia.com/advisories/59760
• http://secunia.com/advisories/60628
• http://www.mozilla.org/security/announce/2014/mfsa2014-60.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
• http://www.securitytracker.com/id/1030619
• https://bugzilla.mozilla.org/show_bug.cgi?id=1000514Issue Tracking
• https://bugzilla.mozilla.org/show_bug.cgi?id=910375Issue Tracking
• https://security.gentoo.org/glsa/201504-01

Published

Jul 23, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-1555Use-after-free vulnerability in the nsDocLoader::OnProgress …
• CVE-2014-1556Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, a…
• CVE-2014-1557The ConvolveHorizontally function in Skia, as used in Mozill…
• CVE-2014-1558Mozilla Firefox before 31.0 and Thunderbird before 31.0 allo…
• CVE-2014-1559Mozilla Firefox before 31.0 and Thunderbird before 31.0 allo…
• CVE-2014-1560Mozilla Firefox before 31.0 and Thunderbird before 31.0 allo…
• CVE-2014-1562Unspecified vulnerability in the browser engine in Mozilla F…
• CVE-2014-1563Use-after-free vulnerability in the mozilla::DOMSVGLength::G…
• CVE-2014-1564Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, a…
• CVE-2014-1565The mozilla::dom::AudioEventTimeline function in the Web Aud…
• CVE-2014-1566Mozilla Firefox before 31.1 on Android does not properly res…
• CVE-2014-1567Use-after-free vulnerability in DirectionalityUtils.cpp in M…