CVE-2015-2745
Last modified
CVE-2015-2745 is a vulnerability of currently unknown severity. Multiple cross-site scripting (XSS) vulnerabilities in the Search app in Gaia in Mozilla Firefox OS before 2.2 allow remote attackers to inject arbitrary HTML via the (1) name or (2) title field in card content associated with a search link that is mishandled after a HOME button press or a Show Windows action, as demonstrated by embedding an arbitrary application or spoofing the account-creation page.. EPSS estimates a 1.44% chance of exploitation in the next 30 days.
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Search app in Gaia in Mozilla Firefox OS before 2.2 allow remote attackers to inject arbitrary HTML via the (1) name or (2) title field in card content associated with a search link that is mishandled after a HOME button press or a Show Windows action, as demonstrated by embedding an arbitrary application or spoofing the account-creation page.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox Os | <= 2.1.0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-2745?
How severe is CVE-2015-2745?
How do I fix CVE-2015-2745?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-2739The ArrayBufferBuilder::append function in Mozilla Firefox b…
- CVE-2015-2740Buffer overflow in the nsXMLHttpRequest::AppendToResponseTex…
- CVE-2015-2741Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, a…
- CVE-2015-2742Mozilla Firefox before 39.0 on OS X includes native key pres…
- CVE-2015-2743PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x b…
- CVE-2015-2744Cross-site scripting (XSS) vulnerability in the Search app i…
- CVE-2015-2746The network diagnostics tool (CommandLineServlet) in the App…
- CVE-2015-2747Multiple cross-site scripting (XSS) vulnerabilities in the d…
- CVE-2015-2748Websense TRITON AP-WEB before 8.0.0 does not properly restri…
- CVE-2015-2749Open redirect vulnerability in Drupal 6.x before 6.35 and 7.…
- CVE-2015-2750Open redirect vulnerability in URL-related API functions in …
- CVE-2015-2751Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggrega…
Are you affected by CVE-2015-2745?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST