CVE-2022-3034

When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.

• CWE-1021
• CWE-1021

• https://bugzilla.mozilla.org/show_bug.cgi?id=1745751Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-38/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-39/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1745751Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-38/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-39/Vendor Advisory

Published

Dec 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30333RARLAB UnRAR before 6.12 on Linux and UNIX allows directory …7.5
• CVE-2022-30334Brave before 1.34, when a Private Window with Tor Connectivi…5.3
• CVE-2022-30335Bonanza Wealth Management System (BWM) 7.3.2 allows SQL inje…9.8
• CVE-2022-30337Cross-Site Request Forgery (CSRF) vulnerability in JoomUnite…4.3
• CVE-2022-30338Incorrect default permissions in the Intel(R) VROC software …7.8
• CVE-2022-30339Out-of-bounds read in firmware for the Intel(R) Integrated S…4.4
• CVE-2022-30349siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripti…6.1
• CVE-2022-3035Cross-site Scripting (XSS) - Stored in GitHub repository sni…4.8
• CVE-2022-30350Avanquest Software RAD PDF (PDFEscape Online) 3.19.2.2 is vu…7.5
• CVE-2022-30351PDFZorro PDFZorro Online r20220428 using TCPDF 6.2.5, despit…7.5
• CVE-2022-30352phpABook 0.9i is vulnerable to SQL Injection due to insuffic…9.8
• CVE-2022-30354OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data…7.5