CVE-2024-10461

In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.

• CWE-79
• CWE-79

• https://bugzilla.mozilla.org/show_bug.cgi?id=1914521Issue Tracking, Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2024-55/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2024-56/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2024-58/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2024-59/Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/10/msg00034.html
• https://lists.debian.org/debian-lts-announce/2024/11/msg00001.html

Published

Oct 29, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-10456Delta Electronics InfraSuite Device Master versions prior to…9.8
• CVE-2024-10457Multiple Server-Side Request Forgery (SSRF) vulnerabilities …6.5
• CVE-2024-10458A permission leak could have occurred from a trusted site to…7.5
• CVE-2024-10459An attacker could have caused a use-after-free when accessib…7.5
• CVE-2024-1046The Paid Membership Plugin, Ecommerce, User Registration For…5.4
• CVE-2024-10460The origin of an external protocol handler prompt could have…5.3
• CVE-2024-10462Truncation of a long URL could have allowed origin spoofing …6.5
• CVE-2024-10463Video frames could have been leaked between origins in some …6.5
• CVE-2024-10464Repeated writes to history interface attributes could have b…6.5
• CVE-2024-10465A clipboard "paste" button could persist across tabs which a…6.5
• CVE-2024-10466By sending a specially crafted push message, a remote server…7.5
• CVE-2024-10467Memory safety bugs present in Firefox 131, Firefox ESR 128.3…8.8