CVE-2016-9901

—

CVSS 3.0

9.8 critical

EPSS

3%p86

Published

Jun 11, 2018 (Jun 11, 2018)

Modified

Jun 17, 2026

Description

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" (unprivileged) page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

Vendors: redhat mozilla
Products: enterprise linux aus, enterprise linux desktop, enterprise linux eus, enterprise linux server, enterprise linux workstation, firefox
Weakness: CWE-20
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.9%)

In the news0 stories

No ingested article mentions this CVE yet.