CVE-2018-12381

MEDIUM Year: 2018
CVSS v3 Score
5.3
Medium
CVSS v2 Score
5.0
Medium
Weakness Type
CWE-610
View all →

Vulnerability Description

Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message's mail columns are incorrectly interpreted as a URL. *Note: this issue only affects Windows operating systems with Outlook installed. Other operating systems are not affected.*. This vulnerability affects Firefox ESR < 60.2 and Firefox < 62.

Related Vulnerabilities

CVE-2021-26711

MEDIUM
CVSS:5.3(Medium)

A frame-injection issue in the online help in Redwood Report2Web 4.3.4.5 allows remote attackers to render an external resource inside a frame via the help/Online_Help/NetHelp/default.htm turl paramet...

CWE-6102021

CVE-2021-29965

MEDIUM
CVSS:5.3(Medium)

A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that ...

CWE-6102021

CVE-2021-43794

MEDIUM
CVSS:5.3(Medium)

Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown a JSON blob instead of th...

CWE-6102021

CVE-2022-43423

MEDIUM
CVSS:5.3(Medium)

Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able...

CWE-6102022

CVE-2022-43428

MEDIUM
CVSS:5.3(Medium)

Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes ...

CWE-6102022

CVE-2018-12475

MEDIUM
CVSS:5.4(Medium)

A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service-download_files of openSUSE Open Build Service allows authenticated users to generate HTTP request against...

CWE-6102018