Vulnerability Database

300,445

Total vulnerabilities in the database

CVE-2007-5947

The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI.

  • Published: Nov 14, 2007
  • Updated: Nov 9, 2025
  • CVE: CVE-2007-5947
  • Severity: Low
  • Exploit:

CVSS v2:

  • Severity: Low
  • Score: 4.3
  • AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
mozilla / seamonkey 1.1.3 1.1.3.x
mozilla / firefox 2.0.0.2 2.0.0.2.x
mozilla / seamonkey 1.1.5 1.1.5.x
mozilla / firefox 2.0.0.7 2.0.0.7.x
mozilla / seamonkey 1.1.2 1.1.2.x
mozilla / seamonkey 1.1.1 1.1.1.x
mozilla / firefox 2.0.0.3 2.0.0.3.x
mozilla / firefox 2.0.0.6 2.0.0.6.x
mozilla / firefox 2.0.0.4 2.0.0.4.x
mozilla / firefox - 2.0.0.9.x
mozilla / firefox 2.0.0.1 2.0.0.1.x
mozilla / seamonkey - 1.1.6.x
mozilla / firefox 2.0.0.8 2.0.0.8.x
mozilla / firefox 2.0.0.5 2.0.0.5.x
mozilla / seamonkey 1.1.4 1.1.4.x