{"id":"CVE-2010-2768","url":"https://www.cyber-defence.io/tools/cve/CVE-2010-2768","generatedAt":"2026-10-27T18:33:40.073Z","title":"Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict use of the type attribute of an OBJECT element to set a document's charset, which allows remote…","description":"Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict use of the type attribute of an OBJECT element to set a document's charset, which allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms via UTF-7 encoding.","published":"2010-09-09T19:00:03.000Z","lastModified":"2026-06-16T23:21:29.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":4.3,"severity":"MEDIUM","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N"},"cwe":["CWE-79"],"affected":["mozilla/firefox","mozilla/seamonkey","mozilla/thunderbird"],"epss":{"score":0.02107,"percentile":0.8163,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (2.11%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox","source":"cve@mitre.org"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html","source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/42867","source":"cve@mitre.org"},{"url":"http://support.avaya.com/css/P8/documents/100110210","source":"cve@mitre.org"},{"url":"http://support.avaya.com/css/P8/documents/100112690","source":"cve@mitre.org"},{"url":"http://www.debian.org/security/2010/dsa-2106","source":"cve@mitre.org"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:173","source":"cve@mitre.org"},{"url":"http://www.mozilla.org/security/announce/2010/mfsa2010-61.html","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/43101","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2010/2323","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2011/0061","source":"cve@mitre.org"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=579744","source":"cve@mitre.org"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11735","source":"cve@mitre.org"},{"url":"http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/42867","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://support.avaya.com/css/P8/documents/100110210","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://support.avaya.com/css/P8/documents/100112690","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2010/dsa-2106","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:173","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.mozilla.org/security/announce/2010/mfsa2010-61.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/43101","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2010/2323","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2011/0061","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=579744","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11735","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2010-2768","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}