{
    "id": "CVE-2006-0884",
    "published": "2006-02-24 22:02:00",
    "last_modified": "2026-06-16 22:21:28",
    "cvss_score": "9.3",
    "cvss_severity": "HIGH",
    "cvss_version": "2.0",
    "cvss_vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
    "cwe": "CWE-20",
    "description": "The WYSIWYG rendering engine (\"rich mail\" editor) in Mozilla Thunderbird 1.0.7 and earlier allows user-assisted attackers to bypass javascript security settings and obtain sensitive information or cause a crash via an e-mail containing a javascript URI in the SRC attribute of an IFRAME tag, which is executed when the user edits the e-mail.",
    "epss_score": "0.07232",
    "epss_percentile": "0.94151",
    "kev": 0,
    "kev_due": null,
    "has_exploit": 1,
    "updated_at": "2026-10-05 18:17:04",
    "priority": {
        "rank": 2,
        "label": "Patch early",
        "why": "A public exploit exists."
    },
    "products": [
        {
            "vendor": "mozilla",
            "product": "thunderbird"
        }
    ],
    "kev_detail": null,
    "exploits": [
        {
            "source": "exploit-db",
            "ref_id": "27257",
            "title": "Mozilla (Multiple Products) - iFrame JavaScript Execution",
            "date": "2006-02-22",
            "url": "https://www.exploit-db.com/exploits/27257"
        }
    ],
    "refs_list": [
        "ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt",
        "ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc",
        "http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html",
        "http://secunia.com/advisories/19721",
        "http://secunia.com/advisories/19811",
        "http://secunia.com/advisories/19821",
        "http://secunia.com/advisories/19823",
        "http://secunia.com/advisories/19863",
        "http://secunia.com/advisories/19902",
        "http://secunia.com/advisories/19941",
        "http://secunia.com/advisories/19950",
        "http://secunia.com/advisories/20051",
        "http://secunia.com/advisories/21033",
        "http://secunia.com/advisories/21622",
        "http://secunia.com/advisories/22065",
        "http://securitytracker.com/id?1015665",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102550-1",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-26-228526-1",
        "http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm",
        "http://www.debian.org/security/2006/dsa-1046",
        "http://www.debian.org/security/2006/dsa-1051",
        "http://www.gentoo.org/security/en/glsa/glsa-200604-18.xml",
        "http://www.gentoo.org/security/en/glsa/glsa-200605-09.xml",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2006:052",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2006:076"
    ]
}