{"schemaVersion":3,"id":"CVE-2014-1480","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site.","dates":{"published":"2014-02-06T02:00:00.000Z","modified":"2024-08-06T09:42:35.492Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.3,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02695,"percentile":0.85696,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.02695},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02695,"percentile":0.85696}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02695,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02695,"percentile":0.85696}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-1021","name":"Improper Restriction of Rendered UI Layers or Frames","description":"The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1021.html"}],"affected":[{"vendor":"canonical","product":"ubuntu_linux","name":"ubuntu linux","label":"ubuntu_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"12.04","noFixRecorded":false,"fixedIn":null},{"text":"12.10","noFixRecorded":false,"fixedIn":null},{"text":"13.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"12.04 | 12.10 | 13.10","eol":{"isEol":true,"eolDate":"2017-04-28T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"12.04","label":"12.04 'Precise Pangolin' (LTS)","eolFrom":"2017-04-28T00:00:00.000Z","isLts":true,"isMaintained":false,"latestVersion":"12.04.5"},"product":{"name":"ubuntu","label":"Ubuntu","category":"os"}},"hubHref":"/vendor/canonical/ubuntu_linux"},{"vendor":"mozilla","product":"firefox","name":"firefox","label":"firefox","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 27.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 27.0","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"firefox","label":"Firefox","category":"app"}},"hubHref":"/vendor/mozilla/firefox"},{"vendor":"mozilla","product":"seamonkey","name":"seamonkey","label":"seamonkey","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.24","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.24","eol":null,"hubHref":"/vendor/mozilla/seamonkey"},{"vendor":"opensuse","product":"opensuse","name":"opensuse","label":"opensuse","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"11.4","noFixRecorded":false,"fixedIn":null},{"text":"12.3","noFixRecorded":false,"fixedIn":null},{"text":"13.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"11.4 | 12.3 | 13.1","eol":{"isEol":true,"eolDate":"2012-11-05T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"11.4","label":"11.4","eolFrom":"2012-11-05T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"opensuse","label":"openSUSE","category":"os"}},"hubHref":"/vendor/opensuse/opensuse"},{"vendor":"oracle","product":"solaris","name":"Solaris","label":"solaris","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"11.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"11.3","eol":{"isEol":true,"eolDate":"2021-01-01T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"11.3","label":"11.3","eolFrom":"2021-01-01T00:00:00.000Z","isLts":false,"isMaintained":true,"latestVersion":null},"product":{"name":"oracle-solaris","label":"Oracle Solaris","category":"os"}},"hubHref":"/vendor/oracle/solaris"},{"vendor":"suse","product":"linux_enterprise_desktop","name":"linux enterprise desktop","label":"linux_enterprise_desktop","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"11:sp3","noFixRecorded":false,"fixedIn":null}],"versionsText":"11:sp3","eol":null,"hubHref":"/vendor/suse/linux_enterprise_desktop"},{"vendor":"suse","product":"linux_enterprise_server","name":"linux enterprise server","label":"linux_enterprise_server","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"11:sp3","noFixRecorded":false,"fixedIn":null}],"versionsText":"11:sp3","eol":null,"hubHref":"/vendor/suse/linux_enterprise_server"},{"vendor":"suse","product":"linux_enterprise_software_development_kit","name":"linux enterprise software development kit","label":"linux_enterprise_software_development_kit","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"11:sp3","noFixRecorded":false,"fixedIn":null}],"versionsText":"11:sp3","eol":null,"hubHref":"/vendor/suse/linux_enterprise_software_development_kit"}],"affectedCount":8,"eol":{"hasEol":true,"count":3},"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html","label":"lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id/1029717","label":"www.securitytracker.com/id/1029717","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]},{"url":"http://www.mozilla.org/security/announce/2014/mfsa2014-03.html","label":"www.mozilla.org/security/announce/2014/mfsa2014-03.html","hostname":"www.mozilla.org","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://www.securitytracker.com/id/1029720","label":"www.securitytracker.com/id/1029720","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2102-2","label":"www.ubuntu.com/usn/USN-2102-2","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201504-01","label":"security.gentoo.org/glsa/201504-01","hostname":"security.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","label":"www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","hostname":"www.oracle.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"http://secunia.com/advisories/56888","label":"secunia.com/advisories/56888","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html","label":"lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List","Third Party Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/90897","label":"exchange.xforce.ibmcloud.com/vulnerabilities/90897","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF","Third Party Advisory"]},{"url":"http://osvdb.org/102867","label":"osvdb.org/102867","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB","Broken Link"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=916726","label":"bugzilla.mozilla.org/show_bug.cgi?id=916726","hostname":"bugzilla.mozilla.org","tags":["X Refsource CONFIRM","Issue Tracking","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html","label":"lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List","Third Party Advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2102-1","label":"www.ubuntu.com/usn/USN-2102-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/65331","label":"www.securityfocus.com/bid/65331","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":["MGASA-2014-0048","OPENSUSE-SU-2024:10071-1","OPENSUSE-SU-2024:14572-1"],"duplicates":[],"related":["OPENSUSE-SU-2024:10071-1","OPENSUSE-SU-2024:14572-1"]},"timeline":[{"kind":"published","date":"2014-02-06T02:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-06T09:42:35.492Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":18,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T18:57:38.626Z","stale":false,"partial":false}}