CVE-2014-1485
The Content Security Policy (CSP) implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 operates on XSLT stylesheets according to style-src directives instead of script-src directives, which might allow remote attackers to execute arbitrary XSLT code by leveraging insufficient style-src restrictions.
- EPSS
- 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- mozilla:firefox
- mozilla:seamonkey
- opensuse:opensuse
- oracle:solaris
- suse:linux_enterprise_desktop
- suse:linux_enterprise_server
- suse:linux_enterprise_software_development_kit