CVSS: 8.1EPSS: 0%CPEs: 186EXPL: 0CVE-2011-3001
https://notcve.org/view.php?id=CVE-2011-3001
29 Sep 2011 — Mozilla Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent manual add-on installation in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that triggers an unspecified internal error. Mozilla Firefox v4.x hasta v6, Thunderbird anterior a v7.0 y SeaMonkey anterior a v2.4 no impiden instalación manual de complementos (add-on) en respuesta a la presión de la tecla Enter, lo que ... • http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 1%CPEs: 207EXPL: 0CVE-2011-2995 – Mozilla: Miscellaneous memory safety hazards (MFSA 2011-36)
https://notcve.org/view.php?id=CVE-2011-2995
29 Sep 2011 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador de Mozilla Firefox anteriores a v3.6.23 y 4.x hasta v6, Thunderbird anteriores a v7.0 y SeaMonkey anteriores a v2.4, permiten a atac... • http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html •
CVSS: 9.3EPSS: 5%CPEs: 207EXPL: 0CVE-2011-3232
https://notcve.org/view.php?id=CVE-2011-3232
29 Sep 2011 — YARR, as used in Mozilla Firefox before 7.0, Thunderbird before 7.0, and SeaMonkey before 2.4, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted JavaScript. Yarr, tal como se utiliza en Mozilla Firefox anterior a v7.0, Thunderbird anterior a v7.0, y SeaMonkey antes de v2.4, permite a atacantes remotos causar una denegación de servicio (caída de aplicación) o posiblemente ejecutar código de su elección a través de JavaScript modificado. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 1%CPEs: 159EXPL: 0CVE-2011-2981 – Mozilla: Privilege escalation using event handlers
https://notcve.org/view.php?id=CVE-2011-2981
18 Aug 2011 — The event-management implementation in Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly select the context for script to run in, which allows remote attackers to bypass the Same Origin Policy or execute arbitrary JavaScript code with chrome privileges via a crafted web site. La implementación de gestión de eventos en Firefox anterior a versión 3.6.20, SeaMonkey versiones 2.x, Thunderbird versiones 3.x anteriores a 3.1.12, y posiblemen... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-16: Configuration •
CVSS: 7.5EPSS: 0%CPEs: 156EXPL: 0CVE-2011-2986
https://notcve.org/view.php?id=CVE-2011-2986
18 Aug 2011 — Mozilla Firefox 4.x through 5, Thunderbird before 6, SeaMonkey 2.x before 2.3, and possibly other products, when the Direct2D (aka D2D) API is used on Windows, allows remote attackers to bypass the Same Origin Policy, and obtain sensitive image data from a different domain, by inserting this data into a canvas. Firefox versiones 4.x hasta 5, Thunderbird anterior a versión 6, SeaMonkey versiones 2.x anteriores a 2.3, y posiblemente otros productos de Mozilla, cuando la API Direct2D (también se conoce como D2... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 8%CPEs: 156EXPL: 0CVE-2011-2987
https://notcve.org/view.php?id=CVE-2011-2987
18 Aug 2011 — Heap-based buffer overflow in Almost Native Graphics Layer Engine (ANGLE), as used in the WebGL implementation in Mozilla Firefox 4.x through 5, Thunderbird before 6, SeaMonkey 2.x before 2.3, and possibly other products might allow remote attackers to execute arbitrary code via unspecified vectors. Desbordamiento de búfer en la región heap de la memoria en Almost Native Graphics Layer Engine (ANGLE), como es usado en la implementación de WebGL en Firefox versiones 4.x hasta 5, Thunderbird anterior a versió... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 4%CPEs: 51EXPL: 0CVE-2011-2988
https://notcve.org/view.php?id=CVE-2011-2988
18 Aug 2011 — Buffer overflow in an unspecified string class in the WebGL shader implementation in Mozilla Firefox 4.x through 5, Thunderbird before 6, SeaMonkey 2.x before 2.3, and possibly other products allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long source-code block for a shader. Desbordamiento de buffer en una clase string no especificada en la implementación WebGL shader en Mozilla Firefox 4.x hasta la versión 5, Thunderbird en versiones anteriores a 6,... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.1EPSS: 0%CPEs: 271EXPL: 0CVE-2011-2983 – Mozilla: Private data leakage using RegExp.input
https://notcve.org/view.php?id=CVE-2011-2983
18 Aug 2011 — Mozilla Firefox before 3.6.20, Thunderbird 2.x and 3.x before 3.1.12, SeaMonkey 1.x and 2.x, and possibly other products does not properly handle the RegExp.input property, which allows remote attackers to bypass the Same Origin Policy and read data from a different domain via a crafted web site, possibly related to a use-after-free. Firefox anterior a versión 3.6.20, Thunderbird versiones 2.x y versiones 3.x anteriores a 3.1.12, SeaMonkey versiones 1.x y 2.x, y posiblemente otros productos de Mozilla, no m... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 4%CPEs: 132EXPL: 0CVE-2011-2989
https://notcve.org/view.php?id=CVE-2011-2989
18 Aug 2011 — The browser engine in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, Thunderbird before 6, and possibly other products does not properly implement WebGL, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors. El motor del navegador en Firefox versiones 4.x hasta 5, SeaMonkey versiones 2.x anteriores a 2.3, Thunderbird anterior a versión 6, y posiblemente otros productos de Mozilla, no implemen... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.3EPSS: 0%CPEs: 134EXPL: 0CVE-2011-2980
https://notcve.org/view.php?id=CVE-2011-2980
18 Aug 2011 — Untrusted search path vulnerability in the ThinkPadSensor::Startup function in Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12, allows local users to gain privileges by leveraging write access in an unspecified directory to place a Trojan horse DLL that is loaded into the running Firefox process. Una vulnerabilidad de ruta (path) de búsqueda no confiable en la función ThinkPadSensor::Startup en Firefox anterior a versión 3.6.20, Thunderbird versiones 3.x anteriores a 3.1.12 de Mozilla, permite ... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html •