CVSS: 6.5EPSS: 0%CPEs: 73EXPL: 0CVE-2010-1213 – Mozilla Cross-origin data disclosure via Web Workers and importScripts
https://notcve.org/view.php?id=CVE-2010-1213
30 Jul 2010 — The importScripts Web Worker method in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 does not verify that content is valid JavaScript code, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted HTML document. El método importScripts Web Worker en Mozilla Firefox v3.5.x anteriores a la v3.5.11 y v3.6.x anteriores a la v3.6.7, Thunderbird v3.0.x anteriores a l... • http://www.mozilla.org/security/announce/2010/mfsa2010-42.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2010-1215 – Mozilla Arbitrary code execution using SJOW and fast native function
https://notcve.org/view.php?id=CVE-2010-1215
30 Jul 2010 — Mozilla Firefox 3.6.x before 3.6.7 and Thunderbird 3.1.x before 3.1.1 do not properly implement access to a content object through a SafeJSObjectWrapper (aka SJOW) wrapper, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging "access to an object from the chrome scope." Mozilla Firefox v3.6.x anteriores a la v3.6.7 y Thunderbird v3.1.x anteriores a la v3.1.1 no implementan apropiadamente el acceso a un objeto de contenido a través de un "wrapper" (encapsula... • http://www.mozilla.org/security/announce/2010/mfsa2010-38.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 2%CPEs: 6EXPL: 0CVE-2010-1212 – Mozilla miscellaneous memory safety hazards
https://notcve.org/view.php?id=CVE-2010-1212
30 Jul 2010 — js/src/jstracer.cpp in the browser engine in Mozilla Firefox 3.6.x before 3.6.7 and Thunderbird 3.1.x before 3.1.1 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) propagation of deep aborts in the TraceRecorder::record_JSOP_BINDNAME function, (2) depth handling in the TraceRecorder::record_JSOP_GETELEM function, and (3) tracing of out-of-range arguments in the TraceRecorder::record_JSOP_ARGSUB functi... • http://www.mozilla.org/security/announce/2010/mfsa2010-34.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.1EPSS: 0%CPEs: 191EXPL: 0CVE-2010-1210 – Mozilla Characters mapped to U+FFFD in 8 bit encodings cause subsequent character to vanish
https://notcve.org/view.php?id=CVE-2010-1210
30 Jul 2010 — intl/uconv/util/nsUnicodeDecodeHelper.cpp in Mozilla Firefox before 3.6.7 and Thunderbird before 3.1.1 inserts a U+FFFD sequence into text in certain circumstances involving undefined positions, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted 8-bit text. intl/uconv/util/nsUnicodeDecodeHelper.cpp en Mozilla Firefox en versiones anteriores a la v3.6.7 y Thunderbird en anteriores a la v3.1.1 inserta una secuencia U+FFFD en texto en determinadas circunst... • http://www.mozilla.org/security/announce/2010/mfsa2010-44.html • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 7%CPEs: 72EXPL: 0CVE-2010-1211 – Mozilla miscellaneous memory safety hazards
https://notcve.org/view.php?id=CVE-2010-1211
30 Jul 2010 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Multiples vulnerabilidades sin especificar en el motor de navegación de Mozilla Firefox v3.5.x anteriores a la v3.5.11 y v3.6.x anteriores a la v3.6.7, Thunde... • http://www.mozilla.org/security/announce/2010/mfsa2010-34.html •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2010-1207 – Mozilla Same-origin bypass using canvas context
https://notcve.org/view.php?id=CVE-2010-1207
30 Jul 2010 — Mozilla Firefox before 3.6.7 and Thunderbird before 3.1.1 do not properly implement read restrictions for CANVAS elements, which allows remote attackers to obtain sensitive cross-origin information via vectors involving reference retention and node deletion. Mozilla Firefox en versiones anteriores a la v3.6.7 y Thunderbird en versiones anteriores a la v3.1.1 no implementan apropiadamente las restricciones de acceso a los elementos CANVAS, lo que permite a atacantes remotos obtener información confidencial f... • http://www.mozilla.org/security/announce/2010/mfsa2010-43.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.1EPSS: 0%CPEs: 72EXPL: 0CVE-2010-2754 – Mozilla Cross-origin data leakage from script filename in error messages
https://notcve.org/view.php?id=CVE-2010-2754
29 Jul 2010 — dom/base/nsJSEnvironment.cpp in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 does not properly suppress a script's URL in certain circumstances involving a redirect and an error message, which allows remote attackers to obtain sensitive information about script parameters via a crafted HTML document, related to the window.onerror handler. dom/base/nsJSEnvironment.cpp en Mozilla Firefox v3.5.x anteriores a v3.5.1... • http://www.mozilla.org/security/announce/2010/mfsa2010-47.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 6%CPEs: 14EXPL: 1CVE-2010-2753 – Mozilla Firefox nsTreeSelection Dangling Pointer Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-2753
20 Jul 2010 — Integer overflow in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 allows remote attackers to execute arbitrary code via a large selection attribute in a XUL tree element, which triggers a use-after-free. Un desbordamiento de enteros en Firefox versiones 3.5.x anteriores a 3.5.11 y versiones 3.6.x anteriores a 3.6.7, Thunderbird versiones 3.0.x anteriores a 3.0.6 y versiones 3.1.x anteriores a 3.1.1, y SeaMonkey a... • http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html • CWE-190: Integer Overflow or Wraparound CWE-416: Use After Free •
CVSS: 10.0EPSS: 75%CPEs: 72EXPL: 1CVE-2010-2752 – Mozilla Firefox CSS font-face Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-2752
20 Jul 2010 — Integer overflow in an array class in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 allows remote attackers to execute arbitrary code by placing many Cascading Style Sheets (CSS) values in an array, related to references to external font resources and an inconsistency between 16-bit and 32-bit integers. Un desbordamiento de enteros en una clase de matriz en Firefox versiones 3.5.x anteriores a 3.5.11 y versiones ... • https://www.exploit-db.com/exploits/15104 • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 83%CPEs: 31EXPL: 4CVE-2010-1205 – libpng 1.4.2 - Denial of Service
https://notcve.org/view.php?id=CVE-2010-1205
30 Jun 2010 — Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row. Desbordamiento de buffer en el fichero pngpread.c en libpng anteriores a 1.2.44 y 1.4.x anteriroes a 1.4.3, como se utiliza en aplicaciones progresivas, podría permitir a atacantes remotos ejecutar código arbitrario mediante una imagen PNG que desencadena una serie de datos adicionales. ... • https://www.exploit-db.com/exploits/14422 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •