CVSS: 8.8EPSS: 1%CPEs: 10EXPL: 0CVE-2010-2762 – Mozilla SJOW creates scope chains ending in outer object (MFSA 2010-59)
https://notcve.org/view.php?id=CVE-2010-2762
09 Sep 2010 — The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox 3.6.x before 3.6.9 and Thunderbird 3.1.x before 3.1.3 does not properly restrict objects at the end of scope chains, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via vectors related to a chrome privileged object and a chain ending in an outer object. La clase XPCSafeJSObjectWrapper en la implementación SafeJSObjectWrapper (también conocido como SJOW) en Mozill... • http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 7%CPEs: 212EXPL: 0CVE-2010-3169 – Mozilla Miscellaneous memory safety hazards
https://notcve.org/view.php?id=CVE-2010-3169
09 Sep 2010 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor de navegación de Mozilla Firefox v3.5.12 y v3.6.x anterior a v3.6.9, Thunderbird anterior a v3.0.7 y v3.1.x anteri... • http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox •
CVSS: 7.5EPSS: 1%CPEs: 212EXPL: 0CVE-2010-2764 – Mozilla Information leak via XMLHttpRequest statusText (MFSA 2010-63)
https://notcve.org/view.php?id=CVE-2010-2764
09 Sep 2010 — Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict read access to the statusText property of XMLHttpRequest objects, which allows remote attackers to discover the existence of intranet web servers via cross-origin requests. Mozilla Firefox anterior a v3.5.12 y v3.6.x anterior a v3.6.9, Thunderbird anterior a v3.0.7 y v3.1.x anterior a v3.1.3, SeaMonkey anterior a v2.0.7 no restringe correctamente el acces... • http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 56%CPEs: 212EXPL: 0CVE-2010-2766 – Mozilla Firefox normalizeDocument Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-2766
09 Sep 2010 — The normalizeDocument function in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 does not properly handle the removal of DOM nodes during normalization, which might allow remote attackers to execute arbitrary code via vectors involving access to a deleted object. La función normalizeDocument en Mozilla Firefox anterior a v3.5.12 y v3.6.x anterior a v3.6.9, Thunderbird anterior a v3.0.7 y v3.1.x anterior a v3.1.3, SeaMonkey an... • http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 47%CPEs: 212EXPL: 0CVE-2010-3167 – Mozilla Firefox nsTreeContentView Dangling Pointer Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-3167
09 Sep 2010 — The nsTreeContentView function in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 does not properly handle node removal in XUL trees, which allows remote attackers to execute arbitrary code via vectors involving access to deleted memory, related to a "dangling pointer vulnerability." La función nsTreeContentView en Mozilla Firefox v3.5.12 y v3.6.x anterior a v3.6.9, Thunderbird anterior a v3.0.7 y v3.1.x anterior a v3.1.3, y S... • http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-399: Resource Management Errors •
CVSS: 9.8EPSS: 24%CPEs: 212EXPL: 0CVE-2010-3168 – Mozilla Firefox tree Object Removal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-3168
09 Sep 2010 — Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict the role of property changes in triggering XUL tree removal, which allows remote attackers to cause a denial of service (deleted memory access and application crash) or possibly execute arbitrary code by setting unspecified properties. Mozilla Firefox anterior a v3.5.12 y v3.6.x anterior a v3.6.9, Thunderbird anterior a v3.0.7 y v3.1.x anterior a v3.1.3, ... • http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 24%CPEs: 212EXPL: 4CVE-2010-3131 – Mozilla Firefox 3.6.8 - 'dwmapi.dll' DLL Hijacking
https://notcve.org/view.php?id=CVE-2010-3131
26 Aug 2010 — Untrusted search path vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 on Windows XP allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .htm, .html, .jtx, .mfp, or .eml file. Una vulnerabilidad de ruta de búsqueda no confiable en Firefox anterior a versión 3.5.12 y versiones 3.6.x an... • https://www.exploit-db.com/exploits/14730 •
CVSS: 6.5EPSS: 0%CPEs: 73EXPL: 0CVE-2010-1213 – Mozilla Cross-origin data disclosure via Web Workers and importScripts
https://notcve.org/view.php?id=CVE-2010-1213
30 Jul 2010 — The importScripts Web Worker method in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 does not verify that content is valid JavaScript code, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted HTML document. El método importScripts Web Worker en Mozilla Firefox v3.5.x anteriores a la v3.5.11 y v3.6.x anteriores a la v3.6.7, Thunderbird v3.0.x anteriores a l... • http://www.mozilla.org/security/announce/2010/mfsa2010-42.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2010-1215 – Mozilla Arbitrary code execution using SJOW and fast native function
https://notcve.org/view.php?id=CVE-2010-1215
30 Jul 2010 — Mozilla Firefox 3.6.x before 3.6.7 and Thunderbird 3.1.x before 3.1.1 do not properly implement access to a content object through a SafeJSObjectWrapper (aka SJOW) wrapper, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging "access to an object from the chrome scope." Mozilla Firefox v3.6.x anteriores a la v3.6.7 y Thunderbird v3.1.x anteriores a la v3.1.1 no implementan apropiadamente el acceso a un objeto de contenido a través de un "wrapper" (encapsula... • http://www.mozilla.org/security/announce/2010/mfsa2010-38.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 2%CPEs: 6EXPL: 0CVE-2010-1212 – Mozilla miscellaneous memory safety hazards
https://notcve.org/view.php?id=CVE-2010-1212
30 Jul 2010 — js/src/jstracer.cpp in the browser engine in Mozilla Firefox 3.6.x before 3.6.7 and Thunderbird 3.1.x before 3.1.1 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) propagation of deep aborts in the TraceRecorder::record_JSOP_BINDNAME function, (2) depth handling in the TraceRecorder::record_JSOP_GETELEM function, and (3) tracing of out-of-range arguments in the TraceRecorder::record_JSOP_ARGSUB functi... • http://www.mozilla.org/security/announce/2010/mfsa2010-34.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •