CVSS: 9.1EPSS: 1%CPEs: 55EXPL: 2CVE-2005-2261
https://notcve.org/view.php?id=CVE-2005-2261
13 Jul 2005 — Firefox before 1.0.5, Thunderbird before 1.0.5, Mozilla before 1.7.9, Netscape 8.0.2, and K-Meleon 0.9 runs XBL scripts even when Javascript has been disabled, which makes it easier for remote attackers to bypass such protection. • http://secunia.com/advisories/16043 •
CVSS: 8.8EPSS: 88%CPEs: 46EXPL: 0CVE-2005-0399
https://notcve.org/view.php?id=CVE-2005-0399
24 Mar 2005 — Heap-based buffer overflow in GIF2.cpp in Firefox before 1.0.2, Mozilla before to 1.7.6, and Thunderbird before 1.0.2, and possibly other applications that use the same library, allows remote attackers to execute arbitrary code via a GIF image with a crafted Netscape extension 2 block and buffer size. • ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt •
CVSS: 7.5EPSS: 0%CPEs: 44EXPL: 0CVE-2005-0590
https://notcve.org/view.php?id=CVE-2005-0590
28 Feb 2005 — The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and Mozilla before 1.7.6 allows remote attackers to use InstallTrigger to spoof the hostname of the host performing the installation via a long "user:pass" sequence in the URL, which appears before the real hostname. • http://secunia.com/advisories/19823 •
CVSS: 9.8EPSS: 1%CPEs: 12EXPL: 0CVE-2005-0255
https://notcve.org/view.php?id=CVE-2005-0255
28 Feb 2005 — String handling functions in Mozilla 1.7.3, Firefox 1.0, and Thunderbird before 1.0.2, such as the nsTSubstring_CharT::Replace function, do not properly check the return values of other functions that resize the string, which allows remote attackers to cause a denial of service and possibly execute arbitrary code by forcing an out-of-memory state that causes a reallocation to fail and return a pointer to a fixed address, which leads to heap corruption. • http://secunia.com/advisories/19823 •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2005-0142
https://notcve.org/view.php?id=CVE-2005-0142
29 Jan 2005 — Firefox 0.9, Thunderbird 0.6 and other versions before 0.9, and Mozilla 1.7 before 1.7.5 save temporary files with world-readable permissions, which allows local users to read certain web content or attachments that belong to other users, e.g. content that is managed by helper applications such as PDF. • http://secunia.com/advisories/19823 •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 0CVE-2005-0149
https://notcve.org/view.php?id=CVE-2005-0149
29 Jan 2005 — Thunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the network.cookie.disableCookieForMailNews preference, which could allow remote attackers to bypass the user's intended privacy and security policy by using cookies in e-mail messages. • http://secunia.com/advisories/19823 •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2005-0148
https://notcve.org/view.php?id=CVE-2005-0148
29 Jan 2005 — Thunderbird before 0.9, when running on Windows systems, uses the default handler when processing javascript: links, which invokes Internet Explorer and may expose the Thunderbird user to vulnerabilities in the version of Internet Explorer that is installed on the user's system. NOTE: since the invocation between multiple products is a common practice, and the vulnerabilities inherent in multi-product interactions are not easily enumerable, this issue might be REJECTED in the future. • http://www.mozilla.org/security/announce/mfsa2005-10.html •
CVSS: 8.1EPSS: 0%CPEs: 43EXPL: 0CVE-2004-1449
https://notcve.org/view.php?id=CVE-2004-1449
31 Dec 2004 — Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7 allows remote attackers to determine the location of files on a user's hard drive by obscuring a file upload control and tricking the user into dragging text into that control. • http://bugzilla.mozilla.org/show_bug.cgi?id=206859#c0 •
CVSS: 10.0EPSS: 15%CPEs: 34EXPL: 0CVE-2004-0903
https://notcve.org/view.php?id=CVE-2004-0903
24 Sep 2004 — Stack-based buffer overflow in the writeGroup function in nsVCardObj.cpp for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to execute arbitrary code via malformed VCard attachments that are not properly handled when previewing a message. • http://bugzilla.mozilla.org/show_bug.cgi?id=257314 •
CVSS: 6.5EPSS: 4%CPEs: 53EXPL: 1CVE-2004-0909
https://notcve.org/view.php?id=CVE-2004-0909
24 Sep 2004 — Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 may allow remote attackers to trick users into performing unexpected actions, including installing software, via signed scripts that request enhanced abilities using the enablePrivilege parameter, then modify the meaning of certain security-relevant dialog messages. • http://bugzilla.mozilla.org/show_bug.cgi?id=253942 •