CVSS: 4.0EPSS: 8%CPEs: 6EXPL: 3CVE-2006-2894 – Mozilla Firefox 1.x - JavaScript Key Filtering
https://notcve.org/view.php?id=CVE-2006-2894
Mozilla Firefox 1.5.0.4, 2.0.x before 2.0.0.8, Mozilla Suite 1.7.13, Mozilla SeaMonkey 1.0.2 and other versions before 1.1.5, and Netscape 8.1 and earlier allow user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename in a text box and using the OnKeyDown, OnKeyPress, and OnKeyUp Javascript keystroke events to change the focus and cause those characters to be inserted into a file upload input control, which can then upload the file when the user submits the form. • https://www.exploit-db.com/exploits/27987 https://www.exploit-db.com/exploits/27986 http://archives.neohapsis.com/archives/bugtraq/2007-02/0166.html http://archives.neohapsis.com/archives/bugtraq/2007-02/0187.html http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 http://lcamtuf.coredump.cx/focusbug http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046610.html http://lists.virus.org/full-disclosure-0702/msg00225.html http://secunia.com/advisories • CWE-20: Improper Input Validation •
CVSS: 6.4EPSS: 31%CPEs: 2EXPL: 0CVE-2006-2781 – (seamonkey): DOS/arbitrary code execution vuln with vcards
https://notcve.org/view.php?id=CVE-2006-2781
Double free vulnerability in nsVCard.cpp in Mozilla Thunderbird before 1.5.0.4 and SeaMonkey before 1.0.2 allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via a VCard that contains invalid base64 characters. • http://rhn.redhat.com/errata/RHSA-2006-0609.html http://secunia.com/advisories/20382 http://secunia.com/advisories/20394 http://secunia.com/advisories/20709 http://secunia.com/advisories/21134 http://secunia.com/advisories/21178 http://secunia.com/advisories/21183 http://secunia.com/advisories/21210 http://secunia.com/advisories/21269 http://secunia.com/advisories/21324 http://secunia.com/advisories/21336 http://secunia.com/advisories/21607 http://secunia.com/advisories&#x • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 94%CPEs: 2EXPL: 0CVE-2006-2782
https://notcve.org/view.php?id=CVE-2006-2782
Firefox 1.5.0.2 does not fix all test cases associated with CVE-2006-1729, which allows remote attackers to read arbitrary files by inserting the target filename into a text box, then turning that box into a file upload control. • http://rhn.redhat.com/errata/RHSA-2006-0609.html http://secunia.com/advisories/20376 http://secunia.com/advisories/20561 http://secunia.com/advisories/21134 http://secunia.com/advisories/21176 http://secunia.com/advisories/21178 http://secunia.com/advisories/21183 http://secunia.com/advisories/21188 http://secunia.com/advisories/21269 http://secunia.com/advisories/21270 http://secunia.com/advisories/21324 http://secunia.com/advisories/21336 http://secunia.com/advisories&#x • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 50%CPEs: 25EXPL: 0CVE-2006-2777
https://notcve.org/view.php?id=CVE-2006-2777
Unspecified vulnerability in Mozilla Firefox before 1.5.0.4 and SeaMonkey before 1.0.2 allows remote attackers to execute arbitrary code by using the nsISelectionPrivate interface of the Selection object to add a SelectionListener and create notifications that are executed in a privileged context. • http://secunia.com/advisories/20376 http://secunia.com/advisories/20394 http://secunia.com/advisories/20561 http://secunia.com/advisories/21176 http://secunia.com/advisories/21178 http://secunia.com/advisories/21183 http://secunia.com/advisories/21188 http://secunia.com/advisories/21324 http://secunia.com/advisories/21532 http://secunia.com/advisories/22066 http://securitytracker.com/id?1016202 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102763-1 http://www& •
CVSS: 9.3EPSS: 97%CPEs: 30EXPL: 0CVE-2006-1737
https://notcve.org/view.php?id=CVE-2006-1737
Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary bytecode via JavaScript with a large regular expression. • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html http://secunia.com/advisories/19631 http://secunia.com/advisories/19696 http://secunia.com/advisories/19714 http://secunia.com/advisories/19721 http://secunia.com/advisories/19729 http://secunia.com/advisories/19746 http://secunia.com/advisories/19759 http:&#x • CWE-189: Numeric Errors •