CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2011-3866
https://notcve.org/view.php?id=CVE-2011-3866
29 Sep 2011 — Mozilla Firefox before 7.0 and SeaMonkey before 2.4 do not properly restrict availability of motion data events, which makes it easier for remote attackers to read keystrokes by leveraging JavaScript code running in a background tab. Mozilla Firefox antes de v7.0 y SeaMonkey antes de v2.4 no restringe correctamente la disponibilidad de los datos de movimiento de eventos, lo que hace que sea más fácil para los atacantes remotos leer las pulsaciones de teclado mediante el aprovechamiento de código JavaScript ... • http://www.mozilla.org/security/announce/2011/mfsa2011-45.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 1%CPEs: 204EXPL: 0CVE-2011-2999 – Mozilla: XSS via plugins and shadowed window.location object (MFSA 2011-38)
https://notcve.org/view.php?id=CVE-2011-2999
29 Sep 2011 — Mozilla Firefox before 3.6.23 and 4.x through 5, Thunderbird before 6.0, and SeaMonkey before 2.3 do not properly handle "location" as the name of a frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, a different vulnerability than CVE-2010-0170. Mozilla Firefox anteriores a v3.6.23 y v4.x hasta v5,Thunderbird anteriores a v6.0 y SeaMonkey anteriores a v2.3 no gestionan adecuadamente "Location" como el nombre de un marco, que permite a atacantes remotos evitar la "S... • http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 0CVE-2011-3002
https://notcve.org/view.php?id=CVE-2011-3002
29 Sep 2011 — Almost Native Graphics Layer Engine (ANGLE), as used in Mozilla Firefox before 7.0 and SeaMonkey before 2.4, does not validate the return value of a GrowAtomTable function call, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a memory-allocation error and a resulting buffer overflow. Almost Native Graphics Layer Engine (ANGLE), como el usado en Mozilla Firefox anteriores a v7.0 y SeaMonkey anteriores a v2.4, no valida... • http://www.mandriva.com/security/advisories?name=MDVSA-2011:141 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 60%CPEs: 207EXPL: 0CVE-2011-2995 – Mozilla: Miscellaneous memory safety hazards (MFSA 2011-36)
https://notcve.org/view.php?id=CVE-2011-2995
29 Sep 2011 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador de Mozilla Firefox anteriores a v3.6.23 y 4.x hasta v6, Thunderbird anteriores a v7.0 y SeaMonkey anteriores a v2.4, permiten a atac... • http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html •
CVSS: 9.8EPSS: 21%CPEs: 207EXPL: 0CVE-2011-3000 – Mozilla: Defense against multiple Location headers due to CRLF Injection (MFSA 2011-39)
https://notcve.org/view.php?id=CVE-2011-3000
29 Sep 2011 — Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses that contain multiple Location, Content-Length, or Content-Disposition headers, which makes it easier for remote attackers to conduct HTTP response splitting attacks via crafted header values. Mozilla Firefox anterior a v3.6.23 y v4.x hasta v6, Thunderbird anteriores a v7.0, y SeaMonkey anteriores a v2.4 no gestionan adecuadamente las respuestas HTTP que contienen cabeceras... • http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.1EPSS: 0%CPEs: 271EXPL: 0CVE-2011-2983 – Mozilla: Private data leakage using RegExp.input
https://notcve.org/view.php?id=CVE-2011-2983
18 Aug 2011 — Mozilla Firefox before 3.6.20, Thunderbird 2.x and 3.x before 3.1.12, SeaMonkey 1.x and 2.x, and possibly other products does not properly handle the RegExp.input property, which allows remote attackers to bypass the Same Origin Policy and read data from a different domain via a crafted web site, possibly related to a use-after-free. Firefox anterior a versión 3.6.20, Thunderbird versiones 2.x y versiones 3.x anteriores a 3.1.12, SeaMonkey versiones 1.x y 2.x, y posiblemente otros productos de Mozilla, no m... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 1%CPEs: 159EXPL: 0CVE-2011-2981 – Mozilla: Privilege escalation using event handlers
https://notcve.org/view.php?id=CVE-2011-2981
18 Aug 2011 — The event-management implementation in Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly select the context for script to run in, which allows remote attackers to bypass the Same Origin Policy or execute arbitrary JavaScript code with chrome privileges via a crafted web site. La implementación de gestión de eventos en Firefox anterior a versión 3.6.20, SeaMonkey versiones 2.x, Thunderbird versiones 3.x anteriores a 3.1.12, y posiblemen... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-16: Configuration •
CVSS: 7.3EPSS: 1%CPEs: 134EXPL: 0CVE-2011-2980
https://notcve.org/view.php?id=CVE-2011-2980
18 Aug 2011 — Untrusted search path vulnerability in the ThinkPadSensor::Startup function in Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12, allows local users to gain privileges by leveraging write access in an unspecified directory to place a Trojan horse DLL that is loaded into the running Firefox process. Una vulnerabilidad de ruta (path) de búsqueda no confiable en la función ThinkPadSensor::Startup en Firefox anterior a versión 3.6.20, Thunderbird versiones 3.x anteriores a 3.1.12 de Mozilla, permite ... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html •
CVSS: 10.0EPSS: 10%CPEs: 214EXPL: 0CVE-2011-2982 – Mozilla: Miscellaneous memory safety hazards
https://notcve.org/view.php?id=CVE-2011-2982
18 Aug 2011 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.20, Thunderbird 2.x and 3.x before 3.1.12, SeaMonkey 1.x and 2.x, and possibly other products allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador en Firefox anterior a versión 3.6.20, Thunderbird versiones 2.x y versiones 3.x anteriores a 3.1.12, SeaMonke... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html •
CVSS: 10.0EPSS: 1%CPEs: 210EXPL: 0CVE-2011-2984 – Mozilla: Privilege escalation dropping a tab element in content area
https://notcve.org/view.php?id=CVE-2011-2984
18 Aug 2011 — Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering for drop events. Firefox anterior a versión 3.6.20, SeaMonkey versiones 2.x, Thunderbird versiones 3.x anteriores a 3.1.12, y posiblemente otros productos de Mozilla, no manejan apropiadamente la caída de un elemen... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •