CVSS: 9.8EPSS: 0%CPEs: 203EXPL: 0CVE-2010-0179 – Firefox Arbitrary code execution with Firebug XMLHttpRequestSpy
https://notcve.org/view.php?id=CVE-2010-0179
05 Apr 2010 — Mozilla Firefox before 3.0.19 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, when the XMLHttpRequestSpy module in the Firebug add-on is used, does not properly handle interaction between the XMLHttpRequestSpy object and chrome privileged objects, which allows remote attackers to execute arbitrary JavaScript via a crafted HTTP response. Mozilla Firefox anteriores a v3.0.19 y v3.5.x anteriores a v3.5.8, y SeaMonkey anteriores a v2.0.3, cuando se utiliza el modulo XMLHttpRequestSpy en el complemento Fireb... • http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.5EPSS: 2%CPEs: 144EXPL: 0CVE-2010-0181
https://notcve.org/view.php?id=CVE-2010-0181
05 Apr 2010 — Mozilla Firefox before 3.5.9 and 3.6.x before 3.6.2, and SeaMonkey before 2.0.4, executes a mail application in situations where an IMG element has a SRC attribute that is a redirect to a mailto: URL, which allows remote attackers to cause a denial of service (excessive application launches) via an HTML document with many images. Mozilla Firefox anteriores a v3.5.9 y v3.6.x anteriores a v3.6.2, y SeaMonkey anteriores a v2.0.4, ejecuta la aplicación de correo en situaciones donde un elemento IMG tiene un atr... • http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 1%CPEs: 206EXPL: 0CVE-2010-0182 – mozilla: XMLDocument:: load() doesn't check nsIContentPolicy (MFSA 2010-24)
https://notcve.org/view.php?id=CVE-2010-0182
05 Apr 2010 — The XMLDocument::load function in Mozilla Firefox before 3.5.9 and 3.6.x before 3.6.2, Thunderbird before 3.0.4, and SeaMonkey before 2.0.4 does not perform the expected nsIContentPolicy checks during loading of content by XML documents, which allows attackers to bypass intended access restrictions via crafted content. La función XMLDocument::load en Mozilla Firefox anteriores a v3.5.9 y v3.6.x anteriores a v3.6.2, Thunderbird anteriores a v3.0.4, y SeaMonkey anteriores a v2.0.4 no realiza las comprobacione... • http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 4%CPEs: 205EXPL: 0CVE-2010-0175 – Mozilla Firefox nsTreeSelection EventListener Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-0175
02 Apr 2010 — Use-after-free vulnerability in the nsTreeSelection implementation in Mozilla Firefox before 3.0.19 and 3.5.x before 3.5.9, Thunderbird before 3.0.4, and SeaMonkey before 2.0.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors that trigger a call to the handler for the select event for XUL tree items. Vulnerabilidad de uso después de la liberación (Use after free)en la implementación nsTreeSelection en Mozilla Firefox anteriores a v3.0... • http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038367.html • CWE-399: Resource Management Errors CWE-416: Use After Free •
CVSS: 10.0EPSS: 5%CPEs: 206EXPL: 0CVE-2010-0176 – Mozilla Firefox nsTreeContentView Dangling Pointer Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-0176
02 Apr 2010 — Mozilla Firefox before 3.0.19, 3.5.x before 3.5.9, and 3.6.x before 3.6.2; Thunderbird before 3.0.4; and SeaMonkey before 2.0.4 do not properly manage reference counts for option elements in a XUL tree optgroup, which might allow remote attackers to execute arbitrary code via unspecified vectors that trigger access to deleted elements, related to a "dangling pointer vulnerability." Mozilla Firefox v3.0.19, v3.5.x antes de v3.5.9, y v3.6.x antes de v3.6.2; Thunderbird antes de v3.0.4, y SeaMonkey antes de v2... • http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038367.html • CWE-399: Resource Management Errors •
CVSS: 10.0EPSS: 7%CPEs: 144EXPL: 0CVE-2010-0177 – Mozilla Firefox PluginArray nsMimeType Dangling Pointer Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-0177
02 Apr 2010 — Mozilla Firefox before 3.0.19, 3.5.x before 3.5.9, and 3.6.x before 3.6.2, and SeaMonkey before 2.0.4, frees the contents of the window.navigator.plugins array while a reference to an array element is still active, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors, related to a "dangling pointer vulnerability." El objeto window.navigator.plugins en Mozilla Firefox anteriores a v3.0.19, 3.5.x anteriores a v3.5.9, y v3.6.x anterior... • http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html • CWE-399: Resource Management Errors •
CVSS: 10.0EPSS: 2%CPEs: 68EXPL: 0CVE-2010-0160 – Mozilla Firefox Web Worker Array Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-0160
21 Feb 2010 — The Web Worker functionality in Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly handle array data types for posted messages, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors. La funcionalidad Web Worker en Mozilla Firefox v3.0.x anterior a la v3.0.18 y 3.5.x anterior a la v3.5.8, y SeaMonkey anteriores a la v2.0.3, no manejan de forma a... • http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html • CWE-399: Resource Management Errors •
CVSS: 9.4EPSS: 0%CPEs: 33EXPL: 0CVE-2009-3988 – Mozilla Firefox showModalDialog Cross-Domain Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2009-3988
19 Feb 2010 — Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly restrict read access to object properties in showModalDialog, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted dialogArguments values. Mozilla Firefox v3.0.x anterior a la v3.0.18 y v3.5.x anterior a la v3.5.8, y SeaMonkey anterior a la v2.0.3, no restringen de forma adecuada el acceso a las propiedades del objeto en showModalDialo... • http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 0%CPEs: 78EXPL: 1CVE-2010-0648
https://notcve.org/view.php?id=CVE-2010-0648
18 Feb 2010 — Mozilla Firefox, possibly before 3.6, allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL in the HREF attribute of a stylesheet LINK element, and then reading the document.styleSheets[0].href property value, related to an IFRAME element. Mozilla Firefox, probablemente anterior v3.6, permite a atacantes remotos descubrir una redirección de URL, para la sesión de un usuario específico de un sitio web, por sustición de la URL ... • http://code.google.com/p/chromium/issues/detail?id=32309 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 0%CPEs: 72EXPL: 2CVE-2010-0220
https://notcve.org/view.php?id=CVE-2010-0220
07 Jan 2010 — The nsObserverList::FillObserverArray function in xpcom/ds/nsObserverList.cpp in Mozilla Firefox before 3.5.7 allows remote attackers to cause a denial of service (application crash) via a crafted web site that triggers memory consumption and an accompanying Low Memory alert dialog, and also triggers attempted removal of an observer from an empty observers array. La función nsObserverList::FillObserverArray en xpcom/ds/nsObserverList.cpp en Mozilla Firefox anterior a v3.5.7 permite a atacantes remotos provo... • http://hg.mozilla.org/mozilla-central/rev/51396f6c9f20 • CWE-399: Resource Management Errors •