CVSS: 9.8EPSS: 4%CPEs: 202EXPL: 0CVE-2009-1841 – Firefox JavaScript arbitrary code execution
https://notcve.org/view.php?id=CVE-2009-1841
12 Jun 2009 — js/src/xpconnect/src/xpcwrappedjsclass.cpp in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to execute arbitrary web script with the privileges of a chrome object, as demonstrated by the browser sidebar and the FeedWriter. js/src/xpconnect/src/xpcwrappedjsclass.cpp en Mozilla Firefox anterior a v3.0.11, Thunderbird anterior a v2.0.0.22, y SeaMonkey anterior a v1.1.17 permite a atacantes remotos ejecutar secuencias de comandos web de forma arb... • http://osvdb.org/55159 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.5EPSS: 5%CPEs: 2EXPL: 3CVE-2009-2044 – Mozilla Firefox 3.0.x - Large '.GIF' File Background Denial of Service
https://notcve.org/view.php?id=CVE-2009-2044
12 Jun 2009 — Mozilla Firefox 3.0.10 and earlier on Linux allows remote attackers to cause a denial of service (application crash) via a URI for a large GIF image in the BACKGROUND attribute of a BODY element. Mozilla Firefox 3.0.10 y anteriores en Linux permite a atacantes remotos producir una denegación de servicio (caída de aplicación) a través de un URI para una imagen GIF en el atributo "BACKGROUND" de un elemento "BODY" • https://www.exploit-db.com/exploits/33031 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 2%CPEs: 198EXPL: 0CVE-2009-1303 – Firefox 2 and 3 Layout engine crash
https://notcve.org/view.php?id=CVE-2009-1303
22 Apr 2009 — The browser engine in Mozilla Firefox before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corruption via vectors related to nsSVGElement::BindToTree. El navegador del motor en Mozilla Firefox versiones anteriores a v3.0.9, Thunderbird versiones anteriores a v2.0.0.22, y SeaMonkey versiones anteriores a v1.1.16 permite a atacantes remotos provocar una denegación de servicio (caída de aplica... • http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html • CWE-16: Configuration •
CVSS: 6.1EPSS: 1%CPEs: 102EXPL: 0CVE-2009-1306 – jar: scheme ignores the content-disposition: header on the inner URI
https://notcve.org/view.php?id=CVE-2009-1306
22 Apr 2009 — The jar: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not follow the Content-Disposition header of the inner URI, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly other attacks via an uploaded .jar file with a "Content-Disposition: attachment" designation. La implementación de jar: URI en Mozilla Firefox anteriores 3.0.9, Thunderbird, y SeaMonkey no cumplen la cabecera "Content-Disposition" de la URI interna, permitiendo a atacan... • http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html • CWE-16: Configuration •
CVSS: 9.1EPSS: 0%CPEs: 94EXPL: 0CVE-2009-1307 – view-source: protocol
https://notcve.org/view.php?id=CVE-2009-1307
22 Apr 2009 — The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to (1) bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; (2) read, create, or modify Local Shared Objects via a Flash file; or (3) bypass unspecified restrictions and render content via vectors involving a jar: URI. La implementación view-source: URI en Mozilla Firefox anteriores a v3.0.9, Thun... • http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 1%CPEs: 102EXPL: 1CVE-2009-1308 – Firefox XSS hazard using third-party stylesheets and XBL bindings
https://notcve.org/view.php?id=CVE-2009-1308
22 Apr 2009 — Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey allows remote attackers to inject arbitrary web script or HTML via vectors involving XBL JavaScript bindings and remote stylesheets, as exploited in the wild by a March 2009 eBay listing. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Mozilla Firefox anteriores a 3.0.9, Thunderbird, y SeaMonkey permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediant... • http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 1%CPEs: 102EXPL: 0CVE-2009-1309 – Firefox Same-origin violations in XMLHttpRequest and XPCNativeWrapper.toString
https://notcve.org/view.php?id=CVE-2009-1309
22 Apr 2009 — Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey do not properly implement the Same Origin Policy for (1) XMLHttpRequest, involving a mismatch for a document's principal, and (2) XPCNativeWrapper.toString, involving an incorrect __proto__ scope, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly other attacks via a crafted document. Mozilla Firefox anteriores a 3.0.9, Thunderbird, y SeaMonkey no implementan correctamente la política de mismo origen para (1) XMLH... • http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html • CWE-16: Configuration •
CVSS: 6.1EPSS: 0%CPEs: 92EXPL: 1CVE-2009-1310 – Firefox Malicious search plugins can inject code into arbitrary sites
https://notcve.org/view.php?id=CVE-2009-1310
22 Apr 2009 — Cross-site scripting (XSS) vulnerability in the MozSearch plugin implementation in Mozilla Firefox before 3.0.9 allows user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SearchForm element. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la implementación del plugin MozSearch en Mozilla Firefox anteriores a v3.0.9 permite a atacantes remotos con la intervención del usuario inyectar secuencias de comandos web o HTML de su elección mediante ... • http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 132EXPL: 1CVE-2009-1311 – Firefox POST data sent to wrong site when saving web page with embedded frame
https://notcve.org/view.php?id=CVE-2009-1311
22 Apr 2009 — Mozilla Firefox before 3.0.9 and SeaMonkey before 1.1.17 allow user-assisted remote attackers to obtain sensitive information via a web page with an embedded frame, which causes POST data from an outer page to be sent to the inner frame's URL during a SAVEMODE_FILEONLY save of the inner frame. Mozilla Firefox anteriores a v3.0.9 y SeaMonkey anteriores a v1.1.17 permite a atacantes remotos con la intervención del usuario obtener información sensible al utilizar una página web con un "frame" embebido, provoca... • http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 6%CPEs: 94EXPL: 1CVE-2009-1312 – Mozilla (Multiple Products) - Server Refresh Header Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2009-1312
22 Apr 2009 — Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header. NOTE: it was later reported that Firefox 3.6 a1 pre and Mozilla 1.7.x and earlier are also affected. Mozilla Firefox anteriores a v3.0.9 y SeaMonkey no bloquean el código "javascript": URIs en cabeceras "Refresh" ... • https://www.exploit-db.com/exploits/32942 • CWE-16: Configuration •