CVSS: 7.5EPSS: 4%CPEs: 132EXPL: 0CVE-2008-3835 – mozilla: nsXMLDocument:: OnChannelRedirect() same-origin violation
https://notcve.org/view.php?id=CVE-2008-3835
24 Sep 2008 — The nsXMLDocument::OnChannelRedirect function in Mozilla Firefox before 2.0.0.17, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code via unknown vectors. La función nsXMLDocument::OnChannelRedirect en Firefox de Mozilla antes de 2.0.0.17, Thunderbird antes de 2.0.0.17 y SeaMonkey antes de 1.1.12 permite a atacantes remotos evitar "Same Origin Policy (Política de Mismo Origen)" y ejecutar código javaScript de... • http://download.novell.com/Download?buildid=WZXONb-tqBw~ • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 4%CPEs: 51EXPL: 0CVE-2008-3836
https://notcve.org/view.php?id=CVE-2008-3836
24 Sep 2008 — feedWriter in Mozilla Firefox before 2.0.0.17 allows remote attackers to execute scripts with chrome privileges via vectors related to feed preview and the (1) elem.doCommand, (2) elem.dispatchEvent, (3) _setTitleText, (4) _setTitleImage, and (5) _initSubscriptionUI functions. feedWriter en Firefox de Mozilla antes de 2.0.0.17 permite a atacantes remotos ejecutar secuencias de comandos con privilegios chrome mediante vectores relacionados con la previsualización feed y las funciones (1) elem.doCommand, (2) ... • http://download.novell.com/Download?buildid=WZXONb-tqBw~ • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 2%CPEs: 8EXPL: 0CVE-2008-3837 – mozilla: Forced mouse drag
https://notcve.org/view.php?id=CVE-2008-3837
24 Sep 2008 — Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, and SeaMonkey before 1.1.12, allow user-assisted remote attackers to move a window during a mouse click, and possibly force a file download or unspecified other drag-and-drop action, via a crafted onmousedown action that calls window.moveBy, a variant of CVE-2003-0823. Firefox de Mozilla antes de 2.0.0.17 y 3.x antes de 3.0.2 y SeaMonkey antes de 1.1.12, permiten a atacantes remotos ayudados por el usuario mover una ventana durante un click de ratón y po... • http://download.novell.com/Download?buildid=WZXONb-tqBw~ •
CVSS: 9.8EPSS: 35%CPEs: 9EXPL: 0CVE-2008-4058 – Mozilla privilege escalation via XPCnativeWrapper pollution
https://notcve.org/view.php?id=CVE-2008-4058
24 Sep 2008 — The XPConnect component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to "pollute XPCNativeWrappers" and execute arbitrary code with chrome privileges via vectors related to (1) chrome XBL and (2) chrome JS. El componente XPConnect en Mozilla Firefox antes de 2.0.0.17 y 3.x antes de 3.0.2, Thunderbird antes de 2.0.0.17 y SeaMonkey before 1.1.12 permite a atacantes remotos "contaminar XPCNativeWrappers" y ejecutar cód... • http://download.novell.com/Download?buildid=WZXONb-tqBw~ • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 69%CPEs: 65EXPL: 0CVE-2008-4059 – Mozilla privilege escalation via XPCnativeWrapper pollution
https://notcve.org/view.php?id=CVE-2008-4059
24 Sep 2008 — The XPConnect component in Mozilla Firefox before 2.0.0.17 allows remote attackers to "pollute XPCNativeWrappers" and execute arbitrary code with chrome privileges via vectors related to a SCRIPT element. El componente XPConnect en Firefox de Mozilla antes de 2.0.0.17 permite a atacantes remotos "contaminar XPCNativeWrappers" y ejecutar código de su elección con privilegios chrome mediante vectores relacionados con un elemento SCRIPT. • http://download.novell.com/Download?buildid=WZXONb-tqBw~ • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 70%CPEs: 134EXPL: 0CVE-2008-4060 – Mozilla privilege escalation via XPCnativeWrapper pollution
https://notcve.org/view.php?id=CVE-2008-4060
24 Sep 2008 — Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to create documents that lack script-handling objects, and execute arbitrary code with chrome privileges, via vectors related to (1) the document.loadBindingDocument function and (2) XSLT. Firefox de Mozilla antes de 2.0.0.17 y 3.x antes de 3.0.2, Thunderbird antes de 2.0.0.17, y SeaMonkey antes de 1.1.12 permite a atacantes remotos crear documentos que no tienen objetos de m... • http://download.novell.com/Download?buildid=WZXONb-tqBw~ • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 57%CPEs: 9EXPL: 0CVE-2008-4061 – Mozilla layout engine crash
https://notcve.org/view.php?id=CVE-2008-4061
24 Sep 2008 — Integer overflow in the MathML component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via an mtd element with a large integer value in the rowspan attribute, related to the layout engine. Desbordamiento de entero en el componente MathML de Mozilla Firefox antes de 2.0.0.17 y 3.x antes de 3.0.2, Thunderbird antes... • http://download.novell.com/Download?buildid=WZXONb-tqBw~ • CWE-189: Numeric Errors •
CVSS: 10.0EPSS: 13%CPEs: 9EXPL: 0CVE-2008-4062 – Mozilla crashes with evidence of memory corruption
https://notcve.org/view.php?id=CVE-2008-4062
24 Sep 2008 — Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the JavaScript engine and (1) misinterpretation of the characteristics of Namespace and QName in jsxml.c, (2) misuse of signed integers in the nsEscapeCount function in nsEscape.cpp, and (3) interaction of Jav... • http://download.novell.com/Download?buildid=WZXONb-tqBw~ • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 9%CPEs: 6EXPL: 0CVE-2008-4063 – Mozilla crashes with evidence of memory corruption
https://notcve.org/view.php?id=CVE-2008-4063
24 Sep 2008 — Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the layout engine and (1) a zero value of the "this" variable in the nsContentList::Item function; (2) interaction of the indic IME extension, a Hindi language selection, and the "g" character; and (3) interaction of the nsFrameList::SortByContentOrder function with a certain insufficie... • http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html •
CVSS: 10.0EPSS: 78%CPEs: 2EXPL: 0CVE-2008-4064 – Mozilla crashes with evidence of memory corruption
https://notcve.org/view.php?id=CVE-2008-4064
24 Sep 2008 — Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to graphics rendering and (1) handling of a long alert messagebox in the cairo_surface_set_device_offset function, (2) integer overflows when handling animated PNG data in the info_callback function in nsPNGDecoder.cpp, and (3) an integer overflow when handling SVG data in the nsSVGFEGauss... • http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html • CWE-399: Resource Management Errors •