CVSS: 4.3EPSS: 7%CPEs: 23EXPL: 0CVE-2006-1732
https://notcve.org/view.php?id=CVE-2006-1732
Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to bypass same-origin protections and conduct cross-site scripting (XSS) attacks via unspecified vectors involving the window.controllers array. • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html http://secunia.com/advisories/19631 http://secunia.com/advisories/19696 http://secunia.com/advisories/19714 http://secunia.com/advisories/19721 http://secunia.com/advisories/19729 http://secunia.com/advisories/19746 http://secunia.com/advisories/19759 http:&#x •
CVSS: 7.5EPSS: 9%CPEs: 4EXPL: 0CVE-2006-1531
https://notcve.org/view.php?id=CVE-2006-1531
Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML. NOTE: due to the lack of sufficient public details from the vendor as of 20060413, it is unclear how CVE-2006-1529, CVE-2006-1530, CVE-2006-1531, and CVE-2006-1723 are different. • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt http://secunia.com/advisories/19631 http://secunia.com/advisories/19649 http://secunia.com/advisories/19863 http://secunia.com/advisories/19941 http://secunia.com/advisories/21033 http://secunia.com/advisories/22065 http://secunia.com/advisories/22066 http://securitytracker.com/id?1015919 http://securitytracker.com/id?1015920 http://securitytracker.com/id?1015921 http://www.debian.org/security/2006/ds •
CVSS: 9.3EPSS: 95%CPEs: 18EXPL: 3CVE-2006-0884 – Mozilla (Multiple Products) - iFrame JavaScript Execution
https://notcve.org/view.php?id=CVE-2006-0884
The WYSIWYG rendering engine ("rich mail" editor) in Mozilla Thunderbird 1.0.7 and earlier allows user-assisted attackers to bypass javascript security settings and obtain sensitive information or cause a crash via an e-mail containing a javascript URI in the SRC attribute of an IFRAME tag, which is executed when the user edits the e-mail. • https://www.exploit-db.com/exploits/27257 ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html http://secunia.com/advisories/19721 http://secunia.com/advisories/19811 http://secunia.com/advisories/19821 http://secunia.com/advisories/19823 http://secunia.com/advisories/19863 http://secunia.com/advisories/19902 • CWE-20: Improper Input Validation •
CVSS: 5.1EPSS: 2%CPEs: 7EXPL: 0CVE-2006-0236
https://notcve.org/view.php?id=CVE-2006-0236
GUI display truncation vulnerability in Mozilla Thunderbird 1.0.2, 1.0.6, and 1.0.7 allows user-assisted attackers to execute arbitrary code via an attachment with a filename containing a large number of spaces ending with a dangerous extension that is not displayed by Thunderbird, along with an inconsistent Content-Type header, which could be used to trick a user into downloading dangerous content by dragging or saving the attachment. • http://secunia.com/advisories/15907 http://secunia.com/secunia_research/2005-22/advisory http://www.mandriva.com/security/advisories?name=MDKSA-2006:021 http://www.securityfocus.com/archive/1/422148/100/0/threaded http://www.securityfocus.com/bid/16271 http://www.vupen.com/english/advisories/2006/0230 https://bugzilla.mozilla.org/show_bug.cgi?id=300246 https://exchange.xforce.ibmcloud.com/vulnerabilities/24164 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.0EPSS: 11%CPEs: 24EXPL: 2CVE-2005-4809 – Mozilla Suite/Firefox/Thunderbird - Nested Anchor Tag Status Bar Spoofing
https://notcve.org/view.php?id=CVE-2005-4809
Mozilla Firefox 1.0.1 and possibly other versions, including Mozilla and Thunderbird, allows remote attackers to spoof the URL in the Status Bar via an A HREF tag that contains a TABLE tag that contains another A tag. • https://www.exploit-db.com/exploits/25221 http://marc.info/?l=full-disclosure&m=111073068631287&w=2 http://secunia.com/advisories/14568 http://securitytracker.com/id?1013423 http://www.osvdb.org/14885 http://www.securityfocus.com/bid/12798 http://www.vupen.com/english/advisories/2005/0260 https://exchange.xforce.ibmcloud.com/vulnerabilities/19540 •