CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2006-2057
https://notcve.org/view.php?id=CVE-2006-2057
26 Apr 2006 — Argument injection vulnerability in Mozilla Firefox 1.0.6 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment. NOTE: it is not clear whether this issue is implementation-specific or a problem in the Microsoft API. • http://ingehenriksen.blogspot.com/2006/04/office-2003-file-attachment-exploit.html • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 8.8EPSS: 96%CPEs: 1EXPL: 4CVE-2006-1993 – Mozilla Firefox 1.5.0.2 - 'js320.dll/xpcom_core.dll' Denial of Service (PoC)
https://notcve.org/view.php?id=CVE-2006-1993
25 Apr 2006 — Mozilla Firefox 1.5.0.2, when designMode is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain Javascript that is not properly handled by the contentWindow.focus method in an iframe, which causes a reference to a deleted controller context object. NOTE: this was originally claimed to be a buffer overflow in (1) js320.dll and (2) xpcom_core.dll, but the vendor disputes this claim. • https://www.exploit-db.com/exploits/1716 • CWE-399: Resource Management Errors •
CVSS: 5.1EPSS: 2%CPEs: 5EXPL: 0CVE-2006-1942
https://notcve.org/view.php?id=CVE-2006-1942
20 Apr 2006 — Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to open local files via a web page with an IMG element containing a SRC attribute with a non-image file:// URL, then tricking the user into selecting View Image for the broken image, as demonstrated using a .wma file to launch Windows Media Player, or by referencing an "alternate web page." • http://secunia.com/advisories/19698 •
CVSS: 10.0EPSS: 70%CPEs: 1EXPL: 0CVE-2006-1790
https://notcve.org/view.php?id=CVE-2006-1790
14 Apr 2006 — A regression fix in Mozilla Firefox 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the InstallTrigger.install method, which leads to memory corruption. • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 96%CPEs: 29EXPL: 0CVE-2006-1738
https://notcve.org/view.php?id=CVE-2006-1738
14 Apr 2006 — Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) by changing the (1) -moz-grid and (2) -moz-grid-group display styles. • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt •
CVSS: 9.8EPSS: 97%CPEs: 30EXPL: 0CVE-2006-1737
https://notcve.org/view.php?id=CVE-2006-1737
14 Apr 2006 — Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary bytecode via JavaScript with a large regular expression. • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt • CWE-189: Numeric Errors •
CVSS: 9.8EPSS: 96%CPEs: 4EXPL: 0CVE-2006-0749 – Mozilla Firefox Tag Parsing Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2006-0749
14 Apr 2006 — nsHTMLContentSink.cpp in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors involving a "particular sequence of HTML tags" that leads to memory corruption. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of the Mozilla/Firefox web browser and Thunderbird e-mail client. User inte... • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt • CWE-399: Resource Management Errors •
CVSS: 9.8EPSS: 96%CPEs: 32EXPL: 0CVE-2006-1730 – Mozilla Firefox CSS Letter-Spacing Heap Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2006-1730
14 Apr 2006 — Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via a large number in the CSS letter-spacing property that leads to a heap-based buffer overflow. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of the Mozilla/Firefox web browser and Thunderbird e-mail client. User interaction is required to exploit this vulnerabilit... • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt • CWE-189: Numeric Errors •
CVSS: 9.8EPSS: 21%CPEs: 30EXPL: 0CVE-2006-1736
https://notcve.org/view.php?id=CVE-2006-1736
14 Apr 2006 — Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to trick users into downloading and saving an executable file via an image that is overlaid by a transparent image link that points to the executable, which causes the executable to be saved when the user clicks the "Save image as..." option. NOTE: this attack is made easier due to a GUI truncation issue that prevents the user from seeing the malicious extension when there is ... • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt •
CVSS: 9.8EPSS: 80%CPEs: 26EXPL: 0CVE-2006-1726
https://notcve.org/view.php?id=CVE-2006-1726
14 Apr 2006 — Unspecified vulnerability in Firefox and Thunderbird 1.5 before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to bypass the js_ValueToFunctionObject check and execute arbitrary code via unknown vectors involving setTimeout and Firefox' ForEach method. • http://secunia.com/advisories/19631 • CWE-264: Permissions, Privileges, and Access Controls •