CVSS: 5.5EPSS: 0%CPEs: 31EXPL: 0CVE-2005-0578
https://notcve.org/view.php?id=CVE-2005-0578
27 Feb 2005 — Firefox before 1.0.1 and Mozilla Suite before 1.7.6 use a predictable filename for the plugin temporary directory, which allows local users to delete arbitrary files of other users via a symlink attack on the plugtmp directory. • http://www.gentoo.org/security/en/glsa/glsa-200503-10.xml •
CVSS: 9.8EPSS: 37%CPEs: 1EXPL: 2CVE-2005-0527
https://notcve.org/view.php?id=CVE-2005-0527
25 Feb 2005 — Firefox 1.0 allows remote attackers to execute arbitrary code via plugins that load "privileged content" into frames, as demonstrated using certain XUL events when a user drags a scrollbar two times, aka "Firescrolling." • http://marc.info/?l=bugtraq&m=110935267500395&w=2 •
CVSS: 9.8EPSS: 4%CPEs: 1EXPL: 1CVE-2005-0230
https://notcve.org/view.php?id=CVE-2005-0230
10 Feb 2005 — Firefox 1.0 does not prevent the user from dragging an executable file to the desktop when it has an image/gif content type but has a dangerous extension such as .bat or .exe, which allows remote attackers to bypass the intended restriction and execute arbitrary commands via malformed GIF files that can still be parsed by the Windows batch file parser, aka "firedragging." • http://marc.info/?l=bugtraq&m=110780995232064&w=2 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2005-0232
https://notcve.org/view.php?id=CVE-2005-0232
08 Feb 2005 — Firefox 1.0 allows remote attackers to modify Boolean configuration parameters for the about:config site by using a plugin such as Flash, and the -moz-opacity filter, to display the about:config site then cause the user to double-click at a certain screen position, aka "Fireflashing." • http://marc.info/?l=bugtraq&m=110781055630856&w=2 •
CVSS: 7.5EPSS: 72%CPEs: 6EXPL: 7CVE-2005-0233
https://notcve.org/view.php?id=CVE-2005-0233
07 Feb 2005 — The International Domain Name (IDN) support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks. • http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 6CVE-2005-0231
https://notcve.org/view.php?id=CVE-2005-0231
07 Feb 2005 — Firefox 1.0 does not invoke the Javascript Security Manager when a user drags a javascript: or data: URL to a tab, which allows remote attackers to bypass the security model, aka "firetabbing." • http://marc.info/?l=bugtraq&m=110781134617144&w=2 •
CVSS: 9.8EPSS: 0%CPEs: 9EXPL: 0CVE-2005-0150
https://notcve.org/view.php?id=CVE-2005-0150
29 Jan 2005 — Firefox before 1.0 allows the user to store a (1) javascript: or (2) data: URLs as a Livefeed bookmark, then executes it in the security context of the currently loaded page when the user later accesses the bookmark, which could allow remote attackers to execute arbitrary code. • http://www.mozilla.org/security/announce/mfsa2005-12.html •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2005-0142
https://notcve.org/view.php?id=CVE-2005-0142
29 Jan 2005 — Firefox 0.9, Thunderbird 0.6 and other versions before 0.9, and Mozilla 1.7 before 1.7.5 save temporary files with world-readable permissions, which allows local users to read certain web content or attachments that belong to other users, e.g. content that is managed by helper applications such as PDF. • http://secunia.com/advisories/19823 •
CVSS: 9.1EPSS: 0%CPEs: 10EXPL: 0CVE-2005-0141
https://notcve.org/view.php?id=CVE-2005-0141
29 Jan 2005 — Firefox before 1.0 and Mozilla before 1.7.5 allow remote attackers to load local files via links "with a custom getter and toString method" that are middle-clicked by the user to be opened in a new tab. • http://www.mozilla.org/security/announce/mfsa2005-01.html •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2005-0146
https://notcve.org/view.php?id=CVE-2005-0146
29 Jan 2005 — Firefox before 1.0 and Mozilla before 1.7.5 allow remote attackers to obtain sensitive data from the clipboard via Javascript that generates a middle-click event on systems for which a middle-click performs a paste operation. • http://www.mozilla.org/security/announce/mfsa2005-08.html •