CVSS: 6.5EPSS: 0%CPEs: 53EXPL: 0CVE-2004-1156
https://notcve.org/view.php?id=CVE-2004-1156
10 Dec 2004 — Mozilla before 1.7.6, and Firefox before 1.0.1, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability. • http://secunia.com/advisories/13129 •
CVSS: 6.5EPSS: 1%CPEs: 3EXPL: 1CVE-2004-1639
https://notcve.org/view.php?id=CVE-2004-1639
26 Oct 2004 — Mozilla Firefox before 0.10, Mozilla 5.0, and Gecko 20040913 allows remote attackers to cause a denial of service (application crash or memory consumption) via a large binary file with a .html extension. • http://archives.neohapsis.com/archives/vulnwatch/2004-q4/0017.html •
CVSS: 7.5EPSS: 0%CPEs: 30EXPL: 2CVE-2004-1381 – Multiple Browsers - Tabbed Browsing
https://notcve.org/view.php?id=CVE-2004-1381
20 Oct 2004 — Firefox before 1.0 and Mozilla before 1.7.5 allow inactive (background) tabs to focus on input being entered in the active tab, as originally reported using form fields, which allows remote attackers to steal sensitive data that is intended for other sites, which could facilitate phishing attacks. • https://www.exploit-db.com/exploits/589 •
CVSS: 5.0EPSS: 0%CPEs: 30EXPL: 1CVE-2004-1380 – Multiple Browsers - Tabbed Browsing
https://notcve.org/view.php?id=CVE-2004-1380
20 Oct 2004 — Firefox before 1.0 and Mozilla before 1.7.5 allows inactive (background) tabs to launch dialog boxes, which can allow remote attackers to spoof the dialog boxes from web sites in other windows and facilitate phishing attacks, aka the "Dialog Box Spoofing Vulnerability." • https://www.exploit-db.com/exploits/589 •
CVSS: 8.1EPSS: 1%CPEs: 27EXPL: 0CVE-2004-0867
https://notcve.org/view.php?id=CVE-2004-0867
24 Sep 2004 — Mozilla Firefox 0.9.2 allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk, and .sch.uk, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session. NOTE: it was later reported that 2.x is also affected. Mozilla Firefox 0.9.2 pemite a sitios web establecer cookies para dominios de nivel superior específicos de países, como .ltd.uk, .plc.uk, y .sch.uk, lo que podría permitir a atacantes remotos realizar ataques de fijac... • http://kuza55.blogspot.com/2008/02/understanding-cookie-security.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 16%CPEs: 38EXPL: 0CVE-2004-0904
https://notcve.org/view.php?id=CVE-2004-0904
24 Sep 2004 — Integer overflow in the bitmap (BMP) decoder for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote attackers to execute arbitrary code via wide bitmap files that trigger heap-based buffer overflows. • http://bugzilla.mozilla.org/show_bug.cgi?id=255067 •
CVSS: 8.1EPSS: 0%CPEs: 27EXPL: 0CVE-2004-0866
https://notcve.org/view.php?id=CVE-2004-0866
16 Sep 2004 — Internet Explorer 6.0 allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk, and .sch.uk, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session. • http://marc.info/?l=bugtraq&m=109536612321898&w=2 •
CVSS: 9.6EPSS: 2%CPEs: 62EXPL: 1CVE-2004-0905
https://notcve.org/view.php?id=CVE-2004-0905
14 Sep 2004 — Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to perform cross-domain scripting and possibly execute arbitrary code by convincing a user to drag and drop javascript: links to a frame or page in another domain. • http://bugzilla.mozilla.org/show_bug.cgi?id=250862 •
CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 0CVE-2004-0779
https://notcve.org/view.php?id=CVE-2004-0779
14 Aug 2004 — The (1) Mozilla 1.6, (2) Firebird 0.7 and (3) Firefox 0.8 web browsers do not properly verify that cached passwords for SSL encrypted sites are only sent via SSL encrypted sessions to the site, which allows a remote attacker to cause a cached password to be sent in cleartext to a spoofed site. Los navegadores Mozilla 1.6, Firebird 0.7 y Firefox 0.8 no verifican adecuadamente que las contraseñas almacenadas en caché de sitios cifrados con SSL sean sólo enviadas mediante sesiones cifradas con el sitio, lo que... • http://bugzilla.mozilla.org/show_bug.cgi?id=226278 •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2004-0765
https://notcve.org/view.php?id=CVE-2004-0765
03 Aug 2004 — The cert_TestHostName function in Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, only checks the hostname portion of a certificate when the hostname portion of the URI is not a fully qualified domain name (FQDN), which allows remote attackers to spoof trusted certificates. La función cet_TestHostName en Mozilla anteriores a 1.7, Firefox anteriores a 0.9, y Thunderbird anteriores a 0.7, sólo comprueba la porción de nombre de máquina de un certificado cuando la porción de nombre de máquin... • http://bugzilla.mozilla.org/show_bug.cgi?id=234058 •