CVSS: 10.0EPSS: 1%CPEs: 153EXPL: 0CVE-2013-0795 – Mozilla: Bypass of SOW protections allows cloning of protected nodes (MFSA 2013-36)
https://notcve.org/view.php?id=CVE-2013-0795
The System Only Wrapper (SOW) implementation in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 does not prevent use of the cloneNode method for cloning a protected node, which allows remote attackers to bypass the Same Origin Policy or possibly execute arbitrary JavaScript code with chrome privileges via a crafted web site. El System Only Wrapper (SOW) implementado en la aplicación Mozilla Firefox antes de v20.0, Firefox ESR v17.x antes v17.0.5, Thunderbird anterior a v17.0.5, Thunderbird ESR v17.x antes v17.0.5 y SeaMonkey antes de v2.17 no evita el uso del método cloneNode para clonar un nodo protegido, que permite a atacantes remotos evitar la política del mismo origen o posiblemente ejecutar código JavaScript arbitrario con privilegios de cromo a través de un sitio web manipulado. • http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.html http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00019.html http://lists.opensuse.org/opensuse-updates/2013-06/msg00012.html http://rhn.redhat.com/errata/RHSA-2013-0696.html http://rhn.redhat.com/errata/RHSA-2013-0697.html http://www.debian.org/security&#x • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.9EPSS: 0%CPEs: 34EXPL: 0CVE-2013-2566
https://notcve.org/view.php?id=CVE-2013-2566
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext. El algoritmo RC4, tal como se usa en el protocolo TLS y protocolo SSL, tiene muchos "single-byte biases", lo que hace que sea más fácil para atacantes remotos realizar ataques de recuperación de texto claro a través de análisis estadístico de texto cifrado en un gran número de sesiones que utilizan el mismo texto claro. • http://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html http://cr.yp.to/talks/2013.03.12/slides.pdf http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://marc.info/?l=bugtraq&m=143039468003789&w=2 http://my.opera.com/securitygroup/blog/2013/03/20/on-the-precariousness-of-rc4 http://security.gentoo.org/glsa/glsa-201406-19.xml http://www.isg.rhul.ac.uk/tls http://www.mozilla.org/security/announce/2013/mfsa2013& • CWE-326: Inadequate Encryption Strength •
CVSS: 10.0EPSS: 1%CPEs: 8EXPL: 0CVE-2011-3079
https://notcve.org/view.php?id=CVE-2011-3079
The Inter-process Communication (IPC) implementation in Google Chrome before 18.0.1025.168, as used in Mozilla Firefox before 38.0 and other products, does not properly validate messages, which has unspecified impact and attack vectors. La implementación de Inter-process Communication (IPC) en Google Chrome en versiones anteriores a 18.0.1025.168, tal como se utiliza en Mozilla Firefox en versiones anteriores a 38.0 y otros productos, no valida mensajes adecuadamente, lo que tiene un impacto y vectores de ataque no especificados. • http://code.google.com/p/chromium/issues/detail?id=117627 http://googlechromereleases.blogspot.com/2012/04/stable-channel-update_30.html http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html http://lists.opensuse.org/opensuse-updates/2015-05/msg00036.html http://osvdb.org/81645 http://rhn.redhat.com/errata/RHSA-2015-1012.html http://secunia.com/advisories/48992 http://www.debian.org/securi • CWE-399: Resource Management Errors •