CVSS: 8.8EPSS: 0%CPEs: 86EXPL: 0CVE-2011-3004
https://notcve.org/view.php?id=CVE-2011-3004
29 Sep 2011 — The JSSubScriptLoader in Mozilla Firefox 4.x through 6 and SeaMonkey before 2.4 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privileges via a crafted web site that leverages certain unwrapping behavior. JSSubScriptLoader en Mozilla Firefox 4.x hasta la versión 6 y SeaMonkey anteriores a la 2.4 no maneja apropiadamente XPCNativeWrappers durante llamadas al método loadSubScript en un complemento, lo que fac... • http://www.mandriva.com/security/advisories?name=MDVSA-2011:141 • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 5%CPEs: 207EXPL: 0CVE-2011-3232
https://notcve.org/view.php?id=CVE-2011-3232
29 Sep 2011 — YARR, as used in Mozilla Firefox before 7.0, Thunderbird before 7.0, and SeaMonkey before 2.4, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted JavaScript. Yarr, tal como se utiliza en Mozilla Firefox anterior a v7.0, Thunderbird anterior a v7.0, y SeaMonkey antes de v2.4, permite a atacantes remotos causar una denegación de servicio (caída de aplicación) o posiblemente ejecutar código de su elección a través de JavaScript modificado. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 0CVE-2011-3002
https://notcve.org/view.php?id=CVE-2011-3002
29 Sep 2011 — Almost Native Graphics Layer Engine (ANGLE), as used in Mozilla Firefox before 7.0 and SeaMonkey before 2.4, does not validate the return value of a GrowAtomTable function call, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a memory-allocation error and a resulting buffer overflow. Almost Native Graphics Layer Engine (ANGLE), como el usado en Mozilla Firefox anteriores a v7.0 y SeaMonkey anteriores a v2.4, no valida... • http://www.mandriva.com/security/advisories?name=MDVSA-2011:141 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 60%CPEs: 207EXPL: 0CVE-2011-2995 – Mozilla: Miscellaneous memory safety hazards (MFSA 2011-36)
https://notcve.org/view.php?id=CVE-2011-2995
29 Sep 2011 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador de Mozilla Firefox anteriores a v3.6.23 y 4.x hasta v6, Thunderbird anteriores a v7.0 y SeaMonkey anteriores a v2.4, permiten a atac... • http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2011-3866
https://notcve.org/view.php?id=CVE-2011-3866
29 Sep 2011 — Mozilla Firefox before 7.0 and SeaMonkey before 2.4 do not properly restrict availability of motion data events, which makes it easier for remote attackers to read keystrokes by leveraging JavaScript code running in a background tab. Mozilla Firefox antes de v7.0 y SeaMonkey antes de v2.4 no restringe correctamente la disponibilidad de los datos de movimiento de eventos, lo que hace que sea más fácil para los atacantes remotos leer las pulsaciones de teclado mediante el aprovechamiento de código JavaScript ... • http://www.mozilla.org/security/announce/2011/mfsa2011-45.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 42%CPEs: 171EXPL: 0CVE-2011-2997
https://notcve.org/view.php?id=CVE-2011-2997
29 Sep 2011 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador de Mozilla Firefox anteriores a v6, Thunderbird anteriores a v7.0 y SeaMonkey anteriores a v2.4, permiten a atacantes remotos causar una denegación de servicio (c... • http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html •
CVSS: 7.5EPSS: 0%CPEs: 74EXPL: 0CVE-2011-2990
https://notcve.org/view.php?id=CVE-2011-2990
18 Aug 2011 — The implementation of Content Security Policy (CSP) violation reports in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, and possibly other products does not remove proxy-authorization credentials from the listed request headers, which allows attackers to obtain sensitive information by reading a report, related to incorrect host resolution that occurs with certain redirects. La implementación de los informes de violación de la Política de Seguridad de Contenido (CSP) en Mozilla Firefox versiones 4... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-255: Credentials Management Errors •
CVSS: 8.1EPSS: 0%CPEs: 271EXPL: 0CVE-2011-2983 – Mozilla: Private data leakage using RegExp.input
https://notcve.org/view.php?id=CVE-2011-2983
18 Aug 2011 — Mozilla Firefox before 3.6.20, Thunderbird 2.x and 3.x before 3.1.12, SeaMonkey 1.x and 2.x, and possibly other products does not properly handle the RegExp.input property, which allows remote attackers to bypass the Same Origin Policy and read data from a different domain via a crafted web site, possibly related to a use-after-free. Firefox anterior a versión 3.6.20, Thunderbird versiones 2.x y versiones 3.x anteriores a 3.1.12, SeaMonkey versiones 1.x y 2.x, y posiblemente otros productos de Mozilla, no m... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 156EXPL: 0CVE-2011-2986
https://notcve.org/view.php?id=CVE-2011-2986
18 Aug 2011 — Mozilla Firefox 4.x through 5, Thunderbird before 6, SeaMonkey 2.x before 2.3, and possibly other products, when the Direct2D (aka D2D) API is used on Windows, allows remote attackers to bypass the Same Origin Policy, and obtain sensitive image data from a different domain, by inserting this data into a canvas. Firefox versiones 4.x hasta 5, Thunderbird anterior a versión 6, SeaMonkey versiones 2.x anteriores a 2.3, y posiblemente otros productos de Mozilla, cuando la API Direct2D (también se conoce como D2... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 10%CPEs: 214EXPL: 0CVE-2011-2982 – Mozilla: Miscellaneous memory safety hazards
https://notcve.org/view.php?id=CVE-2011-2982
18 Aug 2011 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.20, Thunderbird 2.x and 3.x before 3.1.12, SeaMonkey 1.x and 2.x, and possibly other products allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador en Firefox anterior a versión 3.6.20, Thunderbird versiones 2.x y versiones 3.x anteriores a 3.1.12, SeaMonke... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html •