CVSS: 4.3EPSS: 0%CPEs: 116EXPL: 0CVE-2011-3663
https://notcve.org/view.php?id=CVE-2011-3663
Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to capture keystrokes entered on a web page, even when JavaScript is disabled, by using SVG animation accessKey events within that web page. Mozilla Firefox versiones 4.x hasta 8.0, Thunderbird versiones 5.0 hasta 8.0, y SeaMonkey anterior a versión 2.6, Permitir a los atacantes remotos capturar las pulsaciones de teclas (keystrokes) introducidas en una página web, incluso cuando JavaScript está deshabilitado, mediante el uso de eventos accessKey de animación SVG dentro de esa página web. • http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00009.html http://osvdb.org/77954 http://secunia.com/advisories/47302 http://secunia.com/advisories/47334 http://secunia.com/advisories/49055 http://www.mandriva.com/security/advisories?name=MDVSA-2011:192 http://www.mozilla.org/security/announce/2011/mfsa2011-56.html http://www.securitytracker.com/id?1026445 http://www.securitytracker.com/id?1026446 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 5%CPEs: 100EXPL: 0CVE-2011-3665
https://notcve.org/view.php?id=CVE-2011-3665
Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an Ogg VIDEO element that is not properly handled after scaling. Mozilla Firefox v4.x hasta v8.0, Thunderbird v5.0 hasta v8.0, y SeaMonkey antes de v2.6, permiten a atacantes remotos provocar una denegación de servicio (caída de la aplicación) o posiblemente tener otro impacto no especificado a través de un elemento VIDEO Ogg que no sea manipulado apropiadamente despues del escalado. • http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00009.html http://osvdb.org/77956 http://secunia.com/advisories/47302 http://secunia.com/advisories/47334 http://www.mandriva.com/security/advisories?name=MDVSA-2011:192 http://www.mozilla.org/security/announce/2011/mfsa2011-58.html http://www.securitytracker.com/id?1026445 http://www.securitytracker.com/id?1026446 http://www.securitytracker.com/id • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 95%CPEs: 3EXPL: 1CVE-2011-3658 – Mozilla Firefox nsSVGValue Out-of-Bounds Access Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-3658
The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via vectors involving removal of SVG elements. La implementación de SVG en Mozilla Firefox v8.0, Thunderbird v8.0, y SeaMonkey v2.6, no interactua correctamente con los manejadores de eventos DOMAttrModified, lo que permite a atacantes remotos provocar una denegación de servicio (acceso fuera de límites de memoria) o posiblemente tener otro impacto no especificado a través de vectores que implican la eliminación de elementos SVG. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Mozilla Firefox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of nsSVGValue observers. A certain method call can be made to loop excessively causing an out-of-bounds memory access. • https://www.exploit-db.com/exploits/18847 http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00009.html http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html http://osvdb.org/77953 http://secunia.com/advisories/47302 http://secunia.com/advisories/47334 http://secunia.com/advisories/48495 http://secunia.com/advisories/48553 http://secunia.com/advisories/48823 http://secunia.com/advi • CWE-399: Resource Management Errors •
CVSS: 6.8EPSS: 0%CPEs: 226EXPL: 0CVE-2011-3666
https://notcve.org/view.php?id=CVE-2011-3666
Mozilla Firefox before 3.6.25 and Thunderbird before 3.1.17 on Mac OS X do not consider .jar files to be executable files, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted file. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-2372 on Mac OS X. Mozilla Firefox antes de v3.6.25 y Thunderbird antes de v3.1.17 en Mac OS X no consideran los archivos .jar como ejecutables, lo que permite a atacantes remotos asistidos por el usurio evitar las restricciones de acceso intecionadas a través de un archivo. NOTA: esta vulnerabilidad existe debido a una solución incorrecta de CVE-2011-2372 en Mac OS X. • http://www.mozilla.org/security/announce/2011/mfsa2011-59.html http://www.securitytracker.com/id?1026445 http://www.securitytracker.com/id?1026447 https://bugzilla.mozilla.org/show_bug.cgi?id=704622 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14831 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2011-3339
https://notcve.org/view.php?id=CVE-2011-3339
Cross-site scripting (XSS) vulnerability in the Admin Control Center in Sentinel HASP Run-time Environment 5.95 and earlier in SafeNet Sentinel HASP (formerly Aladdin HASP SRM) run-time installer before 6.x and SDK before 5.11, as used in 7 Technologies (7T) IGSS 7 and other products, when Firefox 2.0 is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger write access to a configuration file. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el "Admin Control Center" de Sentinel HASP Run-time Environment 5.95 y versiones anteriores de SafeNet Sentinel HASP (anteriormente Aladdin HASP SRM) run-time installer en versiones anteriores a 6.x y SDK anteriores a 5.11, tal como se utiliza en 7 Technologies (7T) IGSS 7 y otros productos, si Firefox 2.0 es utilizado, permite a atacantes remotos inyectar codigo de script web o código HTML de su elección a través de vectores desconocidos que provocan el acceso de escritura al archivo de configuración. • http://www.safenet-inc.com/support-downloads/sentinel-drivers/CVE-2011-3339 http://www.securityfocus.com/bid/51028 http://www.us-cert.gov/control_systems/pdf/ICSA-11-314-01.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/71789 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •