CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2011-2369
https://notcve.org/view.php?id=CVE-2011-2369
Cross-site scripting (XSS) vulnerability in Mozilla Firefox 4.x through 4.0.1 allows remote attackers to inject arbitrary web script or HTML via an SVG element containing an HTML-encoded entity. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Mozilla Firefox v4.x hasta v4.0.1 permite a atacantes remotos inyectar secuencias de comandos Web o HTML de su elección a través de un elemento SVG que contenga una entidad HTML-encoded. • http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html http://www.mozilla.org/security/announce/2011/mfsa2011-27.html https://bugzilla.mozilla.org/show_bug.cgi?id=650001 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14426 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 122EXPL: 0CVE-2011-2370
https://notcve.org/view.php?id=CVE-2011-2370
Mozilla Firefox before 5.0 does not properly enforce the whitelist for the xpinstall functionality, which allows remote attackers to trigger an installation dialog for a (1) add-on or (2) theme via unspecified vectors. Mozilla Firefox antes de v5.0 no aplica correctamente la lista blanca para la funcionalidad xpinstall, lo que permite a atacantes remotos para provocar un cuadro de diálogo de instalación de un (1) add-on o (2) el tema a través de vectores no especificados. • http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html http://www.mozilla.org/security/announce/2011/mfsa2011-28.html https://bugzilla.mozilla.org/show_bug.cgi?id=645699 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14278 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.1EPSS: 0%CPEs: 251EXPL: 0CVE-2011-2362 – Mozilla Cookie isolation error (MFSA 2011-24)
https://notcve.org/view.php?id=CVE-2011-2362
Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 do not distinguish between cookies for two domain names that differ only in a trailing dot, which allows remote web servers to bypass the Same Origin Policy via Set-Cookie headers. Mozilla Firefox antes de la v3.6.18, Thunderbird antes de la v3.1.11, y SeaMonkey hasta la v2.0.14, no distinguen entre las cookies de dos nombres de dominio que difieran sólo en un punto final, lo que permite a los servidores Web remotos eludir la política del mismo origen (Same Origin Policy) a través de las cabeceras Set-Cookie. • http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html http://secunia.com/advisories/45002 http://support.avaya.com/css/P8/documents/100144854 http://support.avaya.com/css/P8/documents/100145333 http://www.debian.org/security/2011/dsa-2268 http://www.debian.org/security/2011/dsa-2269 http://www.debian.org/security/2011/dsa-2273 http://www.mandriva.com/security/advisories?name=MDVSA-2011:111 http://www.mozilla.org/security/announce/2011/mfsa2011-24.html h • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 48%CPEs: 99EXPL: 0CVE-2011-2364 – Mozilla Miscellaneous memory safety hazards (MFSA 2011-19)
https://notcve.org/view.php?id=CVE-2011-2364
Unspecified vulnerability in the browser engine in Mozilla Firefox 3.6.x before 3.6.18 and Thunderbird before 3.1.11 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-2365. Vulnerabilidad no especificada en el motor de navegación de Mozilla Firefox v3.6.x anterior a v3.6.18 y Thunderbird anterior a v3.1.11 permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de la aplicación) o puede que ejecutar código de su elección mediante vectores desconocidos. Se trata de una vulnerabilidad diferente de CVE-2011-2365. • http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html http://secunia.com/advisories/45002 http://support.avaya.com/css/P8/documents/100144854 http://support.avaya.com/css/P8/documents/100145333 http://www.mandriva.com/security/advisories?name=MDVSA-2011:111 http://www.mozilla.org/security/announce/2011/mfsa2011-19.html http://www.redhat.com/support/errata/RHSA-2011-0885.html http://www.redhat.com/support/errata/RHSA-2011-0886.html http://www.redhat.com/su •
CVSS: 10.0EPSS: 40%CPEs: 99EXPL: 0CVE-2011-2365 – Mozilla Miscellaneous memory safety hazards (MFSA 2011-19)
https://notcve.org/view.php?id=CVE-2011-2365
Unspecified vulnerability in the browser engine in Mozilla Firefox 3.6.x before 3.6.18 and Thunderbird before 3.1.11 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-2364. Vulnerabilidad no especificada en el motor del navegador de Mozilla Firefox v3.6.x antes de v3.6.18 y Thunderbird antes de v3.1.11 permite a atacantes remotos causar una denegación de servicio (corrupción de memoria y caída de aplicación) o posiblemente ejecutar código de su elección a través de vectores desconocidos, una vulnerabilidad diferente a CVE-2011-2364. • http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html http://secunia.com/advisories/45002 http://support.avaya.com/css/P8/documents/100144854 http://support.avaya.com/css/P8/documents/100145333 http://www.debian.org/security/2011/dsa-2268 http://www.debian.org/security/2011/dsa-2269 http://www.debian.org/security/2011/dsa-2273 http://www.mandriva.com/security/advisories?name=MDVSA-2011:111 http://www.mozilla.org/security/announce/2011/mfsa2011-19.html h •