CVSS: 4.3EPSS: 0%CPEs: 202EXPL: 0CVE-2010-2763
https://notcve.org/view.php?id=CVE-2010-2763
The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox before 3.5.12, Thunderbird before 3.0.7, and SeaMonkey before 2.0.7 does not properly restrict scripted functions, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted function. La clase XPCSafeJSObjectWrapper en la implementación SafeJSObjectWrapper (también conocido como SJOW) en Mozilla Firefox anterior a v3.5.12, Thunderbird anterior a v3.0.7, y SeaMonkey anterior a v2.0.7 no restringe adecuadamente funciones de secuencias de comandos, permitiendo a atacantes remotos eludir la Same Origin Policy y llevar a cabo la ejecución de secuencias de comandos en sitios cruzados (XSS) mediante una función manipulada • http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html http://www.debian.org/security/2010/dsa-2106 http://www.mozilla.org/security/announce/2010/mfsa2010-60.html http://www.vupen.com/english/advisories/2010/2323 https://bugzilla.mozilla.org/show_bug.cgi?id=585284 https://exchange.xforce.ibmcloud.com/vulnerabilities/61665 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 66%CPEs: 212EXPL: 0CVE-2010-2766 – Mozilla Firefox normalizeDocument Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-2766
The normalizeDocument function in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 does not properly handle the removal of DOM nodes during normalization, which might allow remote attackers to execute arbitrary code via vectors involving access to a deleted object. La función normalizeDocument en Mozilla Firefox anterior a v3.5.12 y v3.6.x anterior a v3.6.9, Thunderbird anterior a v3.0.7 y v3.1.x anterior a v3.1.3, SeaMonkey anterior a v2.0.7 no maneja correctamente la eliminación de nodos DOM durante la normalización, lo que podría permitir a atacantes remotos ejecutar código arbitrario a través de vectores que impliquen el acceso a un objeto eliminado. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Mozilla Firefox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the normalizeDocument function defined within nsDocument.cpp. When handling children nodes the code does not account for a varying number of children during normalization. • http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html http://secunia.com/advisories/42867 http://support.avaya.com/css/P8/documents/100112690 http://www.debian.org/security/2010/dsa-2106 http://www.mandriva.com/security/advisories?name=MDVSA-2010:173 http://www.mozilla.org/security/announce/2010/mfsa2010-57.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 7%CPEs: 212EXPL: 0CVE-2010-3169 – Mozilla Miscellaneous memory safety hazards
https://notcve.org/view.php?id=CVE-2010-3169
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor de navegación de Mozilla Firefox v3.5.12 y v3.6.x anterior a v3.6.9, Thunderbird anterior a v3.0.7 y v3.1.x anterior a v3.1.3, y SeaMonkey anterior a v2.0.7 permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de aplicación) o posiblemente ejecutar código arbitrario a través de vectores desconocidos. • http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html http://secunia.com/advisories/42867 http://support.avaya.com/css/P8/documents/100110210 http://support.avaya.com/css/P8/documents/100112690 http://www.debian.org/security/2010/dsa-2106 http://www.mandriva.com/security/advisories?name=MDVSA-2010:173 http:/&#x •
CVSS: 5.1EPSS: 0%CPEs: 212EXPL: 0CVE-2010-2769 – Mozilla Copy-and-paste or drag-and-drop into designMode document allows XSS (MFSA 2010-62)
https://notcve.org/view.php?id=CVE-2010-2769
Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 allows user-assisted remote attackers to inject arbitrary web script or HTML via a selection that is added to a document in which the designMode property is enabled. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Mozilla Firefox anterior a v3.5.12 y v3.6.x anterior a v3.6.9, Thunderbird anterior a v3.0.7 y v3.1.x anterior a v3.1.3, y SeaMonkey anterior a v2.0.7 permite a atacantes remotos ayudados por el usuario para inyectar web script o HTML a través de una selección que se agrega a un documento en el que se habilita la propiedad designMode. • http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html http://secunia.com/advisories/42867 http://support.avaya.com/css/P8/documents/100112690 http://www.debian.org/security/2010/dsa-2106 http://www.mandriva.com/security/advisories?name=MDVSA-2010:173 http://www.mozilla.org/security/announce/2010/mfsa2010-62.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 14%CPEs: 212EXPL: 4CVE-2010-3131 – Mozilla Firefox 3.6.8 - 'dwmapi.dll' DLL Hijacking
https://notcve.org/view.php?id=CVE-2010-3131
Untrusted search path vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 on Windows XP allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .htm, .html, .jtx, .mfp, or .eml file. Una vulnerabilidad de ruta de búsqueda no confiable en Firefox anterior a versión 3.5.12 y versiones 3.6.x anteriores a 3.6.9, Thunderbird anteriores a versión 3.0.7 y versiones 3.1.x anteriores a 3.1.3, y SeaMonkey anterior a versión 2.0.7, de Mozilla sobre Windows XP, permite a usuarios locales, y posiblemente remotos atacantes, para ejecutar código arbitrario y conducir ataques de secuestro de DLL por medio de un archivo dwmapi.dll de tipo caballo de Troya que se encuentra en la misma carpeta que un archivo .htm, .html, .jtx, .mfp o .eml. • https://www.exploit-db.com/exploits/14730 https://www.exploit-db.com/exploits/14783 http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html http://secunia.com/advisories/41095 http://secunia.com/advisories/41168 http://www.exploit-db.com/exploits/14730 http://www.exploit-db.com/exploits/14783 http://www.mozilla.org/security/announce/2010/mfsa2010-52.html http://www.securityfocus.com/archive/1/513324/100/0/threaded http://www.vupen.com/english/advisories& •