CVSS: 4.6EPSS: 0%CPEs: 54EXPL: 0CVE-2004-0906
https://notcve.org/view.php?id=CVE-2004-0906
The XPInstall installer in Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 sets insecure permissions for certain installed files within xpi packages, which could allow local users to overwrite arbitrary files or execute arbitrary code. • http://bugzilla.mozilla.org/show_bug.cgi?id=231083 http://bugzilla.mozilla.org/show_bug.cgi?id=235781 http://secunia.com/advisories/12526 http://security.gentoo.org/glsa/glsa-200409-26.xml http://www.kb.cert.org/vuls/id/653160 http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3 http://www.novell.com/linux/security/advisories/2004_36_mozilla.html http://www.redhat.com/support/errata/RHSA-2005-323.html http://www.securityfocus.com/bid/11192 h •
CVSS: 4.0EPSS: 0%CPEs: 53EXPL: 2CVE-2004-0908
https://notcve.org/view.php?id=CVE-2004-0908
Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows untrusted Javascript code to read and write to the clipboard, and possibly obtain sensitive information, via script-generated events such as Ctrl-Ins. • http://bugzilla.mozilla.org/show_bug.cgi?id=257523 http://marc.info/?l=bugtraq&m=109698896104418&w=2 http://marc.info/?l=bugtraq&m=109900315219363&w=2 http://secunia.com/advisories/12526 http://security.gentoo.org/glsa/glsa-200409-26.xml http://www.kb.cert.org/vuls/id/460528 http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3 http://www.novell.com/linux/security/advisories/2004_36_mozilla.html http://www.securityfocus.com/bid/11179 https& •
CVSS: 4.6EPSS: 0%CPEs: 53EXPL: 0CVE-2004-0907
https://notcve.org/view.php?id=CVE-2004-0907
The Linux install .tar.gz archives for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8, create certain files with insecure permissions, which could allow local users to overwrite those files and execute arbitrary code. • http://bugzilla.mozilla.org/show_bug.cgi?id=254303 http://security.gentoo.org/glsa/glsa-200409-26.xml http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3 https://exchange.xforce.ibmcloud.com/vulnerabilities/17373 •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2004-0871
https://notcve.org/view.php?id=CVE-2004-0871
Mozilla does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain, which could allow remote attackers to steal cookies and conduct unauthorized activities, aka "Cross Security Boundary Cookie Injection." • http://securityfocus.com/archive/1/375407 http://securitytracker.com/id?1011331 http://www.westpoint.ltd.uk/advisories/wp-04-0001.txt https://exchange.xforce.ibmcloud.com/vulnerabilities/17417 •
CVSS: 4.6EPSS: 1%CPEs: 62EXPL: 1CVE-2004-0905
https://notcve.org/view.php?id=CVE-2004-0905
Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to perform cross-domain scripting and possibly execute arbitrary code by convincing a user to drag and drop javascript: links to a frame or page in another domain. • http://bugzilla.mozilla.org/show_bug.cgi?id=250862 http://marc.info/?l=bugtraq&m=109698896104418&w=2 http://marc.info/?l=bugtraq&m=109900315219363&w=2 http://security.gentoo.org/glsa/glsa-200409-26.xml http://www.kb.cert.org/vuls/id/651928 http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3 http://www.novell.com/linux/security/advisories/2004_36_mozilla.html http://www.securityfocus.com/bid/11177 http://www.us-cert.gov/cas/techalerts& •