Page 4 of 35 results (0.005 seconds)

CVSS: 7.5EPSS: 2%CPEs: 34EXPL: 0

12 May 2005 — Firefox before 1.0.4 and Mozilla Suite before 1.7.8 does not properly implement certain security checks for script injection, which allows remote attackers to execute script via "Wrapped" javascript: URLs, as demonstrated using (1) a javascript: URL in a view-source: URL, (2) a javascript: URL in a jar: URL, or (3) "a nested variant." • ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt •

CVSS: 9.1EPSS: 17%CPEs: 36EXPL: 1

12 May 2005 — Firefox before 1.0.4 and Mozilla Suite before 1.7.8 do not properly limit privileges of Javascript eval and Script objects in the calling context, which allows remote attackers to conduct unauthorized activities via "non-DOM property overrides," a variant of CVE-2005-1160. • https://www.exploit-db.com/exploits/25670 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 9.1EPSS: 0%CPEs: 62EXPL: 0

29 Jan 2005 — Firefox before 1.0 and Mozilla before 1.7.5 display the SSL lock icon when an insecure page loads a binary file from a trusted site, which could facilitate phishing attacks. • http://www.mozilla.org/security/announce/mfsa2005-03.html •

CVSS: 6.5EPSS: 1%CPEs: 43EXPL: 4

18 Oct 2004 — Mozilla allows remote attackers to cause a denial of service (application crash from null dereference or infinite loop) via a web page that contains a (1) TEXTAREA, (2) INPUT, (3) FRAMESET or (4) IMG tag followed by a null character and some trailing characters, as demonstrated by mangleme. • http://lcamtuf.coredump.cx/mangleme/gallery •

CVSS: 7.5EPSS: 1%CPEs: 27EXPL: 2

18 Oct 2004 — Mozilla allows remote attackers to cause a denial of service (application crash from invalid memory access) via an "unusual combination of visual elements," including several large MARQUEE tags with large height parameters, as demonstrated by mangleme. • http://lcamtuf.coredump.cx/mangleme/gallery •