CVSS: 5.1EPSS: 0%CPEs: 72EXPL: 0CVE-2010-2754 – Mozilla Cross-origin data leakage from script filename in error messages
https://notcve.org/view.php?id=CVE-2010-2754
29 Jul 2010 — dom/base/nsJSEnvironment.cpp in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 does not properly suppress a script's URL in certain circumstances involving a redirect and an error message, which allows remote attackers to obtain sensitive information about script parameters via a crafted HTML document, related to the window.onerror handler. dom/base/nsJSEnvironment.cpp en Mozilla Firefox v3.5.x anteriores a v3.5.1... • http://www.mozilla.org/security/announce/2010/mfsa2010-47.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 8%CPEs: 72EXPL: 1CVE-2010-2752 – Mozilla Firefox CSS font-face Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-2752
20 Jul 2010 — Integer overflow in an array class in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 allows remote attackers to execute arbitrary code by placing many Cascading Style Sheets (CSS) values in an array, related to references to external font resources and an inconsistency between 16-bit and 32-bit integers. Un desbordamiento de enteros en una clase de matriz en Firefox versiones 3.5.x anteriores a 3.5.11 y versiones ... • https://www.exploit-db.com/exploits/15104 • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •
CVSS: 10.0EPSS: 2%CPEs: 65EXPL: 0CVE-2010-1209 – Mozilla Firefox NodeIterator Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-1209
20 Jul 2010 — Use-after-free vulnerability in the NodeIterator implementation in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, allows remote attackers to execute arbitrary code via a crafted NodeFilter that detaches DOM nodes, related to the NodeIterator interface and a javascript callback. Una vulnerabilidad de uso de la memoria previamente liberada en la implementación de NodeIterator en Firefox versiones 3.5.x anteriores a 3.5.11 y versiones 3.6.x anteriores a 3.6.7, y SeaMonk... • http://www.mozilla.org/security/announce/2010/mfsa2010-36.html • CWE-399: Resource Management Errors CWE-416: Use After Free •
CVSS: 10.0EPSS: 6%CPEs: 65EXPL: 2CVE-2010-1214 – Mozilla Firefox Plugin Parameter EnsureCachedAttrParamArrays Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-1214
20 Jul 2010 — Integer overflow in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, allows remote attackers to execute arbitrary code via plugin content with many parameter elements. Desbordamiento de entero en Mozilla Firefox v3.5.x anteriores a la v3.5.11 y v3.6.x anteriores a la v3.6.7, y SeaMonkey en versiones anteriores a la v2.0.6, permite a atacantes remotos ejecutar código de elección a través del "plugin content" con muchos elementos de parámetro. This vulnerability allows r... • https://www.exploit-db.com/exploits/34358 • CWE-189: Numeric Errors •
CVSS: 5.4EPSS: 0%CPEs: 65EXPL: 2CVE-2010-1206 – Firefox: Spoofing attacks via vectors involving 'No Content' status code or via a windows.stop call
https://notcve.org/view.php?id=CVE-2010-1206
25 Jun 2010 — The startDocumentLoad function in browser/base/content/browser.js in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, does not properly implement the Same Origin Policy in certain circumstances related to the about:blank document and a document that is currently loading, which allows (1) remote web servers to conduct spoofing attacks via vectors involving a 204 (aka No Content) status code, and allows (2) remote attackers to conduct spoofing attacks via vectors involvi... • http://hg.mozilla.org/mozilla-central/rev/cadddabb1178 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.1EPSS: 2%CPEs: 78EXPL: 0CVE-2010-1125 – firefox: keystrokes sent to hidden frame rather than visible frame due to javascript flaw
https://notcve.org/view.php?id=CVE-2010-1125
26 Mar 2010 — The JavaScript implementation in Mozilla Firefox 3.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, allows remote attackers to send selected keystrokes to a form field in a hidden frame, instead of the intended form field in a visible frame, via certain calls to the focus method. La implementación de JavaScript en Firefox versiones 3.x anteriores a 3.5.10 y versiones 3.6.x anteriores a 3.6.4, y SeaMonkey anterior a versión 2.0.5, de Mozilla, permite a los atacantes remotos enviar pulsacio... • http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 71EXPL: 1CVE-2010-0654 – firefox: cross-domain information disclosure
https://notcve.org/view.php?id=CVE-2010-0654
18 Feb 2010 — Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 permit cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote attackers to obtain sensitive information via a crafted document. Mozilla Firefox versiones 3.5.x anteriores a 3.5.11 y versiones 3.6.x anteriores a 3.6.7, Thunderbird versiones 3.0.x anteriores a 3.0... • http://code.google.com/p/chromium/issues/detail?id=9877 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 4%CPEs: 52EXPL: 0CVE-2009-3980
https://notcve.org/view.php?id=CVE-2009-3980
17 Dec 2009 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador de Mozilla Firefox v3.5.x antes de v3.5.6, SeaMonkey antes de v2.0.1 y Thunderbird permiten a atacantes remotos provocar una denegación de servicio (por c... • http://secunia.com/advisories/37699 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 8%CPEs: 52EXPL: 0CVE-2009-3982
https://notcve.org/view.php?id=CVE-2009-3982
17 Dec 2009 — Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor JavaScript en Mozilla Firefox v3.5.x antes de v3.5.6, SeaMonkey antes de v2.0.1 y Thunderbird permite a atacantes remotos provocar una denegación de servicio (median... • http://secunia.com/advisories/37699 •
CVSS: 6.8EPSS: 2%CPEs: 157EXPL: 0CVE-2009-3984 – Mozilla SSL spoofing with document.location and empty SSL response page
https://notcve.org/view.php?id=CVE-2009-3984
17 Dec 2009 — Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to spoof an SSL indicator for an http URL or a file URL by setting document.location to an https URL corresponding to a site that responds with a No Content (aka 204) status code and an empty body. Mozilla Firefox en versiones anteriores a v3.0.16 y v3.5.x antes de v3.5.6, y SeaMonkey antes de v2.0.1, permite a atacantes remotos suplantar un indicador de SSL para una URL o fichero HTTP URL estableciendo... • http://secunia.com/advisories/37699 •