CVSS: 4.3EPSS: 0%CPEs: 38EXPL: 0CVE-2008-0593 – Mozilla URL token stealing flaw
https://notcve.org/view.php?id=CVE-2008-0593
Gecko-based browsers, including Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8, modify the .href property of stylesheet DOM nodes to the final URI of a 302 redirect, which might allow remote attackers to bypass the Same Origin Policy and read sensitive information from the original URL, such as with Single-Signon systems. Los navegadores basados en Gecko, incluyendo Mozilla Firefox versiones anteriores a 2.0.0.12 y SeaMonkey versiones anteriores a 1.1.8, modifican la propiedad .href de los nodos DOM de la hoja de estilo al URI final de un redireccionamiento 302, que podría permitir a los atacantes remotos omitir la Política del Mismo Origen y leer información confidencial de la dirección URL original, como con los sistemas de Single-Signon. • http://browser.netscape.com/releasenotes http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html http://secunia.com/advisories/28754 http://secunia.com/advisories/28758 http://secunia.com/advisories/28766 http://secunia.com/advisories/28815 http://secunia.com/advisories/28818 http://secunia.com/advisories/28839 http://secunia.com/advisories/28864 http://secunia.com/advisories/28865 http://secunia.com/advisories/28877 http://secunia.com/advisories/28879 http:/& • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 1%CPEs: 2EXPL: 0CVE-2008-0414 – mozilla: multiple file input focus stealing vulnerabilities
https://notcve.org/view.php?id=CVE-2008-0414
Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8 allows user-assisted remote attackers to trick the user into uploading arbitrary files via label tags that shift focus to a file input field, aka "focus spoofing." Mozilla Firefox versiones anteriores a 2.0.0.12 y SeaMonkey versiones anteriores a 1.1.8, permiten a atacantes remotos con la intervención del usuario engañarle enviando archivos de su elección a través de etiquetas label que cambian el foco a un campo de entrada de archivo, también conocido como "focus spoofing." • http://browser.netscape.com/releasenotes http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html http://secunia.com/advisories/28758 http://secunia.com/advisories/28815 http://secunia.com/advisories/28839 http://secunia.com/advisories/28864 http://secunia.com/advisories/28865 http://secunia.com/advisories/28877 http://secunia.com/advisories/28879 http://secunia.com/advisories/28924 http://secunia.com/advisories/28939 http://secunia.com/advisories/28958 http:/& • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 1%CPEs: 1EXPL: 0CVE-2008-0417 – Mozilla arbitrary code execution
https://notcve.org/view.php?id=CVE-2008-0417
CRLF injection vulnerability in Mozilla Firefox before 2.0.0.12 allows remote user-assisted web sites to corrupt the user's password store via newlines that are not properly handled when the user saves a password. Vulnerabilidad de inyección CRLF en versiones anteriores a Mozilla Firefox 2.0.0.12 que permite a sitios web remotos con la intervención del usuario corromper la contraseña de usuario almacenada en las nuevas líneas que no son manejadas adecuadamente cuando el usuario guarda la contraseña. • http://browser.netscape.com/releasenotes http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html http://secunia.com/advisories/28766 http://secunia.com/advisories/28818 http://secunia.com/advisories/28839 http://secunia.com/advisories/28864 http://secunia.com/advisories/28865 http://secunia.com/advisories/28877 http://secunia.com/advisories/28879 http://secunia.com/advisories/28924 http://secunia.com/advisories/28939 http://secunia.com/advisories/28958 http:/& • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.0EPSS: 2%CPEs: 1EXPL: 1CVE-2008-0594
https://notcve.org/view.php?id=CVE-2008-0594
Mozilla Firefox before 2.0.0.12 does not always display a web forgery warning dialog if the entire contents of a web page are in a DIV tag that uses absolute positioning, which makes it easier for remote attackers to conduct phishing attacks. Versiones anteriores a Mozilla Firefox 2.0.0.12, nunca muestran una advertencia de falsificación de web si el contenido completo de una página web se encuentra entre una etiqueta DIV lo que permite a atacantes remotos realizar ataques de phishing • http://browser.netscape.com/releasenotes http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html http://secunia.com/advisories/28864 http://secunia.com/advisories/28865 http://secunia.com/advisories/28877 http://secunia.com/advisories/28879 http://secunia.com/advisories/28924 http://secunia.com/advisories/28939 http://secunia.com/advisories/28958 http://secunia.com/advisories/29086 http://secunia.com/advisories/29567 http://secunia.com/advisories/30327 http:/& •
CVSS: 9.3EPSS: 13%CPEs: 80EXPL: 0CVE-2008-0420 – Mozilla information disclosure flaw
https://notcve.org/view.php?id=CVE-2008-0420
modules/libpr0n/decoders/bmp/nsBMPDecoder.cpp in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 does not properly perform certain calculations related to the mColors table, which allows remote attackers to read portions of memory uninitialized via a crafted 8-bit bitmap (BMP) file that triggers an out-of-bounds read within the heap, as demonstrated using a CANVAS element; or cause a denial of service (application crash) via a crafted 8-bit bitmap file that triggers an out-of-bounds read. NOTE: the initial public reports stated that this affected Firefox in Ubuntu 6.06 through 7.10. El archivo modules/libpr0n/decoders/bmp/nsBMPDecoder.cpp en Mozilla Firefox versiones anteriores a 2.0.0.12, Thunderbird versiones anteriores a 2.0.0.12, y SeaMonkey versiones anteriores a 1.1.8, no realiza apropiadamente ciertos cálculos relacionados con la tabla mColors, lo que permite a los atacantes remotos leer partes de memoria no inicializadas por medio de un archivo de mapa de bits de 8 bits (BMP) diseñado que desencadena una lectura fuera de límites dentro de la pila, como es demostrado mediante el uso de un elemento CANVAS; o al causar una denegación de servicio (bloqueo de la aplicación) por medio de un archivo de mapa de bits de 8 bits diseñado que desencadena una lectura fuera de límites. NOTA: los reportes públicos iniciales indicaron que esto afectó a Firefox en Ubuntu versiones 6.06 hasta 7.10. • http://browser.netscape.com/releasenotes http://secunia.com/advisories/28758 http://secunia.com/advisories/28839 http://secunia.com/advisories/29049 http://secunia.com/advisories/29098 http://secunia.com/advisories/29167 http://secunia.com/advisories/30327 http://secunia.com/advisories/30620 http://securitytracker.com/id?1019434 http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1 http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml http://www.mandriva. • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •