CVSS: 7.5EPSS: 89%CPEs: 34EXPL: 1CVE-2005-1155
https://notcve.org/view.php?id=CVE-2005-1155
The favicon functionality in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to execute arbitrary code via a <LINK rel="icon"> tag with a javascript: URL in the href attribute, aka "Firelinking." • ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt http://secunia.com/advisories/14938 http://secunia.com/advisories/14992 http://www.gentoo.org/security/en/glsa/glsa-200504-18.xml http://www.kb.cert.org/vuls/id/973309 http://www.mikx.de/firelinking http://www.mozilla.org/security/announce/mfsa2005-37.html http://www.redhat.com/support/errata/RHSA-2005-383.html http://www.redhat.com/support/errata/RHSA-2005-384.html http://www.redha • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 1%CPEs: 35EXPL: 2CVE-2005-1157
https://notcve.org/view.php?id=CVE-2005-1157
Firefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to replace existing search plugins with malicious ones using sidebar.addSearchEngine and the same filename as the target engine, which may not be displayed in the GUI, which could then be used to execute malicious script, aka "Firesearching 2." • ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt http://secunia.com/advisories/14938 http://secunia.com/advisories/14992 http://secunia.com/advisories/14996 http://www.mikx.de/firesearching http://www.mozilla.org/security/announce/mfsa2005-38.html http://www.redhat.com/support/errata/RHSA-2005-383.html http://www.redhat.com/support/errata/RHSA-2005-384.html http://www.redhat.com/support/errata/RHSA-2005-386.html http://www.securityfocus.com •
CVSS: 5.0EPSS: 1%CPEs: 11EXPL: 0CVE-2005-1158
https://notcve.org/view.php?id=CVE-2005-1158
Multiple "missing security checks" in Firefox before 1.0.3 allow remote attackers to inject arbitrary Javascript into privileged pages using the _search target of the Firefox sidebar. • http://secunia.com/advisories/14938 http://www.mozilla.org/security/announce/mfsa2005-39.html http://www.redhat.com/support/errata/RHSA-2005-383.html http://www.securityfocus.com/bid/13231 https://bugzilla.mozilla.org/show_bug.cgi?id=290079 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100019 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11734 https://access.redhat.com/security/cve/CVE-2005-1158 https:// •
CVSS: 5.0EPSS: 90%CPEs: 4EXPL: 4CVE-2005-0989 – Mozilla Suite/Firefox - JavaScript Lambda Replace Heap Memory Disclosure
https://notcve.org/view.php?id=CVE-2005-0989
The find_replen function in jsstr.c in the Javascript engine for Mozilla Suite 1.7.6, Firefox 1.0.1 and 1.0.2, and Netscape 7.2 allows remote attackers to read portions of heap memory in a Javascript string via the lambda replace method. • https://www.exploit-db.com/exploits/25334 ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt http://secunia.com/advisories/14820 http://secunia.com/advisories/14821 http://secunia.com/advisories/19823 http://securitytracker.com/id?1013635 http://securitytracker.com/id?1013643 http://www.gentoo.org/security/en/glsa/glsa-200504-18.xml http://www.mozilla.org/security/announce/mfsa2005-33.html http://www.novell.com/linux/security/advisories/2006_04_25& •
CVSS: 2.6EPSS: 66%CPEs: 11EXPL: 0CVE-2005-0402
https://notcve.org/view.php?id=CVE-2005-0402
Firefox before 1.0.2 allows remote attackers to execute arbitrary code by tricking a user into saving a page as a Firefox sidebar panel, then using the sidebar panel to inject Javascript into a privileged page. • http://secunia.com/advisories/14654 http://www.mozilla.org/security/announce/mfsa2005-31.html http://www.redhat.com/support/errata/RHSA-2005-336.html http://www.vupen.com/english/advisories/2005/0296 https://bugzilla.mozilla.org/show_bug.cgi?id=284627 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100027 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11868 https://access.redhat.com/security/cve/CVE-2005-0402 •