CVSS: 6.1EPSS: 1%CPEs: 9EXPL: 0CVE-2008-5513 – Firefox XSS vulnerabilities in SessionStore
https://notcve.org/view.php?id=CVE-2008-5513
17 Dec 2008 — Unspecified vulnerability in the session-restore feature in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19 allows remote attackers to bypass the same origin policy, inject content into documents associated with other domains, and conduct cross-site scripting (XSS) attacks via unknown vectors related to restoration of SessionStore data. Vulnerabilidad no especificada en la característica session-restore en Mozilla Firefox 3.x versiones anteriores a v3.0.5 y 2.x versiones anteriores a v2.0.0.19 perm... • http://secunia.com/advisories/33184 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 19%CPEs: 9EXPL: 0CVE-2008-5018 – Mozilla crash with evidence of memory corruption
https://notcve.org/view.php?id=CVE-2008-5018
13 Nov 2008 — The JavaScript engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via vectors related to "insufficient class checking" in the Date class. El motor JavaScript en Mozilla Firefox 3.x antes de 3.0.4, Firefox 2.x antes de 2.0.0.18, Thunderbird 2.x antes de 2.0.0.18, y SeaMonkey 1.x antes de 1.1.13, permite a atacantes remotos provocar una denegación de servicio (cra... • http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html • CWE-399: Resource Management Errors •
CVSS: 9.1EPSS: 2%CPEs: 8EXPL: 0CVE-2008-5023 – Mozilla -moz-binding property bypasses security checks on codebase principals
https://notcve.org/view.php?id=CVE-2008-5023
13 Nov 2008 — Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the protection mechanism for codebase principals and execute arbitrary script via the -moz-binding CSS property in a signed JAR file. Firefox 3.x antes de v3.0.4, Firefox 2.x antes de v2.0.0.18 y SeaMonkey 1.x antes de v1.1.13 permite a atacantes remotos evitar los mecanismos de protección para "codebase principals" y ejecutar secuencias de comandos de su elección mediante la propiedad -m... • http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 6%CPEs: 9EXPL: 1CVE-2008-5024 – Mozilla parsing error in E4X default namespace
https://notcve.org/view.php?id=CVE-2008-5024
13 Nov 2008 — Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, which allows remote attackers to conduct XML injection attacks via the default namespace in an E4X document. Mozilla Firefox 3.x antes de 3.0.4, Firefox 2.x antes de 2.0.0.18, Thunderbird 2.x antes de 2.0.0.18, Y SeaMonkey 1.x antes de 1.1.13 no escapan de manera apropiada los caracteres usados para el procesamiento X... • http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html • CWE-91: XML Injection (aka Blind XPath Injection) •
CVSS: 10.0EPSS: 16%CPEs: 9EXPL: 0CVE-2008-5017 – Mozilla crash with evidence of memory corruption
https://notcve.org/view.php?id=CVE-2008-5017
13 Nov 2008 — Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors. Desbordamiento de entero en xpcom/io/nsEscape.cpp en el motor de navegación en Mozilla Firefox 3.x antes de 3.0.4, Firefox 2.x antes de 2.0.0.18, Thunderbird 2.x antes de 2.0.0.18 y SeaMonkey 1.x antes de 1.1.13 permite a atacantes rem... • http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html • CWE-189: Numeric Errors •
CVSS: 10.0EPSS: 1%CPEs: 3EXPL: 0CVE-2008-5052
https://notcve.org/view.php?id=CVE-2008-5052
13 Nov 2008 — The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger memory corruption, as demonstrated by e4x/extensions/regress-410192.js. La función AppendAttributeValue en el motor de JavaScript en Mozilla Firefox v2.x anterior a v2.0.0.18, Thunderbird v2.x anterior a v2.0.0.18, y SeaMonkey v1.x anterior a v1.1.13 , p... • http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html • CWE-399: Resource Management Errors •
CVSS: 9.8EPSS: 21%CPEs: 9EXPL: 0CVE-2008-0017 – Mozilla buffer overflow in http-index-format parser
https://notcve.org/view.php?id=CVE-2008-0017
13 Nov 2008 — The http-index-format MIME type parser (nsDirIndexParser) in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 does not check for an allocation failure, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP index response with a crafted 200 header, which triggers memory corruption and a buffer overflow. El analizador de tipo http-index-format MIME (nsDirIndexParser) en Firefox 3.x antes de 3.0.4, Firefox 2.x an... • http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 2%CPEs: 9EXPL: 0CVE-2008-5022 – nsXMLHttpRequest:: NotifyEventListeners() same-origin violation
https://notcve.org/view.php?id=CVE-2008-5022
13 Nov 2008 — The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-origin policy and execute arbitrary script via multiple listeners, which bypass the inner window check. El método nsXMLHttpRequest::NotifyEventListeners en Firefox v3.x anterior a v3.0.4, Firefox v2.x anterior a v2.0.0.18, Thunderbird v2.x anterior a v2.0.0.18 y SeaMonkey v1.x anterior a v1.1.13... • http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 76%CPEs: 42EXPL: 0CVE-2008-5016 – Mozilla crash with evidence of memory corruption
https://notcve.org/view.php?id=CVE-2008-5016
13 Nov 2008 — The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via multiple vectors that trigger an assertion failure or other consequences. El motor de diseño en Mozilla Firefox 3.x versiones anteriores a v3.0.4, Thunderbird 2.x versiones anteriores a v2.0.0.18, y SeaMonkey 1.x versiones anteriores a v1.1.13 permite a atacantes remotos provocar una denegación de servicio (caída) a través de... • http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html • CWE-399: Resource Management Errors •
CVSS: 10.0EPSS: 27%CPEs: 9EXPL: 0CVE-2008-5014 – Mozilla crash and remote code execution via __proto__ tampering
https://notcve.org/view.php?id=CVE-2008-5014
13 Nov 2008 — jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying the window.__proto__.__proto__ object in a way that causes a lock on a non-native object, which triggers an assertion failure related to the OBJ_IS_NATIVE function. jslock.cpp en Mozilla Firefox 3.x antes de 3.0.2, Firefox 2.x antes de 2.0.0.18, Thunderbird 2.... • http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html • CWE-20: Improper Input Validation •