CVSS: 9.8EPSS: 97%CPEs: 45EXPL: 0CVE-2007-2867 – Multiple Firefox flaws (CVE-2007-1562, CVE-2007-2867, CVE-2007-2868, CVE-2007-2869, CVE-2007-2870, CVE-2007-2871)
https://notcve.org/view.php?id=CVE-2007-2867
01 Jun 2007 — Multiple vulnerabilities in the layout engine for Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, Thunderbird 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2 allow remote attackers to cause a denial of service (crash) via vectors related to dangling pointers, heap corruption, signed/unsigned, and other issues. Múltiples vulnerabilidades en el motor de capas del Mozilla Firefox 1.5.x anterior al 1.5.0.12 y 2.x anterior al 2.0.0.4, Thunderbird 1.5.x anterior al 1.5.0.... • http://fedoranews.org/cms/node/2747 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.1EPSS: 1%CPEs: 3EXPL: 0CVE-2007-2292
https://notcve.org/view.php?id=CVE-2007-2292
26 Apr 2007 — CRLF injection vulnerability in the Digest Authentication support for Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allows remote attackers to conduct HTTP request splitting attacks via LF (%0a) bytes in the username attribute. Una vulnerabilidad de inyección CRLF en el soporte Digest Authentication para Mozilla Firefox anterior a la versión 2.0.0.8 y SeaMonkey anterior a la versión 1.1.5 permite a los atacantes remotos realizar ataques de división de peticiones HTTP por medio de LF (% 0a) bytes... • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 75%CPEs: 42EXPL: 0CVE-2007-1282
https://notcve.org/view.php?id=CVE-2007-1282
06 Mar 2007 — Integer overflow in Mozilla Thunderbird before 1.5.0.10 and SeaMonkey before 1.0.8 allows remote attackers to trigger a buffer overflow and possibly execute arbitrary code via a text/enhanced or text/richtext e-mail message with an extremely long line. Desbordamiento de entero en Mozilla Thunderbird anterior a 1.5.0.10 y SeaMonkey anterior a 1.0.8 permite a atacantes remotos disparar un desbordamiento de búfer y posiblemente ejecutar código de su elección mediante un mensaje de correo electrónico de tipo te... • ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc •
CVSS: 9.6EPSS: 0%CPEs: 5EXPL: 1CVE-2007-0994
https://notcve.org/view.php?id=CVE-2007-0994
06 Mar 2007 — A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8, allows remote attackers to execute arbitrary JavaScript as the user via an HTML mail message with a javascript: URI in an (1) img, (2) link, or (3) style tag, which bypasses the access checks and executes code with chrome privileges. Un error de regresión en Mozilla Firefox versión 2.x anterior a 2.0.0.2 y versión 1.x anterior a 1.5.0.10, y SeaMonkey versión 1.1 anterior a 1... • ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.1EPSS: 3%CPEs: 28EXPL: 0CVE-2007-0996
https://notcve.org/view.php?id=CVE-2007-0996
27 Feb 2007 — The child frames in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 inherit the default charset from the parent window, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set. Los marcos hijo en Mozilla Firefox anterior a 1.5.0.10 y 2.x anterior 2.0.0.2, y SeaMonkey anterior a 1.0.8 heredan el charset por defecto desde la ventana padre, lo caul permite a atacantes remotos conducir ataques de secuencias de ... • ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc •
CVSS: 8.1EPSS: 91%CPEs: 10EXPL: 0CVE-2007-0009 – NSS: SSLv2 protocol buffer overflows
https://notcve.org/view.php?id=CVE-2007-0009
26 Feb 2007 — Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, SeaMonkey before 1.0.8, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via invalid "Client Master Key" length values. Un desbordamiento de búfer en la región stack de la memoria en el soporte SSLv2 en Mozilla Network Security Services (NSS) anterior a v... • ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 4%CPEs: 6EXPL: 0CVE-2007-0780
https://notcve.org/view.php?id=CVE-2007-0780
26 Feb 2007 — browser.js in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 uses the requesting URI to identify child windows, which allows remote attackers to conduct cross-site scripting (XSS) attacks by opening a blocked popup originating from a javascript: URI in combination with multiple frames having the same data: URI. browser.js en Mozilla Firefox 1.5.x versiones anteriores a 1.5.0.10 y 2.x versiones anteriores a 2.0.0.2, y SeaMonkey versiones anteriores a 1.0.8, usa la UR... • ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 6%CPEs: 7EXPL: 0CVE-2007-0778
https://notcve.org/view.php?id=CVE-2007-0778
26 Feb 2007 — The page cache feature in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 can generate hash collisions that cause page data to be appended to the wrong page cache, which allows remote attackers to obtain sensitive information or enable further attack vectors when the target page is reloaded from the cache. La característica caché de página en Mozilla Firefox versiones anteriores a 1.5.0.10 y 2.x versiones anteriores a 2.0.0.2, y SeaMonkey versiones anteriores a 1.0.8 puede... • ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 16%CPEs: 47EXPL: 0CVE-2007-0779
https://notcve.org/view.php?id=CVE-2007-0779
26 Feb 2007 — GUI overlay vulnerability in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 allows remote attackers to spoof certain user interface elements, such as the host name or security indicators, via the CSS3 hotspot property with a large, transparent, custom cursor. Vulnerabilidad de superposición del IGU (Interfaz Gráfica de Usuario) en Mozilla Firefox 1.5.x anterior a 1.5.0.10 y 2.x anterior a 2.0.0.2, y SeaMonkey anterior a 1.0.8 permite a atacantes remotos suplantar de... • ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc •
CVSS: 9.8EPSS: 96%CPEs: 86EXPL: 0CVE-2007-0008 – NSS: SSLv2 protocol buffer overflows
https://notcve.org/view.php?id=CVE-2007-0008
26 Feb 2007 — Integer underflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, SeaMonkey before 1.0.8, Thunderbird before 1.5.0.10, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via a crafted SSLv2 server message containing a public key that is too short to encrypt the "Master Secret", which results in a heap-based overflow. Un subdesbordamiento de enteros en el sopor... • ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc • CWE-189: Numeric Errors •