CVSS: 5.0EPSS: 1%CPEs: 3EXPL: 0CVE-2004-0761
https://notcve.org/view.php?id=CVE-2004-0761
03 Aug 2004 — Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote attackers to use certain redirect sequences to spoof the security lock icon that makes a web page appear to be encrypted. Mozilla anteriores a 1.7, Firefox anteriores a 0.9, y Thunderbird anteriores a 0.7 permiten a atacantes remotos usar ciertas secuencias de redirección para suplantar el icono de la cerradura de seguridad que se muestra cuando una página está cifrada. • ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt •
CVSS: 6.5EPSS: 1%CPEs: 3EXPL: 0CVE-2004-0762
https://notcve.org/view.php?id=CVE-2004-0762
03 Aug 2004 — Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box. Mozilla anteriores a 1.7, Firefox anteriores a 0.9, y Thunderbird anteriores a 0.7 permiten a sitios web remotos instalar extensiones de su elección usando eventes interactivos para manipular el cuadro de diálogo de Seguridad XPInstall. • ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt •
CVSS: 10.0EPSS: 2%CPEs: 3EXPL: 0CVE-2004-0764
https://notcve.org/view.php?id=CVE-2004-0764
03 Aug 2004 — Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the "chrome" flag and XML User Interface Language (XUL) files. Mozilla anteriores a 1.7, Firefox anteriores a 0.9, y Thunderbird anteriores a 0.7, permiten a sitios web remotos secuestrar el interfaz del usuario mediante la bandera "chrome" y ficheros de Interfaz de Usuario XML (XUL). • ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2004-0765
https://notcve.org/view.php?id=CVE-2004-0765
03 Aug 2004 — The cert_TestHostName function in Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, only checks the hostname portion of a certificate when the hostname portion of the URI is not a fully qualified domain name (FQDN), which allows remote attackers to spoof trusted certificates. La función cet_TestHostName en Mozilla anteriores a 1.7, Firefox anteriores a 0.9, y Thunderbird anteriores a 0.7, sólo comprueba la porción de nombre de máquina de un certificado cuando la porción de nombre de máquin... • http://bugzilla.mozilla.org/show_bug.cgi?id=234058 •
CVSS: 10.0EPSS: 22%CPEs: 3EXPL: 1CVE-2004-0648 – Mozilla 1.7 - External Protocol Handler
https://notcve.org/view.php?id=CVE-2004-0648
13 Jul 2004 — Mozilla (Suite) before 1.7.1, Firefox before 0.9.2, and Thunderbird before 0.7.2 allow remote attackers to launch arbitrary programs via a URI referencing the shell: protocol. Mozilla (suite) anteriores a 1.7.1 y Firefox anteriores a 0.9.2, y Thunderbird anteriores a 0.7.2 permiten a atacantes remotos lanzar programas arbitrarios mediante una URI referenciando el protocolo shell: • https://www.exploit-db.com/exploits/24263 •
CVSS: 9.1EPSS: 0%CPEs: 17EXPL: 1CVE-2003-0594
https://notcve.org/view.php?id=CVE-2003-0594
16 Mar 2004 — Mozilla allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Mozilla to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application. Mozilla permite a atacantes remotos saltarse las restriciones de cookies pretendidas en una aplicación web mediante secuencias de atravesamiento de directorios "%2e%2e" (punto pu... • http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html •
CVSS: 6.8EPSS: 1%CPEs: 32EXPL: 1CVE-2004-0191
https://notcve.org/view.php?id=CVE-2004-0191
15 Mar 2004 — Mozilla before 1.4.2 executes Javascript events in the context of a new page while it is being loaded, allowing it to interact with the previous page (zombie document) and enable cross-domain and cross-site scripting (XSS) attacks, as demonstrated using onmousemove events. Mozilla 1.4.2 ejecuta eventos de Javascript en el contexto de una nueva página mientras se está cargando, permitiéndolo interactuar con la página anterior ("documento zombi") y posibilitando ataques de secuencias de comandos en sitios cru... • http://bugzilla.mozilla.org/show_bug.cgi?id=227417 •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 0CVE-2003-0791
https://notcve.org/view.php?id=CVE-2003-0791
07 Oct 2003 — The Script.prototype.freeze/thaw functionality in Mozilla 1.4 and earlier allows attackers to execute native methods by modifying the string used as input to the script.thaw JavaScript function, which is then deserialized and executed. • http://secunia.com/advisories/11103 • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 2CVE-2002-2359 – Mozilla 1.0/1.1 - FTP View Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2002-2359
31 Dec 2002 — Cross-site scripting (XSS) vulnerability in the FTP view feature in Mozilla 1.0 allows remote attackers to inject arbitrary web script or HTML via the title tag of an ftp URL. • https://www.exploit-db.com/exploits/21682 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 5%CPEs: 12EXPL: 0CVE-2002-1308
https://notcve.org/view.php?id=CVE-2002-1308
29 Nov 2002 — Heap-based buffer overflow in Netscape and Mozilla allows remote attackers to execute arbitrary code via a jar: URL that references a malformed .jar file, which overflows a buffer during decompression. Desbordamiento de búfer basado en el montículo (heap) en Netscape y Mozilla permite a atacantes remotos ejecutar código arbitrario mediante una URL de tipo jar: que referencia a un fichero .jar malformado, lo que desborda un búfer durante la descompresión. • http://bugzilla.mozilla.org/show_bug.cgi?id=157646 •