CVSS: 7.5EPSS: 8%CPEs: 12EXPL: 0CVE-2002-1308
https://notcve.org/view.php?id=CVE-2002-1308
Heap-based buffer overflow in Netscape and Mozilla allows remote attackers to execute arbitrary code via a jar: URL that references a malformed .jar file, which overflows a buffer during decompression. Desbordamiento de búfer basado en el montículo (heap) en Netscape y Mozilla permite a atacantes remotos ejecutar código arbitrario mediante una URL de tipo jar: que referencia a un fichero .jar malformado, lo que desborda un búfer durante la descompresión. • http://bugzilla.mozilla.org/show_bug.cgi?id=157646 http://marc.info/?l=bugtraq&m=103730181813075&w=2 http://www.redhat.com/support/errata/RHSA-2003-162.html http://www.redhat.com/support/errata/RHSA-2003-163.html http://www.securityfocus.com/bid/6185 https://exchange.xforce.ibmcloud.com/vulnerabilities/10636 https://access.redhat.com/security/cve/CVE-2002-1308 https://bugzilla.redhat.com/show_bug.cgi?id=1616870 •
CVSS: 5.0EPSS: 0%CPEs: 10EXPL: 0CVE-2002-1204
https://notcve.org/view.php?id=CVE-2002-1204
Netscape Communicator 4.x allows attackers to use a link to steal a user's preferences, including potentially sensitive information such as URL history, e-mail address, and possibly the e-mail password, by redefining the user_pref() function and accessing the prefs.js file, which is stored in a directory with a predictable name. Netscape Communicator 4.x permite a atacantes usar un enlace para robar las preferencias de un usuario, incluyendo información potencialmente sensible como historia de URLs, direcciones de correo electrónico, y posiblemente sus contraseñas, mediante la redefinición de la función user_pref() y accediendo al fichero prefs.js, que está almacenado en un directorio con un nombre predecible. • http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0081.html http://www.idefense.com/advisory/11.19.02c.txt http://www.iss.net/security_center/static/10655.php http://www.securityfocus.com/bid/6215 •
CVSS: 7.5EPSS: 6%CPEs: 13EXPL: 1CVE-2002-1091
https://notcve.org/view.php?id=CVE-2002-1091
Netscape 6.2.3 and earlier, and Mozilla 1.0.1, allow remote attackers to corrupt heap memory and execute arbitrary code via a GIF image with a zero width. • http://bugzilla.mozilla.org/show_bug.cgi?id=157989 http://crash.ihug.co.nz/~Sneuro/zerogif http://marc.info/?l=bugtraq&m=103134051120770&w=2 http://www.iss.net/security_center/static/10058.php http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:075 http://www.redhat.com/support/errata/RHSA-2002-192.html http://www.redhat.com/support/errata/RHSA-2003-046.html http://www.securityfocus.com/bid/5665 https://access.redhat.com/security/cve/CVE-2002-1091 h •
CVSS: 5.0EPSS: 32%CPEs: 26EXPL: 2CVE-2002-1042 – iPlanet Web Server 4.1 - Search Component File Disclosure
https://notcve.org/view.php?id=CVE-2002-1042
Directory traversal vulnerability in search engine for iPlanet web server 6.0 SP2 and 4.1 SP9, and Netscape Enterprise Server 3.6, when running on Windows platforms, allows remote attackers to read arbitrary files via ..\ (dot-dot backslash) sequences in the NS-query-pat parameter. • https://www.exploit-db.com/exploits/21603 http://archives.neohapsis.com/archives/bugtraq/2002-07/0085.html http://www.iss.net/security_center/static/9517.php http://www.securityfocus.com/bid/5191 •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2002-0815
https://notcve.org/view.php?id=CVE-2002-0815
The Javascript "Same Origin Policy" (SOP), as implemented in (1) Netscape, (2) Mozilla, and (3) Internet Explorer, allows a remote web server to access HTTP and SOAP/XML content from restricted sites by mapping the malicious server's parent DNS domain name to the restricted site, loading a page from the restricted site into one frame, and passing the information to the attacker-controlled frame, which is allowed because the document.domain of the two frames matches on the parent domain. • http://marc.info/?l=bugtraq&m=102796732924658&w=2 http://marc.info/?l=bugtraq&m=102798282208686&w=2 •