Lucene search

K

35 matches found

CVE
CVE
added 2005/05/02 4:0 a.m.138 views

CVE-2005-0402

Firefox before 1.0.2 allows remote attackers to execute arbitrary code by tricking a user into saving a page as a Firefox sidebar panel, then using the sidebar panel to inject Javascript into a privileged page.

2.6CVSS6.7AI score0.01444EPSS
CVE
CVE
added 2005/05/12 4:0 a.m.92 views

CVE-2005-1532

Firefox before 1.0.4 and Mozilla Suite before 1.7.8 do not properly limit privileges of Javascript eval and Script objects in the calling context, which allows remote attackers to conduct unauthorized activities via "non-DOM property overrides," a variant of CVE-2005-1160.

7.5CVSS6.3AI score0.17427EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.79 views

CVE-2005-0527

Firefox 1.0 allows remote attackers to execute arbitrary code via plugins that load "privileged content" into frames, as demonstrated using certain XUL events when a user drags a scrollbar two times, aka "Firescrolling."

5.1CVSS7.3AI score0.03137EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.77 views

CVE-2005-1155

The favicon functionality in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to execute arbitrary code via a tag with a javascript: URL in the href attribute, aka "Firelinking."

7.5CVSS6.8AI score0.29686EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.69 views

CVE-2005-0989

The find_replen function in jsstr.c in the Javascript engine for Mozilla Suite 1.7.6, Firefox 1.0.1 and 1.0.2, and Netscape 7.2 allows remote attackers to read portions of heap memory in a Javascript string via the lambda replace method.

5CVSS6.2AI score0.25295EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.69 views

CVE-2005-1159

The native implementations of InstallTrigger and other functions in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 do not properly verify the types of objects being accessed, which causes the Javascript interpreter to continue execution at the wrong memory address, which may allow attackers to...

7.5CVSS6.9AI score0.0369EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.68 views

CVE-2005-0586

Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to spoof the extensions of files to download via the Content-Disposition header, which could be used to trick users into downloading dangerous content.

2.6CVSS6.2AI score0.00689EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.66 views

CVE-2005-0399

Heap-based buffer overflow in GIF2.cpp in Firefox before 1.0.2, Mozilla before to 1.7.6, and Thunderbird before 1.0.2, and possibly other applications that use the same library, allows remote attackers to execute arbitrary code via a GIF image with a crafted Netscape extension 2 block and buffer si...

5.1CVSS7AI score0.41278EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.65 views

CVE-2005-0401

FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka "Firescrolling...

5.1CVSS6.7AI score0.03853EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.63 views

CVE-2005-0255

String handling functions in Mozilla 1.7.3, Firefox 1.0, and Thunderbird before 1.0.2, such as the nsTSubstring_CharT::Replace function, do not properly check the return values of other functions that resize the string, which allows remote attackers to cause a denial of service and possibly execute...

5CVSS6.9AI score0.07998EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.63 views

CVE-2005-1157

Firefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to replace existing search plugins with malicious ones using sidebar.addSearchEngine and the same filename as the target engine, which may not be displayed in the GUI, which could then be used to execute mali...

7.5CVSS6.4AI score0.07353EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.62 views

CVE-2005-0591

Firefox before 1.0.1 allows remote attackers to spoof the (1) security and (2) download modal dialog boxes, which could be used to trick users into executing script or downloading and executing a file, aka "Firespoofing."

2.6CVSS6.2AI score0.02392EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.62 views

CVE-2005-1153

Firefox before 1.0.3 and Mozilla Suite before 1.7.7, when blocking a popup, allows remote attackers to execute arbitrary code via a javascript: URL that is executed when the user selects the "Show javascript" option.

7.5CVSS6.7AI score0.05041EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.61 views

CVE-2005-0232

Firefox 1.0 allows remote attackers to modify Boolean configuration parameters for the about:config site by using a plugin such as Flash, and the -moz-opacity filter, to display the about:config site then cause the user to double-click at a certain screen position, aka "Fireflashing."

2.6CVSS6.2AI score0.01324EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.61 views

CVE-2005-1160

The privileged "chrome" UI code in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to gain privileges by overriding certain properties or methods of DOM nodes, as demonstrated using multiple attacks involving the eval function or the Script object.

5.1CVSS6.6AI score0.04288EPSS
CVE
CVE
added 2005/05/09 4:0 a.m.61 views

CVE-2005-1477

The install function in Firefox 1.0.3 allows remote web sites on the browser's whitelist, such as update.mozilla.org or addon.mozilla.org, to execute arbitrary Javascript with chrome privileges, leading to arbitrary code execution on the system when combined with vulnerabilities such as CVE-2005-14...

5.1CVSS6.4AI score0.3815EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.59 views

CVE-2005-0589

The Form Fill feature in Firefox before 1.0.1 allows remote attackers to steal potentially sensitive information via an input control that monitors the values that are generated by the autocomplete capability.

5CVSS6.3AI score0.00647EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.59 views

CVE-2005-1156

Firefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to execute arbitrary script and code via a new search plugin using sidebar.addSearchEngine, aka "Firesearching 1."

7.5CVSS6.7AI score0.06778EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.58 views

CVE-2005-0588

Firefox before 1.0.1 and Mozilla before 1.7.6 does not restrict xsl:include and xsl:import tags in XSLT stylesheets to the current domain, which allows remote attackers to determine the existence of files on the local system.

5CVSS6.2AI score0.01477EPSS
CVE
CVE
added 2005/05/12 4:0 a.m.58 views

CVE-2005-1531

Firefox before 1.0.4 and Mozilla Suite before 1.7.8 does not properly implement certain security checks for script injection, which allows remote attackers to execute script via "Wrapped" javascript: URLs, as demonstrated using (1) a javascript: URL in a view-source: URL, (2) a javascript: URL in a...

7.5CVSS6.5AI score0.02198EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.57 views

CVE-2005-0578

Firefox before 1.0.1 and Mozilla Suite before 1.7.6 use a predictable filename for the plugin temporary directory, which allows local users to delete arbitrary files of other users via a symlink attack on the plugtmp directory.

2.1CVSS6.2AI score0.00074EPSS
CVE
CVE
added 2005/05/09 4:0 a.m.57 views

CVE-2005-1476

Firefox 1.0.3 allows remote attackers to execute arbitrary Javascript in other domains by using an IFRAME and causing the browser to navigate to a previous javascript: URL, which can lead to arbitrary code execution when combined with CVE-2005-1477.

5.1CVSS7.4AI score0.3815EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.56 views

CVE-2005-0141

Firefox before 1.0 and Mozilla before 1.7.5 allow remote attackers to load local files via links "with a custom getter and toString method" that are middle-clicked by the user to be opened in a new tab.

2.6CVSS6.2AI score0.00749EPSS
CVE
CVE
added 2005/05/26 4:0 a.m.56 views

CVE-2005-0150

Firefox before 1.0 allows the user to store a (1) javascript: or (2) data: URLs as a Livefeed bookmark, then executes it in the security context of the currently loaded page when the user later accesses the bookmark, which could allow remote attackers to execute arbitrary code.

5CVSS6.8AI score0.01433EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.55 views

CVE-2005-0146

Firefox before 1.0 and Mozilla before 1.7.5 allow remote attackers to obtain sensitive data from the clipboard via Javascript that generates a middle-click event on systems for which a middle-click performs a paste operation.

5CVSS6.2AI score0.00765EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.54 views

CVE-2005-0142

Firefox 0.9, Thunderbird 0.6 and other versions before 0.9, and Mozilla 1.7 before 1.7.5 save temporary files with world-readable permissions, which allows local users to read certain web content or attachments that belong to other users, e.g. content that is managed by helper applications such as ...

2.1CVSS6.1AI score0.00059EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.54 views

CVE-2005-0584

Firefox before 1.0.1 and Mozilla before 1.7.6, when displaying the HTTP Authentication dialog, do not change the focus to the tab that generated the prompt, which could facilitate spoofing and phishing attacks.

2.6CVSS6.2AI score0.00575EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.54 views

CVE-2005-1158

Multiple "missing security checks" in Firefox before 1.0.3 allow remote attackers to inject arbitrary Javascript into privileged pages using the _search target of the Firefox sidebar.

5CVSS6.3AI score0.00708EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.53 views

CVE-2005-0147

Firefox before 1.0 and Mozilla before 1.7.5, when configured to use a proxy, respond to 407 proxy auth requests from arbitrary servers, which allows remote attackers to steal NTLM or SPNEGO credentials.

7.5CVSS6.4AI score0.01128EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.52 views

CVE-2005-0230

Firefox 1.0 does not prevent the user from dragging an executable file to the desktop when it has an image/gif content type but has a dangerous extension such as .bat or .exe, which allows remote attackers to bypass the intended restriction and execute arbitrary commands via malformed GIF files tha...

5.1CVSS6.8AI score0.0221EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.52 views

CVE-2005-0590

The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and Mozilla before 1.7.6 allows remote attackers to use InstallTrigger to spoof the hostname of the host performing the installation via a long "user:pass" sequence in the URL, which appears before the real host...

5CVSS6.2AI score0.01766EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.51 views

CVE-2005-0144

Firefox before 1.0 and Mozilla before 1.7.5 display the secure site lock icon when a view-source: URL references a secure SSL site while an insecure page is being loaded, which could facilitate phishing attacks.

2.6CVSS6.2AI score0.00637EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.51 views

CVE-2005-1154

Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to execute arbitrary script in other domains via a setter function for a variable in the target domain, which is executed when the user visits that domain, aka "Cross-site scripting through global scope pollution."

7.5CVSS6.5AI score0.05516EPSS
CVE
CVE
added 2005/05/14 4:0 a.m.43 views

CVE-2005-1576

The file download dialog in Mozilla Firefox 0.10.1 and 1.0 for Windows uses the Content-Type HTTP header to determine the file type, but saves the original file extension when "Save to Disk" is selected, which allows remote attackers to hide the real file types of downloaded files.

2.6CVSS7.1AI score0.00486EPSS
CVE
CVE
added 2005/05/14 4:0 a.m.41 views

CVE-2005-1575

The file download dialog in Mozilla Firefox 0.10.1 and 1.0 for Windows allows remote attackers to hide the real file types of downloaded files via the Content-Type HTTP header and a filename containing whitespace, dots, or ASCII byte 160.

5CVSS7.1AI score0.00486EPSS