Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 138

Export CSV
CVE-2005-1156

security flaw

Firefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to execute arbitrary script and code via a new search plugin using sidebar.addSearchEngine, aka "Firesearching 1."

CVSS 2.0 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Mozilla Netscape Redhat
Products
Firefox Mozilla Navigator and 1 more
CVE-2005-1157

security flaw

Firefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to replace existing search plugins with malicious ones using sidebar.addSearchEngine and the same filename as the target engine, which may not be displayed in the GUI, which could then be used to execute malicious script, aka "Firesearching 2."

CVSS 2.0 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Mozilla Netscape Redhat
Products
Firefox Mozilla Navigator and 1 more
CVE-2005-1159

security flaw

The native implementations of InstallTrigger and other functions in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 do not properly verify the types of objects being accessed, which causes the Javascript interpreter to continue execution at the wrong memory address, which may allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code by passing objects of the wrong type.

CVSS 2.0 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Mozilla Enterprise Linux
CVE-2005-1160

security flaw

The privileged "chrome" UI code in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to gain privileges by overriding certain properties or methods of DOM nodes, as demonstrated using multiple attacks involving the eval function or the Script object.

CVSS 2.0 · 5.1 Medium EPSS 2.7% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Mozilla Enterprise Linux
CVE-2005-1531

security flaw

Firefox before 1.0.4 and Mozilla Suite before 1.7.8 does not properly implement certain security checks for script injection, which allows remote attackers to execute script via "Wrapped" javascript: URLs, as demonstrated using (1) a javascript: URL in a view-source: URL, (2) a javascript: URL in a jar: URL, or (3) "a nested variant."

CVSS 2.0 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Mozilla Enterprise Linux
CVE-2005-1532

security flaw

Firefox before 1.0.4 and Mozilla Suite before 1.7.8 do not properly limit privileges of Javascript eval and Script objects in the calling context, which allows remote attackers to conduct unauthorized activities via "non-DOM property overrides," a variant of CVE-2005-1160.

CVSS 2.0 · 7.5 High EPSS 9.5% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Mozilla Enterprise Linux
CVE-2005-1937

security flaw

A regression error in Firefox 1.0.3 and Mozilla 1.7.7 allows remote attackers to inject arbitrary Javascript from one page into the frameset of another site, aka the frame injection spoofing vulnerability, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2004-0718.

CVSS 2.0 · 2.6 Low EPSS 2.6% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Mozilla Enterprise Linux
CVE-2005-2114

security flaw

Mozilla 1.7.8, Firefox 1.0.4, Camino 0.8.4, Netscape 8.0.2, and K-Meleon 0.9, and possibly other products that use the Gecko engine, allow remote attackers to cause a denial of service (application crash) via JavaScript that repeatedly calls an empty function.

CVSS 2.0 · 5.0 Medium EPSS 2.1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Camino Firefox Mozilla and 1 more
CVE-2005-2260

security flaw

The browser user interface in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 does not properly distinguish between user-generated events and untrusted synthetic events, which makes it easier for remote attackers to perform dangerous actions that normally could only be performed manually by the user.

CVSS 2.0 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Mozilla Enterprise Linux
CVE-2005-2261

security flaw

Firefox before 1.0.5, Thunderbird before 1.0.5, Mozilla before 1.7.9, Netscape 8.0.2, and K-Meleon 0.9 runs XBL scripts even when Javascript has been disabled, which makes it easier for remote attackers to bypass such protection.

CVSS 2.0 · 7.5 High EPSS 3.6% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Mozilla Thunderbird and 1 more
CVE-2005-2263

security flaw

The InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function in the context of another domain by forcing a page navigation after the install method has been called, which causes the callback to be run in the context of the new page and results in a same origin violation.

CVSS 2.0 · 5.0 Medium EPSS 3.1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Mozilla Enterprise Linux
CVE-2005-2265

security flaw

Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 allows remote attackers to cause a denial of service (access violation and crash), and possibly execute arbitrary code, by calling InstallVersion.compareTo with an object instead of a string.

CVSS 2.0 · 5.0 Medium EPSS 68.1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Mozilla Enterprise Linux
CVE-2005-2266

security flaw

Firefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other methods in a parent frame, even when the parent is in a different domain, which violates the same origin policy and allows remote attackers to steal sensitive information such as cookies and passwords from web sites whose child frames do not verify that they are in the same domain as their parents.

CVSS 2.0 · 5.0 Medium EPSS 1.8% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Mozilla Enterprise Linux
CVE-2005-2268

security flaw

Firefox before 1.0.5 and Mozilla before 1.7.9 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability."

CVSS 2.0 · 2.6 Low EPSS 2.9% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Mozilla Enterprise Linux
CVE-2005-2269

security flaw

Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 does not properly verify the associated types of DOM node names within the context of their namespaces, which allows remote attackers to modify certain tag properties, possibly leading to execution of arbitrary script or code, as demonstrated using an XHTML document with IMG tags with custom properties ("XHTML node spoofing").

CVSS 2.0 · 7.5 High EPSS 5.8% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Mozilla Enterprise Linux
CVE-2005-2270

security flaw

Firefox before 1.0.5 and Mozilla before 1.7.9 does not properly clone base objects, which allows remote attackers to execute arbitrary code by navigating the prototype chain to reach a privileged object.

CVSS 2.0 · 7.5 High EPSS 6.0% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Mozilla Enterprise Linux
CVE-2005-2701

security flaw

Heap-based buffer overflow in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to execute arbitrary code via an XBM image file that ends in a large number of spaces instead of the expected end tag.

CVSS 2.0 · 7.5 High EPSS 6.9% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Mozilla Suite Enterprise Linux
CVE-2005-2702

security flaw

Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Unicode sequences with "zero-width non-joiner" characters.

CVSS 2.0 · 7.5 High EPSS 3.6% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Mozilla Suite Enterprise Linux
CVE-2005-2703

security flaw

Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to modify HTTP headers of XML HTTP requests via XMLHttpRequest, and possibly use the client to exploit vulnerabilities in servers or proxies, including HTTP request smuggling and HTTP request splitting.

CVSS 2.0 · 5.0 Medium EPSS 1.8% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Mozilla Suite Enterprise Linux