Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 707

Export CSV
CVE-2008-2809

Firefox self signed certificate flaw

Mozilla 1.9 M8 and earlier, Mozilla Firefox 2 before 2.0.0.15, SeaMonkey 1.1.5 and other versions before 1.1.10, Netscape 9.0, and other Mozilla-based web browsers, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regard the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid certificate for a spoofed web site.

CVSS 2.0 · 4.0 Medium EPSS 1.2% KEV · Not listed
Vendors
Mozilla Netscape Redhat
Products
Firefox Geckb Seamonkey and 2 more
CVE-2008-2810

Firefox arbitrary file disclosure

Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly identify the context of Windows shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy via a crafted web site for which the user has previously saved a shortcut.

CVSS 2.0 · 6.8 Medium EPSS 1.1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Enterprise Linux
CVE-2008-2811

Firefox block reflow flaw

The block reflow implementation in Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image whose display requires more pixels than nscoord_MAX, related to nsBlockFrame::DrainOverflowLines.

CVSS 2.0 · 10.0 Critical EPSS 7.1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Thunderbird and 1 more
CVE-2008-3835

mozilla: nsXMLDocument:: OnChannelRedirect() same-origin violation

The nsXMLDocument::OnChannelRedirect function in Mozilla Firefox before 2.0.0.17, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 2.1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Thunderbird and 1 more
CVE-2008-3837

mozilla: Forced mouse drag

Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, and SeaMonkey before 1.1.12, allow user-assisted remote attackers to move a window during a mouse click, and possibly force a file download or unspecified other drag-and-drop action, via a crafted onmousedown action that calls window.moveBy, a variant of CVE-2003-0823.

CVSS 2.0 · 9.3 Critical EPSS 3.3% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 2 more
CVE-2008-4058

Mozilla privilege escalation via XPCnativeWrapper pollution

The XPConnect component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to "pollute XPCNativeWrappers" and execute arbitrary code with chrome privileges via vectors related to (1) chrome XBL and (2) chrome JS.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 3 more
CVE-2008-4060

Mozilla privilege escalation via XPCnativeWrapper pollution

Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to create documents that lack script-handling objects, and execute arbitrary code with chrome privileges, via vectors related to (1) the document.loadBindingDocument function and (2) XSLT.

CVSS 2.0 · 7.5 High EPSS 4.8% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Thunderbird and 1 more
CVE-2008-4061

Mozilla layout engine crash

Integer overflow in the MathML component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via an mtd element with a large integer value in the rowspan attribute, related to the layout engine.

CVSS 2.0 · 10.0 Critical EPSS 5.0% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 3 more
CVE-2008-4062

Mozilla crashes with evidence of memory corruption

Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the JavaScript engine and (1) misinterpretation of the characteristics of Namespace and QName in jsxml.c, (2) misuse of signed integers in the nsEscapeCount function in nsEscape.cpp, and (3) interaction of JavaScript garbage collection with certain use of an NPObject in the nsNPObjWrapper::GetNewOrUsed function in nsJSNPRuntime.cpp.

CVSS 2.0 · 10.0 Critical EPSS 5.0% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 3 more
CVE-2008-4065

Mozilla BOM characters stripped from JavaScript before execution

Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via byte order mark (BOM) characters that are removed from JavaScript code before execution, aka "Stripped BOM characters bug."

CVSS 2.0 · 4.3 Medium EPSS 4.1% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 3 more
CVE-2008-4067

resource: traversal vulnerability

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 on Linux allows remote attackers to read arbitrary files via a .. (dot dot) and URL-encoded / (slash) characters in a resource: URI.

CVSS 2.0 · 4.3 Medium EPSS 4.4% KEV · Not listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 4 more
CVE-2008-4068

recource: bypass

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass "restrictions imposed on local HTML files," and obtain sensitive information and prompt users to write this information into a file, via directory traversal sequences in a resource: URI.

CVSS 2.0 · 7.8 High EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 3 more
CVE-2008-4069

Mozilla XBM decoder information disclosure

The XBM decoder in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to read uninitialized memory, and possibly obtain sensitive information in opportunistic circumstances, via a crafted XBM image file.

CVSS 2.0 · 5.0 Medium EPSS 1.7% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Enterprise Linux
CVE-2008-4070

Thunderbird cancelled newsgrop messages

Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long header in a news article, related to "canceling [a] newsgroup message" and "cancelled newsgroup messages."

CVSS 2.0 · 10.0 Critical EPSS 7.4% KEV · Not listed
Vendors
Mozilla Redhat
Products
Seamonkey Thunderbird Enterprise Linux
CVE-2008-4582

Mozilla same origin policy bypass

Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.

CVSS 2.0 · 4.3 Medium EPSS 10.2% KEV · Not listed
Vendors
Canonical Debian Microsoft and 1 more
Products
Ubuntu Linux Debian Linux Windows and 2 more
CVE-2008-4821

jar: protocol handler

Adobe Flash Player 9.0.124.0 and earlier, when a Mozilla browser is used, does not properly interpret jar: URLs, which allows attackers to obtain sensitive information via unknown vectors.

CVSS 2.0 · 4.3 Medium EPSS 6.5% KEV · Not listed
Vendors
Adobe Mozilla Redhat
Products
Flash Player Camino Firefox and 2 more
CVE-2008-5012

Mozilla Image stealing via canvas and HTTP redirect

Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are not directly accessible to the attacker. NOTE: this issue can be leveraged to enumerate software on the client by performing redirections related to moz-icon.

CVSS 2.0 · 5.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Thunderbird and 1 more
CVE-2008-5013

Mozilla Flash Player dynamic module unloading flaw

Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when the Flash module has been dynamically unloaded properly, which allows remote attackers to execute arbitrary code via a crafted SWF file that "dynamically unloads itself from an outside JavaScript function," which triggers an access of an expired memory address.

CVSS 2.0 · 9.3 Critical EPSS 4.8% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Enterprise Linux
CVE-2008-5014

Mozilla crash and remote code execution via __proto__ tampering

jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying the window.__proto__.__proto__ object in a way that causes a lock on a non-native object, which triggers an assertion failure related to the OBJ_IS_NATIVE function.

CVSS 2.0 · 10.0 Critical EPSS 5.9% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 3 more
CVE-2008-5508

Firefox errors parsing URLs with control characters

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters, which might allow remote attackers to misrepresent URLs and simplify phishing attacks.

CVSS 2.0 · 4.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 3 more