MO
Product
Mozilla
108
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 0Medium 1Low 0
Watch
Add Mozilla to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2007-4039 | 9.8 | Jul 27 | Argument injection vulnerability involving Mozilla, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary… Affected: All versions, or not specified |
| CVE-2003-0791 | 9.8 | Oct 7 | The Script.prototype.freeze/thaw functionality in Mozilla 1.4 and earlier allows attackers to execute native methods by modifying the string used as input to the script.thaw… Affected: through 1.4 |
| CVE-2005-0587 | 6.5 | Mar 25 | Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which… Affected: before 1.7.6 |
| CVE-2009-3014 | – | Aug 31 | Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly handle javascript: URIs in HTML links within… Affected: through 1.7; 0.8; 0.9.2; 0.9.2.1; 0.9.3; 0.9.4; +34 more |
| CVE-2009-3010 | – | Aug 31 | Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly block data: URIs in Refresh headers in HTTP… Affected: through 1.7.12 |
| CVE-2007-3144 | – | Jun 11 | Visual truncation vulnerability in Mozilla 1.7.12 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated… Affected: 1.7.12 |
| CVE-2007-1794 | – | Apr 2 | The Javascript engine in Mozilla 1.7 and earlier on Sun Solaris 8, 9, and 10 might allow remote attackers to execute arbitrary code via vectors involving garbage collection that… Affected: through 1.7 |
| CVE-2006-6498 | – | Dec 20 | Multiple unspecified vulnerabilities in the JavaScript engine for Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, SeaMonkey before 1.0.7, and… Affected: 1.7 |
| CVE-2006-0292 | – | Feb 2 | The Javascript interpreter (jsinterp.c) in Mozilla and Firefox before 1.5.1 does not properly dereference objects, which allows remote attackers to cause a denial of service… Affected: 1.4; 1.4.1; 1.5; 1.5; 1.5; 1.5 |
| CVE-2006-0496 | – | Feb 1 | Cross-site scripting (XSS) vulnerability in Mozilla 1.7.12 and possibly earlier, Mozilla Firefox 1.0.7 and possibly earlier, and Netscape 8.1 and possibly earlier, allows remote… Affected: 1.7; 1.7; 1.7; 1.7; 1.7; 1.7; +10 more |
| CVE-2005-4809 | – | Dec 31 | Mozilla Firefox 1.0.1 and possibly other versions, including Mozilla and Thunderbird, allows remote attackers to spoof the URL in the Status Bar via an A HREF tag that contains a… Affected: 1.7.3; 1.7.4; 1.7.5; 1.7.6 |
| CVE-2005-4685 | – | Dec 31 | Firefox and Mozilla can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote attackers to trick a user into… Affected: 0.8; 0.9.2; 0.9.2.1; 0.9.3; 0.9.4; 0.9.4.1; +34 more |
| CVE-2005-4874 | – | Dec 31 | The XMLHttpRequest object in Mozilla 1.7.8 supports the HTTP TRACE method, which allows remote attackers to obtain (1) proxy authentication passwords via a request with a… Affected: 1.7.8 |
| CVE-2005-3896 | – | Nov 29 | Mozilla allows remote attackers to cause a denial of service (CPU consumption) via a Javascript BODY onload event that calls the window function Affected: All versions, or not specified |
| CVE-2005-2968 | – | Sep 20 | Firefox 1.0.6 and Mozilla 1.7.10 allows attackers to execute arbitrary commands via shell metacharacters in a URL that is provided to the browser on the command line, which is… Affected: 1.7.10 |
| CVE-2005-2270 | – | Jul 13 | Firefox before 1.0.5 and Mozilla before 1.7.9 does not properly clone base objects, which allows remote attackers to execute arbitrary code by navigating the prototype chain to… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +19 more |
| CVE-2005-2269 | – | Jul 13 | Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 does not properly verify the associated types of DOM node names within the context of their namespaces, which allows… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +19 more |
| CVE-2005-2268 | – | Jul 13 | Firefox before 1.0.5 and Mozilla before 1.7.9 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +19 more |
| CVE-2005-2266 | – | Jul 13 | Firefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other methods in a parent frame, even when the parent is in a different domain, which… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +19 more |
| CVE-2005-2265 | – | Jul 13 | Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 allows remote attackers to cause a denial of service (access violation and crash), and possibly execute… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +19 more |
| CVE-2005-2263 | – | Jul 13 | The InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function in the context of another domain by… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +19 more |
| CVE-2005-2261 | – | Jul 13 | Firefox before 1.0.5, Thunderbird before 1.0.5, Mozilla before 1.7.9, Netscape 8.0.2, and K-Meleon 0.9 runs XBL scripts even when Javascript has been disabled, which makes it… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +19 more |
| CVE-2005-2260 | – | Jul 13 | The browser user interface in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 does not properly distinguish between user-generated events and untrusted… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +19 more |
| CVE-2005-2114 | – | Jul 5 | Mozilla 1.7.8, Firefox 1.0.4, Camino 0.8.4, Netscape 8.0.2, and K-Meleon 0.9, and possibly other products that use the Gecko engine, allow remote attackers to cause a denial of… Affected: 1.7.8 |
| CVE-2005-1937 | – | Jun 14 | A regression error in Firefox 1.0.3 and Mozilla 1.7.7 allows remote attackers to inject arbitrary Javascript from one page into the frameset of another site, aka the frame… Affected: 1.7.7 |
| CVE-2005-1532 | – | May 12 | Firefox before 1.0.4 and Mozilla Suite before 1.7.8 do not properly limit privileges of Javascript eval and Script objects in the calling context, which allows remote attackers to… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +18 more |
| CVE-2005-1531 | – | May 12 | Firefox before 1.0.4 and Mozilla Suite before 1.7.8 does not properly implement certain security checks for script injection, which allows remote attackers to execute script via… Affected: through 1.4; 1.4.1; 1.5; 1.5; 1.5; 1.5; +16 more |
| CVE-2005-0399 | – | May 2 | Heap-based buffer overflow in GIF2.cpp in Firefox before 1.0.2, Mozilla before to 1.7.6, and Thunderbird before 1.0.2, and possibly other applications that use the same library,… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +16 more |
| CVE-2005-1160 | – | May 2 | The privileged "chrome" UI code in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to gain privileges by overriding certain properties or methods of… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +17 more |
| CVE-2005-1159 | – | May 2 | The native implementations of InstallTrigger and other functions in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 do not properly verify the types of objects being accessed,… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +17 more |
| CVE-2005-1157 | – | May 2 | Firefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to replace existing search plugins with malicious ones using sidebar.addSearchEngine and… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +17 more |
| CVE-2005-1156 | – | May 2 | Firefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to execute arbitrary script and code via a new search plugin using… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +17 more |
| CVE-2005-1155 | – | May 2 | The favicon functionality in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to execute arbitrary code via a <LINK rel="icon"> tag with a javascript:… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +17 more |
| CVE-2005-1154 | – | May 2 | Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to execute arbitrary script in other domains via a setter function for a variable in the target domain,… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +17 more |
| CVE-2005-1153 | – | May 2 | Firefox before 1.0.3 and Mozilla Suite before 1.7.7, when blocking a popup, allows remote attackers to execute arbitrary code via a javascript: URL that is executed when the user… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +17 more |
| CVE-2005-0989 | – | May 2 | The find_replen function in jsstr.c in the Javascript engine for Mozilla Suite 1.7.6, Firefox 1.0.1 and 1.0.2, and Netscape 7.2 allows remote attackers to read portions of heap… Affected: 1.7.6 |
| CVE-2005-0590 | – | May 2 | The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and Mozilla before 1.7.6 allows remote attackers to use InstallTrigger to spoof the… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +16 more |
| CVE-2005-0588 | – | May 2 | Firefox before 1.0.1 and Mozilla before 1.7.6 does not restrict xsl:include and xsl:import tags in XSLT stylesheets to the current domain, which allows remote attackers to… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +16 more |
| CVE-2005-0586 | – | May 2 | Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to spoof the extensions of files to download via the Content-Disposition header, which could be… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +16 more |
| CVE-2005-0584 | – | May 2 | Firefox before 1.0.1 and Mozilla before 1.7.6, when displaying the HTTP Authentication dialog, do not change the focus to the tab that generated the prompt, which could facilitate… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +16 more |
| CVE-2005-0578 | – | May 2 | Firefox before 1.0.1 and Mozilla Suite before 1.7.6 use a predictable filename for the plugin temporary directory, which allows local users to delete arbitrary files of other… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +16 more |
| CVE-2005-0401 | – | May 2 | FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +16 more |
| CVE-2005-0255 | – | May 2 | String handling functions in Mozilla 1.7.3, Firefox 1.0, and Thunderbird before 1.0.2, such as the nsTSubstring_CharT::Replace function, do not properly check the return values of… Affected: 1.7.3 |
| CVE-2005-0238 | – | May 2 | The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL… Affected: through 1.6 |
| CVE-2005-0215 | – | May 2 | Mozilla 1.6 and possibly other versions allows remote attackers to cause a denial of service (application crash) via a XBM (X BitMap) file with a large (1) height or (2) width… Affected: 1.6 |
| CVE-2005-0147 | – | May 2 | Firefox before 1.0 and Mozilla before 1.7.5, when configured to use a proxy, respond to 407 proxy auth requests from arbitrary servers, which allows remote attackers to steal NTLM… Affected: 1.7; 1.7; 1.7.1; 1.7.2; 1.7.3 |
| CVE-2005-0146 | – | May 2 | Firefox before 1.0 and Mozilla before 1.7.5 allow remote attackers to obtain sensitive data from the clipboard via Javascript that generates a middle-click event on systems for… Affected: 1.7; 1.7; 1.7.1; 1.7.2; 1.7.3 |
| CVE-2005-0144 | – | May 2 | Firefox before 1.0 and Mozilla before 1.7.5 display the secure site lock icon when a view-source: URL references a secure SSL site while an insecure page is being loaded, which… Affected: 1.7; 1.7; 1.7.1; 1.7.2; 1.7.3 |
| CVE-2005-0142 | – | May 2 | Firefox 0.9, Thunderbird 0.6 and other versions before 0.9, and Mozilla 1.7 before 1.7.5 save temporary files with world-readable permissions, which allows local users to read… Affected: 1.7; 1.7; 1.7.1; 1.7.2; 1.7.3 |
| CVE-2005-0141 | – | May 2 | Firefox before 1.0 and Mozilla before 1.7.5 allow remote attackers to load local files via links "with a custom getter and toString method" that are middle-clicked by the user to… Affected: 1.7; 1.7; 1.7.1; 1.7.2; 1.7.3 |