MO
Product
Mozilla
108
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 0Medium 1Low 0
Watch
Add Mozilla to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2005-0592 | – | Mar 25 | Heap-based buffer overflow in the UTF8ToNewUnicode function for Firefox before 1.0.1 and Mozilla before 1.7.6 might allow remote attackers to cause a denial of service (crash) or… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +16 more |
| CVE-2005-0585 | – | Mar 25 | Firefox before 1.0.1 and Mozilla before 1.7.6 truncates long sub-domains or paths for display, which may allow remote malicious web sites to spoof legitimate sites and facilitate… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +16 more |
| CVE-2005-0143 | – | Mar 23 | Firefox before 1.0 and Mozilla before 1.7.5 display the SSL lock icon when an insecure page loads a binary file from a trusted site, which could facilitate phishing attacks Affected: 0.8; 0.9.2; 0.9.2.1; 0.9.3; 0.9.4; 0.9.4.1; +34 more |
| CVE-2005-0593 | – | Mar 4 | Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote attackers to spoof the SSL "secure site" lock icon via (1) a web site that does not finish loading, which shows the… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +16 more |
| CVE-2005-0149 | – | Feb 15 | Thunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the network.cookie.disableCookieForMailNews preference, which could allow remote attackers to bypass the… Affected: 1.7; 1.7; 1.7; 1.7; 1.7; 1.7; +3 more |
| CVE-2005-0233 | – | Feb 8 | The International Domain Name (IDN) support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode encoded domain names… Affected: before 1.7.6 |
| CVE-2004-0903 | – | Jan 27 | Stack-based buffer overflow in the writeGroup function in nsVCardObj.cpp for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows… Affected: 1.7; 1.7.1; 1.7.2 |
| CVE-2004-0902 | – | Jan 27 | Multiple heap-based buffer overflows in Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote attackers to cause a denial of… Affected: 1.7; 1.7.1; 1.7.2 |
| CVE-2004-1451 | – | Dec 31 | Mozilla before 1.6 does not display the entire URL in the status bar when a link contains %00, which could allow remote attackers to trick users into clicking on unknown or… Affected: 0.8; 0.9.2; 0.9.2.1; 0.9.3; 0.9.4; 0.9.4.1; +29 more |
| CVE-2004-1450 | – | Dec 31 | Unknown vulnerability in LiveConnect in Mozilla 1.7 beta allows remote attackers to read arbitrary files in known locations Affected: 1.7 |
| CVE-2004-1449 | – | Dec 31 | Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7 allows remote attackers to determine the location of files on a user's hard drive by obscuring a file upload… Affected: 0.8; 0.9.2; 0.9.2.1; 0.9.3; 0.9.4; 0.9.4.1; +30 more |
| CVE-2004-1156 | – | Dec 31 | Mozilla before 1.7.6, and Firefox before 1.0.1, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known… Affected: 0.8; 0.9.2; 0.9.2.1; 0.9.3; 0.9.4; 0.9.4.1; +34 more |
| CVE-2004-0909 | – | Dec 31 | Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 may allow remote attackers to trick users into performing unexpected actions,… Affected: 0.8; 0.9.2; 0.9.2.1; 0.9.3; 0.9.4; 0.9.4.1; +34 more |
| CVE-2004-0908 | – | Dec 31 | Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows untrusted Javascript code to read and write to the clipboard, and possibly… Affected: 0.8; 0.9.2; 0.9.2.1; 0.9.3; 0.9.4; 0.9.4.1; +34 more |
| CVE-2004-0907 | – | Dec 31 | The Linux install .tar.gz archives for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8, create certain files with insecure… Affected: 0.8; 0.9.2; 0.9.2.1; 0.9.3; 0.9.4; 0.9.4.1; +34 more |
| CVE-2004-0906 | – | Dec 31 | The XPInstall installer in Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 sets insecure permissions for certain installed files… Affected: 0.8; 0.9.2; 0.9.2.1; 0.9.3; 0.9.4; 0.9.4.1; +34 more |
| CVE-2004-0904 | – | Dec 31 | Integer overflow in the bitmap (BMP) decoder for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote attackers to execute… Affected: 1.7; 1.7; 1.7.1; 1.7.2 |
| CVE-2004-2659 | – | Dec 31 | Opera offers an Open button to verify that a user wishes to execute a downloaded file, which allows user-assisted remote attackers to construct a race condition that tricks a user… Affected: All versions, or not specified |
| CVE-2004-1753 | – | Dec 31 | The Apple Java plugin, as used in Netscape 7.1 and 7.2, Mozilla 1.7.2, and Firefox 0.9.3 on MacOS X 10.3.5, when tabbed browsing is enabled, does not properly handle… Affected: 1.7.2 |
| CVE-2004-1316 | – | Dec 29 | Heap-based buffer overflow in MSG_UnEscapeSearchUrl in nsNNTPProtocol.cpp for Mozilla 1.7.3 and earlier allows remote attackers to cause a denial of service (application crash)… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +15 more |
| CVE-2004-1381 | – | Oct 20 | Firefox before 1.0 and Mozilla before 1.7.5 allow inactive (background) tabs to focus on input being entered in the active tab, as originally reported using form fields, which… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +15 more |
| CVE-2004-1380 | – | Oct 20 | Firefox before 1.0 and Mozilla before 1.7.5 allows inactive (background) tabs to launch dialog boxes, which can allow remote attackers to spoof the dialog boxes from web sites in… Affected: 1.3; 1.4; 1.4; 1.4.1; 1.5; 1.5; +15 more |
| CVE-2004-1614 | – | Oct 18 | Mozilla allows remote attackers to cause a denial of service (application crash from invalid memory access) via an "unusual combination of visual elements," including several… Affected: 1.0; 1.0; 1.0; 1.0.1; 1.0.2; 1.1; +21 more |
| CVE-2004-1613 | – | Oct 18 | Mozilla allows remote attackers to cause a denial of service (application crash from null dereference or infinite loop) via a web page that contains a (1) TEXTAREA, (2) INPUT, (3)… Affected: 1.0; 1.0; 1.0; 1.0.1; 1.0.2; 1.1; +22 more |
| CVE-2004-0871 | – | Sep 16 | Mozilla does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain, which could allow remote… Affected: 0.9.2 |
| CVE-2004-0905 | – | Sep 14 | Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to perform cross-domain scripting and possibly execute… Affected: 1.0; 1.0; 1.0; 1.0.1; 1.0.2; 1.1; +19 more |
| CVE-2004-0761 | – | Aug 18 | Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote attackers to use certain redirect sequences to spoof the security lock icon that makes a web page… Affected: through 1.7 |
| CVE-2004-0779 | – | Aug 18 | The (1) Mozilla 1.6, (2) Firebird 0.7 and (3) Firefox 0.8 web browsers do not properly verify that cached passwords for SSL encrypted sites are only sent via SSL encrypted… Affected: 1.6 |
| CVE-2004-0765 | – | Aug 18 | The cert_TestHostName function in Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, only checks the hostname portion of a certificate when the hostname portion… Affected: through 1.7 |
| CVE-2004-0764 | – | Aug 18 | Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the "chrome" flag and XML User Interface Language (XUL)… Affected: through 1.7 |
| CVE-2004-0762 | – | Aug 18 | Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall… Affected: through 1.7 |
| CVE-2004-0760 | – | Aug 18 | Mozilla allows remote attackers to cause Mozilla to open a URI as a different MIME type than expected via a null character (%00) in an FTP URI Affected: All versions, or not specified |
| CVE-2004-0759 | – | Aug 18 | Mozilla before 1.7 allows remote web servers to read arbitrary files via Javascript that sets the value of an <input type="file"> tag Affected: All versions, or not specified |
| CVE-2004-0758 | – | Aug 18 | Mozilla 1.5 through 1.7 allows a CA certificate to be imported even when their DN is the same as that of the built-in CA root certificate, which allows remote attackers to cause a… Affected: All versions, or not specified |
| CVE-2004-0757 | – | Aug 18 | Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to… Affected: through 1.7 |
| CVE-2004-0722 | – | Aug 18 | Integer overflow in the SOAPParameter object constructor in (1) Netscape version 7.0 and 7.1 and (2) Mozilla 1.6, and possibly earlier versions, allows remote attackers to execute… Affected: 1.6 |
| CVE-2004-0648 | – | Aug 6 | Mozilla (Suite) before 1.7.1, Firefox before 0.9.2, and Thunderbird before 0.7.2 allow remote attackers to launch arbitrary programs via a URI referencing the shell: protocol Affected: through 1.7.1 |
| CVE-2004-0718 | – | Jul 27 | The (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content into a frame that… Affected: 1.6 |
| CVE-2004-0478 | – | Jul 7 | Unknown versions of Mozilla allow remote attackers to cause a denial of service (high CPU/RAM consumption) using Javascript with an infinite loop that continues to add input to a… Affected: All versions, or not specified |
| CVE-2003-0594 | – | Apr 15 | Mozilla allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which… Affected: 1.0; 1.0; 1.0; 1.0.1; 1.0.2; 1.1; +11 more |
| CVE-2004-0191 | – | Mar 15 | Mozilla before 1.4.2 executes Javascript events in the context of a new page while it is being loaded, allowing it to interact with the previous page (zombie document) and enable… Affected: 0.8; 0.9.2; 0.9.2.1; 0.9.3; 0.9.4; 0.9.4.1; +26 more |
| CVE-2003-1265 | – | Dec 31 | Netscape 7.0 and Mozilla 5.0 do not immediately delete messages in the trash folder when users select the 'Empty Trash' option, which could allow local users to access deleted… Affected: 5.0 |
| CVE-2003-0300 | – | Jun 16 | The IMAP Client for Sylpheed 0.8.11 allows remote malicious IMAP servers to cause a denial of service (crash) via certain large literal size values that cause either integer… Affected: 1.3; 1.4 |
| CVE-2003-0298 | – | Jun 16 | The IMAP Client for Mozilla 1.3 and 1.4a allows remote malicious IMAP servers to cause a denial of service and possibly execute arbitrary code via certain large (1) literal and… Affected: 1.3; 1.4 |
| CVE-2002-2013 | – | Dec 31 | Mozilla 0.9.6 and earlier and Netscape 6.2 and earlier allows remote attackers to steal cookies from another domain via a link with a hex-encoded null character (%00) followed by… Affected: 0.9.2; 0.9.2.1; 0.9.3; 0.9.4; 0.9.4.1; 0.9.5; +1 more |
| CVE-2002-2359 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in the FTP view feature in Mozilla 1.0 allows remote attackers to inject arbitrary web script or HTML via the title tag of an ftp URL Affected: 1.0; 1.0; 1.0; 1.1 |
| CVE-2002-2338 | – | Dec 31 | The POP3 mail client in Mozilla 1.0 and earlier, and Netscape Communicator 4.7 and earlier, allows remote attackers to cause a denial of service (no new mail) via a mail message… Affected: 0.9.2; 0.9.2.1; 0.9.3; 0.9.4; 0.9.4.1; 0.9.5; +7 more |
| CVE-2002-2314 | – | Dec 31 | Mozilla 1.0 allows remote attackers to steal cookies from other domains via a javascript: URL with a leading "//" and ending in a newline, which causes the host/path check to fail Affected: 1.0 |
| CVE-2002-2061 | – | Dec 31 | Heap-based buffer overflow in Netscape 6.2.3 and Mozilla 1.0 and earlier allows remote attackers to crash client browsers and execute arbitrary code via a PNG image with large… Affected: through 1.0 |
| CVE-2002-1308 | – | Nov 29 | Heap-based buffer overflow in Netscape and Mozilla allows remote attackers to execute arbitrary code via a jar: URL that references a malformed .jar file, which overflows a buffer… Affected: 0.9.6; 0.9.7; 0.9.8; 0.9.9; 1.0; 1.0.1; +1 more |