Mozilla » Firefox : Security Vulnerabilities

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2002-2436	200	+Info	2011-12-07	2017-08-29	4.3	None	Remote	Medium	Not required	Partial	None	None
The Cascading Style Sheets (CSS) implementation in Mozilla Firefox before 4.0, Thunderbird before 3.3, and SeaMonkey before 2.1 does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document, a related issue to CVE-2010-2264.
2	CVE-2002-2437	264	+Info	2011-12-07	2012-03-08	5.0	None	Remote	Low	Not required	Partial	None	None
The JavaScript implementation in Mozilla Firefox before 4.0, Thunderbird before 3.3, and SeaMonkey before 2.1 does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which allows remote attackers to obtain sensitive information about visited web pages by calling this method.
3	CVE-2003-1492	59		2003-12-31	2017-07-29	5.0	None	Remote	Low	Not required	None	Partial	None
Netscape Navigator 7.0.2 and Mozilla allows remote attackers to access cookie information in a different domain via an HTTP request for a domain with an extra . (dot) at the end.
4	CVE-2004-0761			2004-08-18	2017-10-11	5.0	None	Remote	Low	Not required	None	Partial	None
Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote attackers to use certain redirect sequences to spoof the security lock icon that makes a web page appear to be encrypted.
5	CVE-2004-0762			2004-08-18	2017-10-11	5.0	None	Remote	Low	Not required	None	Partial	None
Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box.
6	CVE-2004-0763			2004-08-18	2017-10-11	5.0	None	Remote	Low	Not required	None	Partial	None
Mozilla Firefox 0.9.1 and 0.9.2 allows remote web sites to spoof certificates of trusted web sites via redirects and Javascript that uses the "onunload" method.
7	CVE-2004-0765			2004-08-18	2017-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The cert_TestHostName function in Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, only checks the hostname portion of a certificate when the hostname portion of the URI is not a fully qualified domain name (FQDN), which allows remote attackers to spoof trusted certificates.
8	CVE-2004-0779			2004-08-18	2017-07-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The (1) Mozilla 1.6, (2) Firebird 0.7 and (3) Firefox 0.8 web browsers do not properly verify that cached passwords for SSL encrypted sites are only sent via SSL encrypted sessions to the site, which allows a remote attacker to cause a cached password to be sent in cleartext to a spoofed site.
9	CVE-2004-0866			2004-09-16	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 6.0 allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk, and .sch.uk, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session.
10	CVE-2004-0867	264		2004-12-23	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Mozilla Firefox 0.9.2 allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk, and .sch.uk, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session. NOTE: it was later reported that 2.x is also affected.
11	CVE-2004-0905		Exec Code	2004-09-14	2017-10-11	4.6	None	Local	Low	Not required	Partial	Partial	Partial
Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to perform cross-domain scripting and possibly execute arbitrary code by convincing a user to drag and drop javascript: links to a frame or page in another domain.
12	CVE-2004-1156			2004-12-31	2017-10-11	4.3	None	Remote	Medium	Not required	None	Partial	None
Mozilla before 1.7.6, and Firefox before 1.0.1, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability.
13	CVE-2004-1200		DoS	2004-12-31	2017-07-11	5.0	None	Remote	Low	Not required	None	None	Partial
Firefox and Mozilla allow remote attackers to cause a denial of service (application crash from memory consumption), as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.
14	CVE-2004-1380			2004-10-20	2017-10-11	5.0	None	Remote	Low	Not required	None	Partial	None
Firefox before 1.0 and Mozilla before 1.7.5 allows inactive (background) tabs to launch dialog boxes, which can allow remote attackers to spoof the dialog boxes from web sites in other windows and facilitate phishing attacks, aka the "Dialog Box Spoofing Vulnerability."
15	CVE-2004-1381			2004-10-20	2017-10-11	5.0	None	Remote	Low	Not required	Partial	None	None
Firefox before 1.0 and Mozilla before 1.7.5 allow inactive (background) tabs to focus on input being entered in the active tab, as originally reported using form fields, which allows remote attackers to steal sensitive data that is intended for other sites, which could facilitate phishing attacks.
16	CVE-2004-1639		DoS	2004-10-26	2017-07-11	5.0	None	Remote	Low	Not required	None	None	Partial
Mozilla Firefox before 0.10, Mozilla 5.0, and Gecko 20040913 allows remote attackers to cause a denial of service (application crash or memory consumption) via a large binary file with a .html extension.
17	CVE-2004-1753			2004-12-31	2017-07-11	2.6	None	Remote	High	Not required	None	Partial	None
The Apple Java plugin, as used in Netscape 7.1 and 7.2, Mozilla 1.7.2, and Firefox 0.9.3 on MacOS X 10.3.5, when tabbed browsing is enabled, does not properly handle SetWindow(NULL) calls, which allows Java applets from one tab to draw to other tabs and facilitates phishing attacks that spoof tabs.
18	CVE-2004-2225			2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	None	Partial	None
Mozilla Firefox before 0.10.1 allows remote attackers to delete arbitrary files in the download directory via a crafted data: URI that is not properly handled when the user clicks the Save button.
19	CVE-2004-2227			2004-12-31	2017-07-11	5.0	None	Remote	Low	Not required	None	Partial	None
Mozilla Firefox before 1.0 truncates long filenames in the file download dialog box, which makes it easier for remote attackers to trick users into downloading files with dangerous extensions.
20	CVE-2004-2228		+Priv	2004-12-31	2017-07-11	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Mozilla Firefox before 1.0 is installed with world-writable permissions on Mac OS X, which allows local users to gain privileges.
21	CVE-2004-2657			2004-12-31	2018-10-19	1.7	None	Local	Low	???	Partial	None	None
DISPUTED Mozilla Firefox 1.5.0.1, and possibly other versions, preserves some records of user activity even after uninstalling, which allows local users who share a Windows profile to view the records after a new installation of Firefox, as reported for the list of Passwords Never Saved web sites. NOTE: The vendor has disputed this issue, stating that "The uninstaller is primarily there to uninstall the application. It is not there to uninstall user data. For the moment I will stick by my module-owner decision."
22	CVE-2005-0141			2005-05-02	2017-10-11	2.6	None	Remote	High	Not required	Partial	None	None
Firefox before 1.0 and Mozilla before 1.7.5 allow remote attackers to load local files via links "with a custom getter and toString method" that are middle-clicked by the user to be opened in a new tab.
23	CVE-2005-0142			2005-05-02	2017-10-11	2.1	None	Local	Low	Not required	Partial	None	None
Firefox 0.9, Thunderbird 0.6 and other versions before 0.9, and Mozilla 1.7 before 1.7.5 save temporary files with world-readable permissions, which allows local users to read certain web content or attachments that belong to other users, e.g. content that is managed by helper applications such as PDF.
24	CVE-2005-0143			2005-03-23	2017-10-11	2.6	None	Remote	High	Not required	None	Partial	None
Firefox before 1.0 and Mozilla before 1.7.5 display the SSL lock icon when an insecure page loads a binary file from a trusted site, which could facilitate phishing attacks.
25	CVE-2005-0144			2005-05-02	2017-10-11	2.6	None	Remote	High	Not required	None	Partial	None
Firefox before 1.0 and Mozilla before 1.7.5 display the secure site lock icon when a view-source: URL references a secure SSL site while an insecure page is being loaded, which could facilitate phishing attacks.
26	CVE-2005-0145		Bypass	2005-01-24	2017-10-11	2.6	None	Remote	High	Not required	None	Partial	None
Firefox before 1.0 does not properly distinguish between user-generated and synthetic click events, which allows remote attackers to use Javascript to bypass the file download prompt when the user uses the Alt-click feature.
27	CVE-2005-0146			2005-05-02	2017-10-11	5.0	None	Remote	Low	Not required	Partial	None	None
Firefox before 1.0 and Mozilla before 1.7.5 allow remote attackers to obtain sensitive data from the clipboard via Javascript that generates a middle-click event on systems for which a middle-click performs a paste operation.
28	CVE-2005-0147			2005-05-02	2017-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Firefox before 1.0 and Mozilla before 1.7.5, when configured to use a proxy, respond to 407 proxy auth requests from arbitrary servers, which allows remote attackers to steal NTLM or SPNEGO credentials.
29	CVE-2005-0150		Exec Code	2005-05-26	2017-10-11	5.0	None	Remote	Low	Not required	None	Partial	None
Firefox before 1.0 allows the user to store a (1) javascript: or (2) data: URLs as a Livefeed bookmark, then executes it in the security context of the currently loaded page when the user later accesses the bookmark, which could allow remote attackers to execute arbitrary code.
30	CVE-2005-0230		Exec Code Bypass	2005-05-02	2017-10-11	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Firefox 1.0 does not prevent the user from dragging an executable file to the desktop when it has an image/gif content type but has a dangerous extension such as .bat or .exe, which allows remote attackers to bypass the intended restriction and execute arbitrary commands via malformed GIF files that can still be parsed by the Windows batch file parser, aka "firedragging."
31	CVE-2005-0231		Bypass	2005-02-07	2017-10-11	2.6	None	Remote	High	Not required	None	Partial	None
Firefox 1.0 does not invoke the Javascript Security Manager when a user drags a javascript: or data: URL to a tab, which allows remote attackers to bypass the security model, aka "firetabbing."
32	CVE-2005-0232			2005-05-02	2017-10-11	2.6	None	Remote	High	Not required	None	Partial	None
Firefox 1.0 allows remote attackers to modify Boolean configuration parameters for the about:config site by using a plugin such as Flash, and the -moz-opacity filter, to display the about:config site then cause the user to double-click at a certain screen position, aka "Fireflashing."
33	CVE-2005-0233			2005-02-08	2022-02-28	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The International Domain Name (IDN) support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
34	CVE-2005-0255		DoS Exec Code Mem. Corr.	2005-05-02	2017-10-11	5.0	None	Remote	Low	Not required	None	None	Partial
String handling functions in Mozilla 1.7.3, Firefox 1.0, and Thunderbird before 1.0.2, such as the nsTSubstring_CharT::Replace function, do not properly check the return values of other functions that resize the string, which allows remote attackers to cause a denial of service and possibly execute arbitrary code by forcing an out-of-memory state that causes a reallocation to fail and return a pointer to a fixed address, which leads to heap corruption.
35	CVE-2005-0399		Exec Code Overflow	2005-05-02	2018-05-03	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Heap-based buffer overflow in GIF2.cpp in Firefox before 1.0.2, Mozilla before to 1.7.6, and Thunderbird before 1.0.2, and possibly other applications that use the same library, allows remote attackers to execute arbitrary code via a GIF image with a crafted Netscape extension 2 block and buffer size.
36	CVE-2005-0401		Exec Code	2005-05-02	2018-05-03	5.1	None	Remote	High	Not required	Partial	Partial	Partial
FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka "Firescrolling 2."
37	CVE-2005-0402		Exec Code	2005-05-02	2017-10-11	2.6	None	Remote	High	Not required	None	Partial	None
Firefox before 1.0.2 allows remote attackers to execute arbitrary code by tricking a user into saving a page as a Firefox sidebar panel, then using the sidebar panel to inject Javascript into a privileged page.
38	CVE-2005-0527		Exec Code	2005-05-02	2017-10-11	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Firefox 1.0 allows remote attackers to execute arbitrary code via plugins that load "privileged content" into frames, as demonstrated using certain XUL events when a user drags a scrollbar two times, aka "Firescrolling."
39	CVE-2005-0578			2005-05-02	2017-10-11	2.1	None	Local	Low	Not required	None	None	Partial
Firefox before 1.0.1 and Mozilla Suite before 1.7.6 use a predictable filename for the plugin temporary directory, which allows local users to delete arbitrary files of other users via a symlink attack on the plugtmp directory.
40	CVE-2005-0584			2005-05-02	2017-10-11	2.6	None	Remote	High	Not required	None	Partial	None
Firefox before 1.0.1 and Mozilla before 1.7.6, when displaying the HTTP Authentication dialog, do not change the focus to the tab that generated the prompt, which could facilitate spoofing and phishing attacks.
41	CVE-2005-0585			2005-03-25	2017-10-11	2.6	None	Remote	High	Not required	None	Partial	None
Firefox before 1.0.1 and Mozilla before 1.7.6 truncates long sub-domains or paths for display, which may allow remote malicious web sites to spoof legitimate sites and facilitate phishing attacks.
42	CVE-2005-0586			2005-05-02	2017-10-11	2.6	None	Remote	High	Not required	None	Partial	None
Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to spoof the extensions of files to download via the Content-Disposition header, which could be used to trick users into downloading dangerous content.
43	CVE-2005-0587			2005-03-25	2017-10-11	2.6	None	Remote	High	Not required	None	Partial	None
Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which overwrites the file that was referenced in the first .LNK file.
44	CVE-2005-0588			2005-05-02	2017-10-11	5.0	None	Remote	Low	Not required	Partial	None	None
Firefox before 1.0.1 and Mozilla before 1.7.6 does not restrict xsl:include and xsl:import tags in XSLT stylesheets to the current domain, which allows remote attackers to determine the existence of files on the local system.
45	CVE-2005-0589			2005-05-02	2017-10-11	5.0	None	Remote	Low	Not required	Partial	None	None
The Form Fill feature in Firefox before 1.0.1 allows remote attackers to steal potentially sensitive information via an input control that monitors the values that are generated by the autocomplete capability.
46	CVE-2005-0590			2005-05-02	2017-10-11	5.0	None	Remote	Low	Not required	None	Partial	None
The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and Mozilla before 1.7.6 allows remote attackers to use InstallTrigger to spoof the hostname of the host performing the installation via a long "user:pass" sequence in the URL, which appears before the real hostname.
47	CVE-2005-0591			2005-05-02	2017-10-11	2.6	None	Remote	High	Not required	None	Partial	None
Firefox before 1.0.1 allows remote attackers to spoof the (1) security and (2) download modal dialog boxes, which could be used to trick users into executing script or downloading and executing a file, aka "Firespoofing."
48	CVE-2005-0592		DoS Exec Code Overflow	2005-03-25	2017-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Heap-based buffer overflow in the UTF8ToNewUnicode function for Firefox before 1.0.1 and Mozilla before 1.7.6 might allow remote attackers to cause a denial of service (crash) or execute arbitrary code via invalid sequences in a UTF8 encoded string that result in a zero length value.
49	CVE-2005-0593			2005-03-04	2017-10-11	2.6	None	Remote	High	Not required	None	Partial	None
Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote attackers to spoof the SSL "secure site" lock icon via (1) a web site that does not finish loading, which shows the lock of the previous site, (2) a non-HTTP server that uses SSL, which causes the lock to be displayed when the SSL handshake is completed, or (3) a URL that generates an HTTP 204 error, which updates the icon and location information but does not change the display of the original site.
50	CVE-2005-0752		Exec Code	2005-04-18	2017-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The Plugin Finder Service (PFS) in Firefox before 1.0.3 allows remote attackers to execute arbitrary code via a javascript: URL in the PLUGINSPAGE attribute of an EMBED tag.

Total number of vulnerabilities : 1482 Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30