Mozilla Firefox vulnerabilities

CVE-2020-12394 [LOW] CVE-2020-12394: A logic flaw in our location bar implementation could have allowed a local attacker to spoof the cur A logic flaw in our location bar implementation could have allowed a local attacker to spoof the current location by selecting a different origin and removing focus from the input element. This vulnerability affects Firefox < 76.

CVE-2005-1576 [LOW] CVE-2005-1576: The file download dialog in Mozilla Firefox 0.10.1 and 1.0 for Windows uses the Content-Type HTTP he The file download dialog in Mozilla Firefox 0.10.1 and 1.0 for Windows uses the Content-Type HTTP header to determine the file type, but saves the original file extension when "Save to Disk" is selected, which allows remote attackers to hide the real file types of downloaded files.

CVE-2005-0584 [LOW] CVE-2005-0584: Firefox before 1.0.1 and Mozilla before 1.7.6, when displaying the HTTP Authentication dialog, do no Firefox before 1.0.1 and Mozilla before 1.7.6, when displaying the HTTP Authentication dialog, do not change the focus to the tab that generated the prompt, which could facilitate spoofing and phishing attacks.

CVE-2024-2616 [LOW] CWE-787 CVE-2024-2616: To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash i To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead of attempt to continue. This vulnerability affects Firefox ESR < 115.9 and Thunderbird < 115.9.

CVE-2007-5414 [LOW] CWE-79 CVE-2007-5414: Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0, when UTF-7 document content Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0, when UTF-7 document content is rendered directly in UTF-7, allows remote attackers to inject arbitrary web script or HTML via a gopher URI that uses single quote characters to delimit a literal string within an XSS sequence, a related issue to CVE-2007-5415.

CVE-2020-6824 [LOW] CWE-384 CVE-2020-6824: Initially, a user opens a Private Browsing Window and generates a password for a site, then closes t Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open. Subsequently, if the user had opened a new Private Browsing Window, revisited the same site, and generated a new password - the generated passwords would have been identical, rather than independent. This

CVE-2017-5387 [LOW] CWE-538 CVE-2017-5387: The existence of a specifically requested local file can be found due to the double firing of the "o The existence of a specifically requested local file can be found due to the double firing of the "onerror" when the "source" attribute on a "" tag refers to a file that does not exist if the source page is loaded locally. This vulnerability affects Firefox < 51.

CVE-2005-0585 [LOW] CVE-2005-0585: Firefox before 1.0.1 and Mozilla before 1.7.6 truncates long sub-domains or paths for display, which Firefox before 1.0.1 and Mozilla before 1.7.6 truncates long sub-domains or paths for display, which may allow remote malicious web sites to spoof legitimate sites and facilitate phishing attacks.

CVE-2005-3089 [LOW] CVE-2005-3089: Firefox 1.0.6 allows attackers to cause a denial of service (crash) via a Proxy Auto-Config (PAC) sc Firefox 1.0.6 allows attackers to cause a denial of service (crash) via a Proxy Auto-Config (PAC) script that uses an eval statement. NOTE: it is not clear whether an untrusted party has any role in triggering this issue, so it might not be a vulnerability.

CVE-2005-0586 [LOW] CVE-2005-0586: Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to spoof the extensi Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to spoof the extensions of files to download via the Content-Disposition header, which could be used to trick users into downloading dangerous content.

CVE-2009-0358 [LOW] CWE-200 CVE-2009-0358: Mozilla Firefox 3.x before 3.0.6 does not properly implement the (1) no-store and (2) no-cache Cache Mozilla Firefox 3.x before 3.0.6 does not properly implement the (1) no-store and (2) no-cache Cache-Control directives, which allows local users to obtain sensitive information by using the (a) back button or (b) history list of the victim's browser, as demonstrated by reading the response page of an https POST request.

CVE-2006-2332 [LOW] CVE-2006-2332: Mozilla Firefox 1.5.0.3 allows remote attackers to cause a denial of service via a web page with a l Mozilla Firefox 1.5.0.3 allows remote attackers to cause a denial of service via a web page with a large number of IMG elements in which the SRC attribute is a mailto URI. NOTE: another researcher found that the web page caused a temporary browser slowdown instead of a crash.

CVE-2015-2714 [LOW] CWE-264 CVE-2015-2714: Mozilla Firefox before 38.0 on Android does not properly restrict writing URL data to the Android lo Mozilla Firefox before 38.0 on Android does not properly restrict writing URL data to the Android logging system, which allows attackers to obtain sensitive information via a crafted application that has a required permission for reading a log, as demonstrated by the READ_LOGS permission for the mixed-content violation log on Android 4.0 and earlier.

CVE-2014-1515 [LOW] CWE-200 CVE-2014-1515: Mozilla Firefox before 28.0.1 on Android processes a file: URL by copying a local file onto the SD c Mozilla Firefox before 28.0.1 on Android processes a file: URL by copying a local file onto the SD card, which allows attackers to obtain sensitive information from the Firefox profile directory via a crafted application.

CVE-2006-2538 [LOW] CVE-2006-2538: IE Tab 1.0.9 plugin for Mozilla Firefox 1.5.0.3 allows remote user-assisted attackers to cause a den IE Tab 1.0.9 plugin for Mozilla Firefox 1.5.0.3 allows remote user-assisted attackers to cause a denial of service (application crash), possibly due to a null dereference, via certain Javascript, as demonstrated using a url parameter to the content/reloaded.html page in a chrome:// URI. Some third-party researchers claim that they are unable to reproduce this vu

CVE-2012-1945 [LOW] CWE-200 CVE-2012-1945: Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thun Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allow local users to obtain sensitive information via an HTML document that loads a shortcut (aka .lnk) file for display within an IFRAME element, as demonstrated by a network share implemented by (

CVE-2005-0144 [LOW] CVE-2005-0144: Firefox before 1.0 and Mozilla before 1.7.5 display the secure site lock icon when a view-source: UR Firefox before 1.0 and Mozilla before 1.7.5 display the secure site lock icon when a view-source: URL references a secure SSL site while an insecure page is being loaded, which could facilitate phishing attacks.

CVE-2006-3731 [LOW] CVE-2006-3731: Mozilla Firefox 1.5.0.4 and earlier allows remote user-assisted attackers to cause a denial of servi Mozilla Firefox 1.5.0.4 and earlier allows remote user-assisted attackers to cause a denial of service (crash) via a form with a multipart/form-data encoding and a user-uploaded file. NOTE: a third party has claimed that this issue might be related to the LiveHTTPHeaders extension.

CVE-2014-1595 [LOW] CWE-199 CVE-2014-1595: Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, and Thunderbird before 31.3 on Apple OS X Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, and Thunderbird before 31.3 on Apple OS X 10.10 omit a CoreGraphics disable-logging action that is needed by jemalloc-based applications, which allows local users to obtain sensitive information by reading /tmp files, as demonstrated by credential information.

CVE-2012-0450 [LOW] CWE-264 CVE-2012-0450: Mozilla Firefox 4.x through 9.0 and SeaMonkey before 2.7 on Linux and Mac OS X set weak permissions Mozilla Firefox 4.x through 9.0 and SeaMonkey before 2.7 on Linux and Mac OS X set weak permissions for Firefox Recovery Key.html, which might allow local users to read a Firefox Sync key via standard filesystem operations.