CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Netscape : Security Vulnerabilities (CVSS score between 5 and 5.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2007-1377 1 DoS 2007-03-09 2008-11-15
5.0
 None Remote Low Not required None None Partial
AcroPDF.DLL in Adobe Reader 8.0, when accessed from Mozilla Firefox, Netscape, or Opera, allows remote attackers to cause a denial of service (unspecified resource consumption) via a .pdf URL with an anchor identifier that begins with search= followed by many %n sequences, a different vulnerability than CVE-2006-6027 and CVE-2006-6236.
2 CVE-2006-6077 2006-11-24 2010-09-15
5.0
 None Remote Low Not required Partial None None
The (1) Password Manager in Mozilla Firefox 2.0, and 1.5.0.8 and earlier; and the (2) Passcard Manager in Netscape 8.1.2 and possibly other versions, do not properly verify that an ACTION URL in a FORM element containing a password INPUT element matches the web site for which the user stored a password, which allows remote attackers to obtain passwords via a password INPUT element on a different web page located on the web site intended for this password.
3 CVE-2006-1942 2006-04-20 2011-03-07
5.1
 User Remote High Not required Partial Partial Partial
Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to open local files via a web page with an IMG element containing a SRC attribute with a non-image file:// URL, then tricking the user into selecting View Image for the broken image, as demonstrated using a .wma file to launch Windows Media Player, or by referencing an "alternate web page."
4 CVE-2005-4134 DoS Overflow 2005-12-09 2010-08-21
5.0
 None Remote Low Not required None None Partial
Mozilla Firefox 1.5, Netscape 8.0.4 and 7.2, and K-Meleon before 0.9.12 allows remote attackers to cause a denial of service (CPU consumption and delayed application startup) via a web site with a large title, which is recorded in history.dat but not processed efficiently during startup. NOTE: despite initial reports, the Mozilla vendor does not believe that this issue can be used to trigger a crash or buffer overflow in Firefox. Also, it has been independently reported that Netscape 8.1 does not have this issue.
5 CVE-2005-0989 2005-05-02 2011-07-11
5.0
 None Remote Low Not required Partial None None
The find_replen function in jsstr.c in the Javascript engine for Mozilla Suite 1.7.6, Firefox 1.0.1 and 1.0.2, and Netscape 7.2 allows remote attackers to read portions of heap memory in a Javascript string via the lambda replace method.
6 CVE-2004-0528 2004-08-06 2008-09-05
5.0
 None Remote Low Not required None Partial None
Netscape Navigator 7.1 allows remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that point to the legitimate site, combined with an image map whose href points to the malicious site, which facilitates a "phishing" attack.
7 CVE-2003-1560 200 +Info 2003-12-31 2009-01-29
5.0
 None Remote Low Not required Partial None None
Netscape 4 sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.
8 CVE-2003-1492 59 2003-12-31 2008-09-05
5.0
 None Remote Low Not required None Partial None
Netscape Navigator 7.0.2 and Mozilla allows remote attackers to access cookie information in a different domain via an HTTP request for a domain with an extra . (dot) at the end.
9 CVE-2002-2338 20 DoS 2002-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
The POP3 mail client in Mozilla 1.0 and earlier, and Netscape Communicator 4.7 and earlier, allows remote attackers to cause a denial of service (no new mail) via a mail message containing a dot (.) at a newline, which is interpreted as the end of the message.
10 CVE-2002-2308 DoS 2002-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
Netscape Communicator 6.2.1 allows remote attackers to cause a denial of service in client browsers via a webpage containing a recursive META refresh tag where the content tag is blank and the URL tag references itself.
11 CVE-2002-2013 2002-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Mozilla 0.9.6 and earlier and Netscape 6.2 and earlier allows remote attackers to steal cookies from another domain via a link with a hex-encoded null character (%00) followed by the target domain.
12 CVE-2002-1655 DoS 2002-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
The Web Publishing feature in Netscape Enterprise Server 3.x and iPlanet Web Server 4.x allows remote attackers to cause a denial of service (crash) via a wp-html-rend request.
13 CVE-2002-1204 2002-11-29 2008-09-10
5.0
 None Remote Low Not required Partial None None
Netscape Communicator 4.x allows attackers to use a link to steal a user's preferences, including potentially sensitive information such as URL history, e-mail address, and possibly the e-mail password, by redefining the user_pref() function and accessing the prefs.js file, which is stored in a directory with a predictable name.
14 CVE-2002-1042 Dir. Trav. 2002-10-04 2008-09-05
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in search engine for iPlanet web server 6.0 SP2 and 4.1 SP9, and Netscape Enterprise Server 3.6, when running on Windows platforms, allows remote attackers to read arbitrary files via ..\ (dot-dot backslash) sequences in the NS-query-pat parameter.
15 CVE-2002-0594 2002-06-18 2008-09-05
5.0
 None Remote Low Not required Partial None None
Netscape 6 and Mozilla 1.0 RC1 and earlier allows remote attackers to determine the existence of files on the client system via a LINK element in a Cascading Style Sheet (CSS) page that causes an HTTP redirect.
16 CVE-2002-0354 2002-06-25 2008-09-05
5.0
 None Remote Low Not required None Partial None
The XMLHttpRequest object (XMLHTTP) in Netscape 6.1 and Mozilla 0.9.7 allows remote attackers to read arbitrary files and list directories on a client system by opening a URL that redirects the browser to the file on the client, then reading the result using the responseText property.
17 CVE-2001-0745 +Info 2001-10-18 2008-09-05
5.0
 None Remote Low Not required Partial None None
Netscape 4.7x allows remote attackers to obtain sensitive information such as the user's login, mailbox location and installation path via Javascript that accesses the mailbox: URL in the document.referrer property.
18 CVE-2001-0684 DoS 2001-09-20 2008-09-05
5.0
 None Remote Low Not required None None Partial
Netscape Collabra Server 3.5.4 and earlier allows a remote attacker to cause a denial of service by sending seven or more characters to TCP port 5239.
19 CVE-2001-0683 DoS 2001-09-20 2008-09-05
5.0
 None Remote Low Not required None None Partial
Memory leak in Netscape Collabra Server 3.5.4 and earlier allows a remote attacker to cause a denial of service (memory exhaustion) by repeatedly sending approximately 5K of data to TCP port 5238.
20 CVE-2001-0251 DoS 2001-06-02 2008-09-05
5.0
 None Remote Low Not required None None Partial
The Web Publishing feature in Netscape Enterprise Server 3.x allows remote attackers to cause a denial of service via the REVLOG command.
21 CVE-2001-0250 2001-06-02 2008-09-05
5.0
 None Remote Low Not required Partial None None
The Web Publishing feature in Netscape Enterprise Server 4.x and earlier allows remote attackers to list arbitrary directories under the web server root via the INDEX command.
22 CVE-2001-0175 DoS 2001-03-26 2008-09-05
5.0
 None Remote Low Not required None None Partial
The caching module in Netscape Fasttrack Server 4.1 allows remote attackers to cause a denial of service (resource exhaustion) by requesting a large number of non-existent URLs.
23 CVE-2000-1196 1 2001-08-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
PSCOErrPage.htm in Netscape PublishingXpert 2.5 before SP2 allows remote attackers to read arbitrary files by specifying the target file in the errPagePath parameter.
24 CVE-2000-1075 Dir. Trav. 2000-12-11 2008-09-05
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in iPlanet Certificate Management System 4.2 and Directory Server 4.12 allows remote attackers to read arbitrary files via a .. (dot dot) attack in the Agent, End Entity, or Administrator services.
25 CVE-2000-0960 2000-12-19 2008-09-05
5.0
 None Remote Low Not required Partial None None
The POP3 server in Netscape Messaging Server 4.15p1 generates different error messages for incorrect user names versus incorrect passwords, which allows remote attackers to determine valid users on the system and harvest email addresses for spam abuse.
26 CVE-2000-0676 2000-10-20 2008-09-10
5.0
 None Remote Low Not required Partial None None
Netscape Communicator and Navigator 4.04 through 4.74 allows remote attackers to read arbitrary files by using a Java applet to open a connection to a URL using the "file", "http", "https", and "ftp" protocols, as demonstrated by Brown Orifice.
27 CVE-2000-0655 DoS Exec Code 2000-07-25 2008-09-10
5.0
 None Remote Low Not required None None Partial
Netscape Communicator 4.73 and earlier allows remote attackers to cause a denial of service or execute arbitrary commands via a JPEG image containing a comment with an illegal field length of 1.
28 CVE-2000-0517 2000-05-26 2008-09-05
5.0
 None Remote Low Not required Partial None None
Netscape 4.73 and earlier does not properly warn users about a potentially invalid certificate if the user has previously accepted the certificate for a different web site, which could allow remote attackers to spoof a legitimate web site by compromising that site's DNS information.
29 CVE-2000-0236 2000-03-17 2008-09-10
5.0
 None Remote Low Not required Partial None None
Netscape Enterprise Server with Directory Indexing enabled allows remote attackers to list server directories via web publishing tags such as ?wp-ver-info and ?wp-cs-dump.
30 CVE-2000-0087 2000-01-12 2008-09-10
5.0
 None Remote Low Not required Partial None None
Netscape Mail Notification (nsnotify) utility in Netscape Communicator uses IMAP without SSL, even if the user has set a preference for Communicator to use an SSL connection, allowing a remote attacker to sniff usernames and passwords in plaintext.
31 CVE-2000-0034 1999-12-22 2008-09-10
5.0
 None Remote Low Not required Partial None None
Netscape 4.7 records user passwords in the preferences.js file during an IMAP or POP session, even if the user has not enabled "remember passwords."
32 CVE-1999-1532 DoS 1999-10-29 2008-09-05
5.0
 None Remote Low Not required None None Partial
Netscape Messaging Server 3.54, 3.55, and 3.6 allows a remote attacker to cause a denial of service (memory exhaustion) via a series of long RCPT TO commands.
33 CVE-1999-1262 1997-08-01 2008-09-10
5.1
 User Remote High Not required Partial Partial Partial
Java in Netscape 4.5 does not properly restrict applets from connecting to other hosts besides the one from which the applet was loaded, which violates the Java security model and could allow remote attackers to conduct unauthorized activities.
34 CVE-1999-1130 1999-07-30 2008-09-05
5.0
 None Remote Low Not required Partial None None
Default configuration of the search engine in Netscape Enterprise Server 3.5.1, and possibly other versions, allows remote attackers to read the source of JHTML files by specifying a search command using the HTML-tocrec-demo1.pat pattern file.
35 CVE-1999-1005 1999-12-19 2008-09-09
5.0
 None Remote Low Not required Partial None None
Groupwise web server GWWEB.EXE allows remote attackers to read arbitrary files with .htm extensions via a .. (dot dot) attack using the HELP parameter.
36 CVE-1999-1002 2000-01-12 2008-09-09
5.0
 None Remote Low Not required Partial None None
Netscape Navigator uses weak encryption for storing a user's Netscape mail password.
37 CVE-1999-0809 1999-07-09 2008-09-09
5.0
 None Remote Low Not required Partial None None
Netscape Communicator 4.x with Javascript enabled does not warn a user of cookie settings, even if they have selected the option to "Only accept cookies originating from the same server as the page being viewed".
38 CVE-1999-0758 2001-03-12 2008-09-09
5.0
 None Remote Low Not required Partial None None
Netscape Enterprise 3.5.1 and FastTrack 3.01 servers allow a remote attacker to view source code to scripts by appending a %20 to the script's URL.
39 CVE-1999-0752 DoS Overflow 1999-07-06 2008-09-09
5.0
 None Remote Low Not required None None Partial
Denial of service in Netscape Enterprise Server via a buffer overflow in the SSL handshake.
40 CVE-1999-0751 Overflow 1999-09-13 2008-09-09
5.0
 None Remote Low Not required None None Partial
Buffer overflow in Accept command in Netscape Enterprise Server 3.6 with the SSL Handshake Patch.
41 CVE-1999-0686 DoS 1999-05-07 2008-09-09
5.0
 None Remote Low Not required None None Partial
Denial of service in Netscape Enterprise Server (NES) in HP Virtual Vault (VVOS) via a long URL.
42 CVE-1999-0685 Overflow 1999-09-02 2008-09-09
5.1
 User Remote High Not required Partial Partial Partial
Buffer overflow in Netscape Communicator via EMBED tags in the pluginspage option.
43 CVE-1999-0479 DoS 1999-03-01 2008-09-09
5.0
 None Remote Low Not required None None Partial
Denial of service Netscape Enterprise Server with VirtualVault on HP-UX VVOS systems.
44 CVE-1999-0269 1998-08-01 2008-09-09
5.0
 None Remote Low Not required Partial None None
Netscape Enterprise servers may list files through the PageServices query.
45 CVE-1999-0239 1998-01-01 2008-09-09
5.0
 None Remote Low Not required Partial None None
Netscape FastTrack Web server lists files when a lowercase "get" command is used instead of an uppercase GET.
46 CVE-1999-0012 Bypass 1998-02-06 2008-09-09
5.0
 None Remote Low Not required Partial None None
Some web servers under Microsoft Windows allow remote attackers to bypass access restrictions for files with long file names.
47 CVE-1999-0007 1998-06-26 2008-09-09
5.0
 None Remote Low Not required Partial None None
Information from SSL-encrypted sessions via PKCS #1.
Total number of vulnerabilities : 47   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.