Netscape
120 CVEs across 21 Netscape products. Browse Netscape vulnerabilities, severities, and proof-of-concept exploits.
Netscape products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-18940 | Medium | 6.1 | 2019-01-31 | servlet/SnoopServlet (a servlet installed by default) in Netscape Enterprise 3.63 has reflected XSS via an arbitrary parameter=[XSS] in the query string. A rem… |
CVE-2009-2542 | | 2009-07-20 | Netscape 6 and 8 allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object… | |
CVE-2008-2809 | | 2008-07-08 | Mozilla 1.9 M8 and earlier, Mozilla Firefox 2 before 2.0.0.15, SeaMonkey 1.1.5 and other versions before 1.1.10, Netscape 9.0, and other Mozilla-based web brow… | |
CVE-2008-1676 | | 2008-07-07 | Red Hat PKI Common Framework (rhpki-common) in Red Hat Certificate System (aka Certificate Server or RHCS) 7.1 through 7.3, and Netscape Certificate Management… | |
CVE-2007-4042 | | 2007-07-27 | Multiple argument injection vulnerabilities in Netscape Navigator 9 allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metach… | |
CVE-2007-3924 | | 2007-07-21 | Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Netscape installed and certain URIs registered, allows remote att… | |
CVE-2007-1377 | | 2007-03-10 | AcroPDF.DLL in Adobe Reader 8.0, when accessed from Mozilla Firefox, Netscape, or Opera, allows remote attackers to cause a denial of service (unspecified reso… | |
CVE-2006-6077 | | 2006-11-24 | The (1) Password Manager in Mozilla Firefox 2.0, and 1.5.0.8 and earlier; and the (2) Passcard Manager in Netscape 8.1.2 and possibly other versions, do not pr… | |
CVE-2006-4842 | | 2006-10-12 | The Netscape Portable Runtime (NSPR) API 4.6.1 and 4.6.2, as used in Sun Solaris 10, trusts user-specified environment variables for specifying log files even… | |
CVE-2006-4253 | | 2006-08-21 | Concurrency vulnerability in Mozilla Firefox 1.5.0.6 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary co… | |
CVE-2006-2894 | | 2006-06-07 | Mozilla Firefox 1.5.0.4, 2.0.x before 2.0.0.8, Mozilla Suite 1.7.13, Mozilla SeaMonkey 1.0.2 and other versions before 1.1.5, and Netscape 8.1 and earlier allo… | |
CVE-2006-2613 | | 2006-05-26 | Mozilla Suite 1.7.13, Mozilla Firefox 1.5.0.3 and possibly other versions before before 1.8.0, and Netscape 7.2 and 8.1, and possibly other versions and produc… | |
CVE-2006-1942 | | 2006-04-20 | Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to… | |
CVE-2005-4134 | | 2005-12-09 | Mozilla Firefox 1.5, Netscape 8.0.4 and 7.2, and K-Meleon before 0.9.12 allows remote attackers to cause a denial of service (CPU consumption and delayed appli… | |
CVE-2005-1157 | | 2005-05-02 | Firefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to replace existing search plugins with malicious ones using sidebar… | |
CVE-2005-1156 | | 2005-05-02 | Firefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to execute arbitrary script and code via a new search plugin using s… | |
CVE-2005-0989 | | 2005-05-02 | The find_replen function in jsstr.c in the Javascript engine for Mozilla Suite 1.7.6, Firefox 1.0.1 and 1.0.2, and Netscape 7.2 allows remote attackers to read… | |
CVE-2004-1160 | | 2005-01-10 | Netscape 7.x to 7.2, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target windo… | |
CVE-2004-1753 | | 2004-12-31 | The Apple Java plugin, as used in Netscape 7.1 and 7.2, Mozilla 1.7.2, and Firefox 0.9.3 on MacOS X 10.3.5, when tabbed browsing is enabled, does not properly… | |
CVE-2004-1236 | | 2004-12-31 | Buffer overflow in the LDAP component for Netscape Directory Server (NDS) 3.6 on HP-UX and other operating systems allows remote attackers to execute arbitrary… | |
CVE-2004-0904 | | 2004-12-31 | Integer overflow in the bitmap (BMP) decoder for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote atta… | |
CVE-2004-0826 | | 2004-12-31 | Heap-based buffer overflow in Netscape Network Security Services (NSS) library allows remote attackers to execute arbitrary code via a modified record length f… | |
CVE-2004-0905 | | 2004-09-14 | Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to perform cross-domain scripting and poss… | |
CVE-2004-0722 | | 2004-08-18 | Integer overflow in the SOAPParameter object constructor in (1) Netscape version 7.0 and 7.1 and (2) Mozilla 1.6, and possibly earlier versions, allows remote… | |
CVE-2004-0528 | | 2004-08-06 | Netscape Navigator 7.1 allows remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that point to the legitim… | |
CVE-2004-0718 | | 2004-07-27 | The (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content… | |
CVE-2003-1560 | | 2003-12-31 | Netscape 4 sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive informati… | |
CVE-2003-1492 | | 2003-12-31 | Netscape Navigator 7.0.2 and Mozilla allows remote attackers to access cookie information in a different domain via an HTTP request for a domain with an extra… | |
CVE-2003-1419 | | 2003-12-31 | Netscape 7.0 allows remote attackers to cause a denial of service (crash) via a web page with an invalid regular expression argument to the JavaScript reformat… | |
CVE-2003-1265 | | 2003-12-31 | Netscape 7.0 and Mozilla 5.0 do not immediately delete messages in the trash folder when users select the 'Empty Trash' option, which could allow local users t… | |
CVE-2003-0553 | | 2003-08-18 | Buffer overflow in the Client Detection Tool (CDT) plugin (npcdt.dll) for Netscape 7.02 allows remote attackers to execute arbitrary code via an attachment wit… | |
CVE-2002-2338 | | 2002-12-31 | The POP3 mail client in Mozilla 1.0 and earlier, and Netscape Communicator 4.7 and earlier, allows remote attackers to cause a denial of service (no new mail)… | |
CVE-2002-2308 | | 2002-12-31 | Netscape Communicator 6.2.1 allows remote attackers to cause a denial of service in client browsers via a webpage containing a recursive META refresh tag where… | |
CVE-2002-2284 | | 2002-12-31 | Netscape Communicator 4.0 through 4.79 allows remote attackers to bypass JVM security and execute arbitrary Java code via an applet that loads user-supplied Ja… | |
CVE-2002-2248 | | 2002-12-31 | Buffer overflow in the sun.awt.windows.WDefaultFontCharset Java class implementation in Netscape 4.0 allows remote attackers to execute arbitrary code via an a… | |
CVE-2002-2061 | | 2002-12-31 | Heap-based buffer overflow in Netscape 6.2.3 and Mozilla 1.0 and earlier allows remote attackers to crash client browsers and execute arbitrary code via a PNG… | |
CVE-2002-2013 | | 2002-12-31 | Mozilla 0.9.6 and earlier and Netscape 6.2 and earlier allows remote attackers to steal cookies from another domain via a link with a hex-encoded null characte… | |
CVE-2002-1766 | | 2002-12-31 | Buffer overflow in Composer in Netscape 4.77 allows local users to overwrite process memory and execute arbitrary code via a font tag with a long face attribut… | |
CVE-2002-1655 | | 2002-12-31 | The Web Publishing feature in Netscape Enterprise Server 3.x and iPlanet Web Server 4.x allows remote attackers to cause a denial of service (crash) via a wp-h… | |
CVE-2002-1654 | | 2002-12-31 | iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4.0 and 4.1 allows remote attackers to conduct HTTP Basic Authentication via the wp-force-… | |
CVE-2002-1308 | | 2002-11-29 | Heap-based buffer overflow in Netscape and Mozilla allows remote attackers to execute arbitrary code via a jar: URL that references a malformed .jar file, whic… | |
CVE-2002-1204 | | 2002-11-29 | Netscape Communicator 4.x allows attackers to use a link to steal a user's preferences, including potentially sensitive information such as URL history, e-mail… | |
CVE-2002-1091 | | 2002-10-04 | Netscape 6.2.3 and earlier, and Mozilla 1.0.1, allow remote attackers to corrupt heap memory and execute arbitrary code via a GIF image with a zero width. | |
CVE-2002-1042 | | 2002-10-04 | Directory traversal vulnerability in search engine for iPlanet web server 6.0 SP2 and 4.1 SP9, and Netscape Enterprise Server 3.6, when running on Windows plat… | |
CVE-2002-0815 | | 2002-08-12 | The Javascript "Same Origin Policy" (SOP), as implemented in (1) Netscape, (2) Mozilla, and (3) Internet Explorer, allows a remote web server to access HTTP an… | |
CVE-2002-0354 | | 2002-06-25 | The XMLHttpRequest object (XMLHTTP) in Netscape 6.1 and Mozilla 0.9.7 allows remote attackers to read arbitrary files and list directories on a client system b… | |
CVE-2002-0594 | | 2002-06-18 | Netscape 6 and Mozilla 1.0 RC1 and earlier allows remote attackers to determine the existence of files on the client system via a LINK element in a Cascading S… | |
CVE-2002-0593 | | 2002-06-18 | Buffer overflow in Netscape 6 and Mozilla 1.0 RC1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code… | |
CVE-2001-0921 | | 2001-11-21 | Netscape 4.79 and earlier for MacOS allows an attacker with access to the browser to obtain passwords from form fields by printing the document into which the… | |
CVE-2001-0745 | | 2001-10-18 | Netscape 4.7x allows remote attackers to obtain sensitive information such as the user's login, mailbox location and installation path via Javascript that acce… | |
CVE-2001-0684 | | 2001-09-20 | Netscape Collabra Server 3.5.4 and earlier allows a remote attacker to cause a denial of service by sending seven or more characters to TCP port 5239. | |
CVE-2001-0683 | | 2001-09-20 | Memory leak in Netscape Collabra Server 3.5.4 and earlier allows a remote attacker to cause a denial of service (memory exhaustion) by repeatedly sending appro… | |
CVE-2000-1196 | | 2001-08-31 | PSCOErrPage.htm in Netscape PublishingXpert 2.5 before SP2 allows remote attackers to read arbitrary files by specifying the target file in the errPagePath par… | |
CVE-2001-0596 | | 2001-08-02 | Netscape Communicator before 4.77 allows remote attackers to execute arbitrary Javascript via a GIF image whose comment contains the Javascript. | |
CVE-2001-0262 | | 2001-07-02 | Buffer overflow in Netscape SmartDownload 1.3 allows remote attackers (malicious web pages) to execute arbitrary commands via a long URL. | |
CVE-2001-0251 | | 2001-06-02 | The Web Publishing feature in Netscape Enterprise Server 3.x allows remote attackers to cause a denial of service via the REVLOG command. | |
CVE-2001-0250 | | 2001-06-02 | The Web Publishing feature in Netscape Enterprise Server 4.x and earlier allows remote attackers to list arbitrary directories under the web server root via th… | |
CVE-2001-0164 | | 2001-06-02 | Buffer overflow in Netscape Directory Server 4.12 and earlier allows remote attackers to cause a denial of service or execute arbitrary commands via a malforme… | |
CVE-2001-0175 | | 2001-03-26 | The caching module in Netscape Fasttrack Server 4.1 allows remote attackers to cause a denial of service (resource exhaustion) by requesting a large number of… | |
CVE-2000-0308 | | 2001-03-12 | Insecure file permissions for Netscape FastTrack Server 2.x, Enterprise Server 2.0, and Proxy Server 2.5 in SCO UnixWare 7.0.x and 2.1.3 allow an attacker to g… | |
CVE-1999-0758 | | 2001-03-12 | Netscape Enterprise 3.5.1 and FastTrack 3.01 servers allow a remote attacker to view source code to scripts by appending a %20 to the script's URL. | |
CVE-2000-1187 | | 2001-01-09 | Buffer overflow in the HTML parser for Netscape 4.75 and earlier allows remote attackers to execute arbitrary commands via a long password value in a form fiel… | |
CVE-2000-0961 | | 2000-12-19 | Buffer overflow in IMAP server in Netscape Messaging Server 4.15 Patch 2 allows local users to execute arbitrary commands via a long LIST command. | |
CVE-2000-0960 | | 2000-12-19 | The POP3 server in Netscape Messaging Server 4.15p1 generates different error messages for incorrect user names versus incorrect passwords, which allows remote… | |
CVE-2000-1076 | | 2000-12-11 | Netscape (iPlanet) Certificate Management System 4.2 and Directory Server 4.12 stores the administrative password in plaintext, which could allow local and pos… | |
CVE-2000-1075 | | 2000-12-11 | Directory traversal vulnerability in iPlanet Certificate Management System 4.2 and Directory Server 4.12 allows remote attackers to read arbitrary files via a… | |
CVE-2000-1074 | | 2000-12-11 | csstart program in iCal 2.1 Patch 2 uses relative pathnames to install the libsocket and libnsl libraries, which could allow the icsuser account to gain root p… | |
CVE-2000-1073 | | 2000-12-11 | csstart program in iCal 2.1 Patch 2 searches for the cshttpd program in the current working directory, which allows local users to gain root privileges by crea… | |
CVE-2000-1072 | | 2000-12-11 | iCal 2.1 Patch 2 installs many files with world-writeable permissions, which allows local users to modify the iCal configuration and execute arbitrary commands… | |
CVE-2000-1071 | | 2000-12-11 | The GUI installation for iCal 2.1 Patch 2 disables access control for the X server using an "xhost +" command, which allows remote attackers to monitor X Windo… | |
CVE-2000-0711 | | 2000-10-20 | Netscape Communicator does not properly prevent a ServerSocket object from being created by untrusted entities, which allows remote attackers to create a serve… | |
CVE-2000-0676 | | 2000-10-20 | Netscape Communicator and Navigator 4.04 through 4.74 allows remote attackers to read arbitrary files by using a Java applet to open a connection to a URL usin… | |
CVE-2000-0655 | | 2000-07-25 | Netscape Communicator 4.73 and earlier allows remote attackers to cause a denial of service or execute arbitrary commands via a JPEG image containing a comment… | |
CVE-2000-0600 | | 2000-06-26 | Netscape Enterprise Server in NetWare 5.1 allows remote attackers to cause a denial of service or execute arbitrary commands via a malformed URL. | |
CVE-2000-0577 | | 2000-06-21 | Netscape Professional Services FTP Server 1.3.6 allows remote attackers to read arbitrary files via a .. (dot dot) attack. | |
CVE-2000-0517 | | 2000-05-26 | Netscape 4.73 and earlier does not properly warn users about a potentially invalid certificate if the user has previously accepted the certificate for a differ… | |
CVE-2000-0409 | | 2000-05-10 | Netscape 4.73 and earlier follows symlinks when it imports a new certificate, which allows local users to overwrite files of the user importing the certificate. | |
CVE-2000-0406 | | 2000-05-10 | Netscape Communicator before version 4.73 and Navigator 4.07 do not properly validate SSL certificates, which allows remote attackers to steal information by r… | |
CVE-1999-0790 | | 2000-04-01 | A remote attacker can read information from a Netscape user's cache via JavaScript. | |
CVE-2000-0236 | | 2000-03-17 | Netscape Enterprise Server with Directory Indexing enabled allows remote attackers to list server directories via web publishing tags such as ?wp-ver-info and… | |
CVE-2000-0237 | | 2000-03-11 | Netscape Enterprise Server with Web Publishing enabled allows remote attackers to list arbitrary directories via a GET request for the /publisher directory, wh… | |
CVE-2000-0087 | | 2000-01-12 | Netscape Mail Notification (nsnotify) utility in Netscape Communicator uses IMAP without SSL, even if the user has set a preference for Communicator to use an… | |
CVE-1999-1002 | | 2000-01-12 | Netscape Navigator uses weak encryption for storing a user's Netscape mail password. | |
CVE-1999-0744 | | 2000-01-04 | Buffer overflow in Netscape Enterprise Server and FastTrask Server allows remote attackers to gain privileges via a long HTTP GET request. | |
CVE-1999-0892 | | 1999-12-24 | Buffer overflow in Netscape Communicator before 4.7 via a dynamic font whose length field is less than the size of the font. | |
CVE-2000-0034 | | 1999-12-22 | Netscape 4.7 records user passwords in the preferences.js file during an IMAP or POP session, even if the user has not enabled "remember passwords." | |
CVE-1999-1005 | | 1999-12-19 | Groupwise web server GWWEB.EXE allows remote attackers to read arbitrary files with .htm extensions via a .. (dot dot) attack using the HELP parameter. | |
CVE-1999-0853 | | 1999-12-01 | Buffer overflow in Netscape Enterprise Server and Netscape FastTrack Server allows remote attackers to gain privileges via the HTTP Basic Authentication proced… | |
CVE-1999-1189 | | 1999-11-24 | Buffer overflow in Netscape Navigator/Communicator 4.7 for Windows 95 and Windows 98 allows remote attackers to cause a denial of service, and possibly execute… | |
CVE-1999-0827 | | 1999-11-01 | By default, Internet Explorer 5.0 and other versions enables the "Navigate sub-frames across different domains" option, which allows frame spoofing. | |
CVE-1999-1532 | | 1999-10-29 | Netscape Messaging Server 3.54, 3.55, and 3.6 allows a remote attacker to cause a denial of service (memory exhaustion) via a series of long RCPT TO commands. | |
CVE-1999-1226 | | 1999-10-28 | Netscape Communicator 4.7 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long certificate key. | |
CVE-1999-1357 | | 1999-10-05 | Netscape Communicator 4.04 through 4.7 (and possibly other versions) in various UNIX operating systems converts the 0x8b character to a "<" sign, and the 0x9b… | |
CVE-1999-0751 | | 1999-09-13 | Buffer overflow in Accept command in Netscape Enterprise Server 3.6 with the SSL Handshake Patch. | |
CVE-1999-0685 | | 1999-09-02 | Buffer overflow in Netscape Communicator via EMBED tags in the pluginspage option. | |
CVE-1999-1130 | | 1999-07-30 | Default configuration of the search engine in Netscape Enterprise Server 3.5.1, and possibly other versions, allows remote attackers to read the source of JHTM… | |
CVE-1999-0809 | | 1999-07-09 | Netscape Communicator 4.x with Javascript enabled does not warn a user of cookie settings, even if they have selected the option to "Only accept cookies origin… | |
CVE-1999-0752 | | 1999-07-06 | Denial of service in Netscape Enterprise Server via a buffer overflow in the SSL handshake. | |
CVE-1999-0762 | | 1999-05-24 | When Javascript is embedded within the TITLE tag, Netscape Communicator allows a remote attacker to use the "about" protocol to gain access to browser informat… | |
CVE-1999-0686 | | 1999-05-07 | Denial of service in Netscape Enterprise Server (NES) in HP Virtual Vault (VVOS) via a long URL. |