Netscape vulnerabilities
110 vulnerabilities
Known vulnerabilities in Netscape products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 21 products.
Products
21- Navigator38 vulnerabilities
- Communicator34 vulnerabilities
- Enterprise Server20 vulnerabilities
- Fasttrack Server7 vulnerabilities
- Directory Server6 vulnerabilities
- Messaging Server5 vulnerabilities
- Iplanet Ical4 vulnerabilities
- Collabra Server3 vulnerabilities
- Certificate Server2 vulnerabilities
- News Server2 vulnerabilities
- Proxy Server2 vulnerabilities
- Certificate Management System1 vulnerabilities
- Commerce Server1 vulnerabilities
- Communications Server1 vulnerabilities
- Messanger1 vulnerabilities
- Netscape Messaging Server Multiplexor1 vulnerabilities
- Portable Runtime Api1 vulnerabilities
- Professional Services Ftpserver1 vulnerabilities
- Publishingxpert1 vulnerabilities
- Smartdownload1 vulnerabilities
- Personalization Engine0 vulnerabilities
CVE-2018-18940netscapeenterprise_server
EPSS score1.42%
servlet/SnoopServlet (a servlet installed by default) in Netscape Enterprise 3.63 has reflected XSS via an arbitrary parameter=[XSS] in the query string. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. NOTE: this product is discontinued.CVE-2003-1265mozillamozilla+1EPSS score0.39%
Netscape 7.0 and Mozilla 5.0 do not immediately delete messages in the trash folder when users select the 'Empty Trash' option, which could allow local users to access deleted messages.CVE-2003-1492chainguardfirefox+2EPSS score1.20%
Netscape Navigator 7.0.2 and Mozilla allows remote attackers to access cookie information in a different domain via an HTTP request for a domain with an extra . (dot) at the end.CVE-2003-1419netscapenavigatorEPSS score2.15%
Netscape 7.0 allows remote attackers to cause a denial of service (crash) via a web page with an invalid regular expression argument to the JavaScript reformatDate function.CVE-2003-1560netscapenavigatorEPSS score1.06%
Netscape 4 sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.CVE-2003-0553netscapenavigatorEPSS score2.70%
Buffer overflow in the Client Detection Tool (CDT) plugin (npcdt.dll) for Netscape 7.02 allows remote attackers to execute arbitrary code via an attachment with a long filename.CVE-2007-4042microsoftinternet_explorer+1EPSS score10.32%
Multiple argument injection vulnerabilities in Netscape Navigator 9 allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a (1) mailto, (2) nntp, (3) news, (4) snews, or (5) telnet URI, a similar issue to CVE-2007-3670.CVE-2007-3924netscapenavigatorEPSS score13.63%
Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Netscape installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a -chrome argument to the navigatorurl URI, which are inserted into the command line that is created when invoking netscape.exe, a related issue to CVE-2007-3670. NOTE: there has been debate about whether the issue is in Internet Explorer or Netscape. As of 20070713, it is CVE's opinion that IE appears to not properly delimit the URL argument when invoking Netscape; this issue could arise with other protocol handlers in IE.CVE-2001-0684netscapecollabra_serverEPSS score1.91%
Netscape Collabra Server 3.5.4 and earlier allows a remote attacker to cause a denial of service by sending seven or more characters to TCP port 5239.CVE-2001-0262netscapesmartdownloadEPSS score7.47%
Buffer overflow in Netscape SmartDownload 1.3 allows remote attackers (malicious web pages) to execute arbitrary commands via a long URL.CVE-2001-0164netscapedirectory_serverEPSS score2.17%
Buffer overflow in Netscape Directory Server 4.12 and earlier allows remote attackers to cause a denial of service or execute arbitrary commands via a malformed recipient field.CVE-2001-0596netscapecommunicatorEPSS score8.69%
Netscape Communicator before 4.77 allows remote attackers to execute arbitrary Javascript via a GIF image whose comment contains the Javascript.CVE-2001-0921netscapecommunicatorEPSS score0.61%
Netscape 4.79 and earlier for MacOS allows an attacker with access to the browser to obtain passwords from form fields by printing the document into which the password has been typed, which is printed in cleartext.CVE-2001-0683netscapecollabra_serverEPSS score1.34%
Memory leak in Netscape Collabra Server 3.5.4 and earlier allows a remote attacker to cause a denial of service (memory exhaustion) by repeatedly sending approximately 5K of data to TCP port 5238.CVE-2001-0251netscapeenterprise_serverEPSS score2.63%
The Web Publishing feature in Netscape Enterprise Server 3.x allows remote attackers to cause a denial of service via the REVLOG command.CVE-2001-0250netscapeenterprise_serverEPSS score3.42%
The Web Publishing feature in Netscape Enterprise Server 4.x and earlier allows remote attackers to list arbitrary directories under the web server root via the INDEX command.CVE-2001-0175netscapefasttrack_serverEPSS score2.47%
The caching module in Netscape Fasttrack Server 4.1 allows remote attackers to cause a denial of service (resource exhaustion) by requesting a large number of non-existent URLs.CVE-2001-0745netscapemessangerEPSS score1.70%
Netscape 4.7x allows remote attackers to obtain sensitive information such as the user's login, mailbox location and installation path via Javascript that accesses the mailbox: URL in the document.referrer property.CVE-2005-1156mozillafirefox+2EPSS score2.34%
Firefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to execute arbitrary script and code via a new search plugin using sidebar.addSearchEngine, aka "Firesearching 1."CVE-2005-1157mozillafirefox+2EPSS score2.46%
Firefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to replace existing search plugins with malicious ones using sidebar.addSearchEngine and the same filename as the target engine, which may not be displayed in the GUI, which could then be used to execute malicious script, aka "Firesearching 2."