CVE-2005-0401

FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka "Firescrolling 2."

• http://marc.info/?l=bugtraq&m=111168413007891&w=2
• http://mikx.de/firescrolling2/Exploit
• http://secunia.com/advisories/14654Vendor Advisory
• http://www.gentoo.org/security/en/glsa/glsa-200503-30.xmlVendor Advisory
• http://www.mozilla.org/security/announce/mfsa2005-32.html
• http://www.redhat.com/support/errata/RHSA-2005-335.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2005-336.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2005-384.html
• http://www.securityfocus.com/bid/12885Exploit, Patch
• http://www.vupen.com/english/advisories/2005/0296
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100026
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9650
• http://marc.info/?l=bugtraq&m=111168413007891&w=2
• http://mikx.de/firescrolling2/Exploit
• http://secunia.com/advisories/14654Vendor Advisory
• http://www.gentoo.org/security/en/glsa/glsa-200503-30.xmlVendor Advisory
• http://www.mozilla.org/security/announce/mfsa2005-32.html
• http://www.redhat.com/support/errata/RHSA-2005-335.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2005-336.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2005-384.html
• http://www.securityfocus.com/bid/12885Exploit, Patch
• http://www.vupen.com/english/advisories/2005/0296
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100026
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9650

Published

May 2, 2005

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2005-0395Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2005-0396Desktop Communication Protocol (DCOP) daemon, aka dcopserver…
• CVE-2005-0397Format string vulnerability in the SetImageInfo function in …
• CVE-2005-0398The KAME racoon daemon in ipsec-tools before 0.5 allows remo…
• CVE-2005-0399Heap-based buffer overflow in GIF2.cpp in Firefox before 1.0…
• CVE-2005-0400The ext2_make_empty function call in the Linux kernel before…
• CVE-2005-0402Firefox before 1.0.2 allows remote attackers to execute arbi…
• CVE-2005-0403init_dev in tty_io.c in the Red Hat backport of NPTL to Red …
• CVE-2005-0404KMail 1.7.1 in KDE 3.3.2 allows remote attackers to spoof em…
• CVE-2005-0406A design flaw in image processing software that modifies JPE…5.5
• CVE-2005-0407Cross-site scripting (XSS) vulnerability in Openconf 1.04, a…
• CVE-2005-0408CitrusDB 0.3.6 and earlier generates easily predictable MD5 …9.8