CVE-2007-1095

Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 do not properly implement JavaScript onUnload handlers, which allows remote attackers to run certain JavaScript code and access the location DOM hierarchy in the context of the next web site that is visited by a client.

• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
• http://lcamtuf.coredump.cx/ietrap/ff/
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052630.html
• http://osvdb.org/33809
• http://secunia.com/advisories/27276Vendor Advisory
• http://secunia.com/advisories/27298Vendor Advisory
• http://secunia.com/advisories/27311Vendor Advisory
• http://secunia.com/advisories/27315Vendor Advisory
• http://secunia.com/advisories/27325Vendor Advisory
• http://secunia.com/advisories/27327Vendor Advisory
• http://secunia.com/advisories/27335Vendor Advisory
• http://secunia.com/advisories/27336Vendor Advisory
• http://secunia.com/advisories/27356Vendor Advisory
• http://secunia.com/advisories/27360Vendor Advisory
• http://secunia.com/advisories/27383Vendor Advisory
• http://secunia.com/advisories/27387Vendor Advisory
• http://secunia.com/advisories/27403Vendor Advisory
• http://secunia.com/advisories/27414Vendor Advisory
• http://secunia.com/advisories/27425Vendor Advisory
• http://secunia.com/advisories/27480Vendor Advisory
• http://secunia.com/advisories/27665Vendor Advisory
• http://secunia.com/advisories/27680Vendor Advisory
• http://secunia.com/advisories/28398Vendor Advisory
• http://securityreason.com/securityalert/2310
• http://securitytracker.com/id?1018837
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1
• http://support.novell.com/techcenter/psdb/60eb95b75c76f9fbfcc9a89f99cd8f79.html
• http://www.debian.org/security/2007/dsa-1392
• http://www.debian.org/security/2007/dsa-1396
• http://www.debian.org/security/2007/dsa-1401
• http://www.gentoo.org/security/en/glsa/glsa-200711-14.xml
• http://www.mandriva.com/en/security/advisories?name=MDKSA-2007:202
• http://www.mozilla.org/security/announce/2007/mfsa2007-30.html
• http://www.novell.com/linux/security/advisories/2007_57_mozilla.html
• http://www.redhat.com/support/errata/RHSA-2007-0979.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2007-0980.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2007-0981.htmlVendor Advisory
• http://www.securityfocus.com/archive/1/461007/100/0/threaded
• http://www.securityfocus.com/archive/1/461023/100/0/threaded
• http://www.securityfocus.com/archive/1/482876/100/200/threaded
• http://www.securityfocus.com/archive/1/482925/100/0/threaded
• http://www.securityfocus.com/archive/1/482932/100/200/threaded
• http://www.securityfocus.com/bid/22688
• http://www.ubuntu.com/usn/usn-536-1
• http://www.vupen.com/english/advisories/2007/3544
• http://www.vupen.com/english/advisories/2007/3587
• http://www.vupen.com/english/advisories/2008/0083
• https://bugzilla.mozilla.org/show_bug.cgi?id=371360
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32647
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32649
• https://issues.rpath.com/browse/RPL-1858
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11665
• https://usn.ubuntu.com/535-1/
• https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00498.html
• https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00285.html
• https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00355.html
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
• http://lcamtuf.coredump.cx/ietrap/ff/
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052630.html
• http://osvdb.org/33809
• http://secunia.com/advisories/27276Vendor Advisory
• http://secunia.com/advisories/27298Vendor Advisory
• http://secunia.com/advisories/27311Vendor Advisory
• http://secunia.com/advisories/27315Vendor Advisory
• http://secunia.com/advisories/27325Vendor Advisory
• http://secunia.com/advisories/27327Vendor Advisory
• http://secunia.com/advisories/27335Vendor Advisory
• http://secunia.com/advisories/27336Vendor Advisory
• http://secunia.com/advisories/27356Vendor Advisory
• http://secunia.com/advisories/27360Vendor Advisory
• http://secunia.com/advisories/27383Vendor Advisory
• http://secunia.com/advisories/27387Vendor Advisory
• http://secunia.com/advisories/27403Vendor Advisory
• http://secunia.com/advisories/27414Vendor Advisory
• http://secunia.com/advisories/27425Vendor Advisory
• http://secunia.com/advisories/27480Vendor Advisory
• http://secunia.com/advisories/27665Vendor Advisory
• http://secunia.com/advisories/27680Vendor Advisory
• http://secunia.com/advisories/28398Vendor Advisory
• http://securityreason.com/securityalert/2310
• http://securitytracker.com/id?1018837
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1
• http://support.novell.com/techcenter/psdb/60eb95b75c76f9fbfcc9a89f99cd8f79.html
• http://www.debian.org/security/2007/dsa-1392
• http://www.debian.org/security/2007/dsa-1396
• http://www.debian.org/security/2007/dsa-1401
• http://www.gentoo.org/security/en/glsa/glsa-200711-14.xml
• http://www.mandriva.com/en/security/advisories?name=MDKSA-2007:202
• http://www.mozilla.org/security/announce/2007/mfsa2007-30.html
• http://www.novell.com/linux/security/advisories/2007_57_mozilla.html
• http://www.redhat.com/support/errata/RHSA-2007-0979.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2007-0980.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2007-0981.htmlVendor Advisory
• http://www.securityfocus.com/archive/1/461007/100/0/threaded
• http://www.securityfocus.com/archive/1/461023/100/0/threaded
• http://www.securityfocus.com/archive/1/482876/100/200/threaded
• http://www.securityfocus.com/archive/1/482925/100/0/threaded
• http://www.securityfocus.com/archive/1/482932/100/200/threaded
• http://www.securityfocus.com/bid/22688
• http://www.ubuntu.com/usn/usn-536-1
• http://www.vupen.com/english/advisories/2007/3544
• http://www.vupen.com/english/advisories/2007/3587
• http://www.vupen.com/english/advisories/2008/0083
• https://bugzilla.mozilla.org/show_bug.cgi?id=371360
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32647
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32649
• https://issues.rpath.com/browse/RPL-1858
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11665
• https://usn.ubuntu.com/535-1/
• https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00498.html
• https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00285.html
• https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00355.html

Published

Feb 26, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-1089IBM DB2 Universal Database (UDB) 9.1 GA through 9.1 FP1 allo…
• CVE-2007-1090Microsoft Windows Explorer on Windows XP and 2003 allows rem…
• CVE-2007-1091Microsoft Internet Explorer 7 allows remote attackers to pre…
• CVE-2007-1092Mozilla Firefox 1.5.0.9 and 2.0.0.1, and SeaMonkey before 1.…
• CVE-2007-1093Multiple unspecified vulnerabilities in JP1/Cm2/Network Node…
• CVE-2007-1094Microsoft Internet Explorer 7 allows remote attackers to cau…
• CVE-2007-1096Cross-site scripting (XSS) vulnerability in ps_cart.php in V…
• CVE-2007-1097Unrestricted file upload vulnerability in the onAttachFiles …
• CVE-2007-1098Multiple unspecified vulnerabilities in ScryMUD before 2.1.1…
• CVE-2007-1099dbclient in Dropbear SSH client before 0.49 does not suffici…
• CVE-2007-1100Directory traversal vulnerability in download.php in Ahmet S…
• CVE-2007-1101Multiple cross-site scripting (XSS) vulnerabilities in Photo…