CVE-2004-0905
Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8...
Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to perform cross-domain scripting and possibly execute arbitrary code by convincing a user to drag and drop javascript: links to a frame or page in another domain.
Exploit likelihood
What each source reports
NVD Score used
Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to perform cross-domain scripting and possibly execute arbitrary code by convincing a user to drag and drop javascript: links to a frame or page in another domain.
- Record
CVE-2004-0905- CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to perform cross-domain scripting and possibly execute arbitrary code by convincing a user to drag and drop javascript: links to a frame or page in another domain.
- Record
CVE-2004-0905- Updated
- 2026-11-02
EUVDEUVD-2004-0903 No score
Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to perform cross-domain scripting and possibly execute arbitrary code by convincing a user to drag and drop javascript: links to a frame or page in another domain.
- Record
EUVD-2004-0903- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fqjg-fc86-m5cr No score
Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8...
Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to perform cross-domain scripting and possibly execute arbitrary code by convincing a user to drag and drop javascript: links to a frame or page in another domain.
- Record
GHSA-fqjg-fc86-m5cr- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-0905 is a medium vulnerability (CVSS 4.6) in Mozilla Firefox, published September 14, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.05%, the 87th percentile. No source names a fixed version.
References
kb.cert.org/vuls/id/651928
novell.com/linux/security/advisories/2004_36_mozilla.html
bugzilla.mozilla.org/show_bug.cgi?id=250862
marc.info?l=bugtraq&m=109900315219363&w=2
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10378
securityfocus.com/bid/11177
Show 7 moreShow less
mozilla.org/projects/security/known-vulnerabilities.html
security.gentoo.org/glsa/glsa-200409-26.xml
exchange.xforce.ibmcloud.com/vulnerabilities/17374
us-cert.gov/cas/techalerts/TA04-261A.html
nvd.nist.gov/vuln/detail/CVE-2004-0905
github.com/advisories/GHSA-fqjg-fc86-m5cr