CVE-1999-0685

The Netscape Mail Notification (nsnotify) utility in Netscape Communicator uses IMAP without SSL, even if the user has set a preference for SSL connections. This allows a remote attacker to sniff usernames and passwords in plaintext.

There is a buffer overflow in Netscape Communicator before version 4.7 caused by a dynamic font whose length field is less than the size of the font.

Netscape Communicator 4.7 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long certificate key.

Netscape Communicator versions 4.04 through 4.7 (and possibly other versions) on various UNIX operating systems converts the 0x8b character to a '<' sign and the 0x9b character to a '>' sign, which could allow remote attackers to perform cross-site scripting (CSS) attacks in CGI programs that do not filter these characters.

Netscape Communicator 4.x with JavaScript enabled does not warn a user of cookie settings, even if they have selected the option 'Only accept cookies originating from the same server as the page being viewed'.

A vulnerability in Netscape Communicator allows a remote attacker to use the 'about' protocol to gain access to browser information when JavaScript is embedded within the TITLE tag.