Archive
11 June 2018
Vulnerabilities first published on this day (UTC), newest first.
349 results · Feed
-
Unscored —
Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory cor…
-
Unscored —
A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not…
-
Unscored —
Memory safety bugs were reported in Firefox 50.1. Some of these bugs showed evidence of memory corruption and we presum…
-
Unscored —
Data sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will ignore the referrer-policy …
-
Unscored —
During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessi…
-
Unscored —
When a "javascript:" URL is drag and dropped by a user into the addressbar, the URL will be processed and executed. Thi…
-
Unscored —
A location bar spoofing attack where the location bar of loaded page will be shown over the content of another tab due …
-
Unscored —
A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event co…
-
Unscored —
A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to cre…
-
Unscored —
A use-after-free vulnerability when holding a selection during scroll events. This results in a potentially exploitable…
-
Unscored —
Memory safety bugs were reported in Firefox 53 and Firefox ESR 52.1. Some of these bugs showed evidence of memory corru…
-
Unscored —
WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, l…
-
Unscored —
A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree an…
-
Unscored —
Use-after-free vulnerability in Web Animations when interacting with cycle collection found through fuzzing. This vulne…
-
Unscored —
An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leadi…
-
Unscored —
Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for t…
-
Unscored —
If a malicious site uses the "view-source:" protocol in a series within a single hyperlink, it can trigger a non-exploi…
-
Unscored —
The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege…
-
Unscored —
Malicious sites can display a spoofed addressbar on a page when the existing location bar on the new page is scrolled o…
-
Unscored —
Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract p…
-
Unscored —
The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing …
-
Unscored —
An out-of-bounds read when an HTTP/2 connection to a servers sends "DATA" frames with incorrect data content. This lead…
-
Unscored —
If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, trigge…
-
Unscored —
An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a …
-
Unscored —
A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS layout when attem…
-
Unscored —
In certain circumstances a networking event listener can be prematurely released. This appears to result in a null dere…
-
Unscored —
A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. This vulnerability…
-
Unscored —
A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash.…
-
Unscored —
Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence …
-
Unscored —
A segmentation fault can occur during some bidirectional layout operations. This vulnerability affects Firefox < 52 and…
-
Unscored —
A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL pa…
-
Unscored —
A STUN server in conjunction with a large number of "webkitRTCPeerConnection" objects can be used to send large STUN pa…
-
Unscored —
Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address …
-
Unscored —
A use-after-free can occur during buffer storage operations within the ANGLE graphics library, used for WebGL content. …
-
Unscored —
On Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media Plugin sandbox is start…
-
Unscored —
An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives. This vulnerability affect…
-
Unscored —
A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS…
-
Unscored —
The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a speci…
-
Unscored —
A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip …
-
Unscored —
Memory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we pr…