Archive
July 2019
Vulnerabilities first published in this month (UTC), newest first.
1,623 results · Feed
-
Unscored —
A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results …
-
Unscored —
A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers. This result…
-
Unscored —
A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main …
-
Unscored —
A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use,…
-
Unscored —
The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could…
-
Unscored —
A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a…
-
Unscored —
A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when …
-
Unscored —
Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for downloa…
-
Unscored —
If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installe…
-
Unscored —
If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently…
-
Unscored —
A malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page na…
-
Unscored —
A hyperlink using the res: protocol can be used to open local files at a known location in Internet Explorer if a user …
-
Unscored —
The default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS) attacks. This defaul…
-
Unscored —
A hyperlink using protocols associated with Internet Explorer, such as IE.HTTP:, can be used to open local files at a k…
-
Unscored —
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing ce…
-
Unscored —
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when proc…
-
Unscored —CVE-2019-11705 Public exploit
A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processi…
-
Unscored —CVE-2019-11706 Public exploit
A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when pr…
-
High 8.8
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allo…
KEV May 23, 2022 -
Critical 10.0
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can resul…
KEV May 23, 2022 -
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some o…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 67. Some of these bugs showed e…
-
Unscored —
When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages …
-
Unscored —
POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS require…
-
Unscored —
A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting …
-
Unscored —
Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in so…
-
Unscored —
D-Link DSL-2750U 1.11 is affected by: Authentication Bypass. The impact is: denial of service and information leakage. …
-
Unscored —
Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and l…
-
Unscored —
Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such …
-
Unscored —
A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being use…
-
Unscored —
Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on…
-
Unscored —
When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bo…
-
Unscored —
Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering p…
-
Unscored —
The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar. This allows for doma…
-
Unscored —
A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the …
-
Unscored —
Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been…
-
Unscored —
When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation i…
-
Unscored —
A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1…
-
Unscored —
The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that t…
-
Unscored —
Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before …