Archive
22 December 2022
Vulnerabilities first published on this day (UTC), newest first.
218 results · Feed
-
Medium 4.3
The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This…
-
Medium 6.1
When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.<br>*Not…
-
Critical 9.8
Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bu…
-
Medium 6.5
The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instruction…
-
Medium 6.1
An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could…
-
Medium 6.1
Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affe…
-
High 8.8
Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level orig…
-
High 7.5
When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates th…
-
Medium 5.3
When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerabilit…
-
Medium 4.3
When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of pre…
-
Medium 6.1
When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus l…
-
Medium 5.5
When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to un…
-
Critical 9.8
Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs …
-
Medium 6.5
When visiting a website with an overly long URL, the user interface would start to hang. Due to session restore, this c…
-
Medium 6.5
When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resultin…
-
Critical 9.8
Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Team reported …
-
Medium 4.3
If array shift operations are not used, the Garbage Collector may have become confused about valid objects. This vulner…
-
High 8.8
When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly bei…
-
High 8.8
A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further…
-
Medium 6.5
An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so b…
-
Critical 9.8
Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs prese…
-
Medium 6.5
An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the…
-
Medium 6.5
Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. T…
-
Critical 9.8
A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerab…
-
Medium 6.5
Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header.…
-
Critical 9.8
A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially e…
-
High 8.8
On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and …
-
High 7.8
When saving or opening an email attachment on macOS, Thunderbird did not set attribute com.apple.quarantine on the rece…
-
High 8.1
If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the <code>meta</code> ta…
-
Medium 4.3
When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to…
-
Unscored —
When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute …
-
Medium 5.5
An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnera…
-
Medium 6.5
An OpenPGP digital signature includes information about the date when the signature was created. When displaying an ema…
-
High 8.8CVE-2022-2200 EPSS 24%
If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScr…
-
High 8.8
Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs …
-
High 8.8
Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs …
-
High 8.6
An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clip…
-
High 8.8
AyaCMS v3.1.2 was found to have a code flaw in the ust_sql.inc.php file, which allows attackers to cause command execut…
-
Critical 9.8
Default version of nbnbk was discovered to contain an arbitrary file upload vulnerability via the component /api/User/d…
-
High 8.8
An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited. This vulnerability a…