491 results · Feed
-
Unscored —
The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that …
-
Unscored —
Full screen notification obscured by file open dialog
A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.
-
Unscored —CVE-2023-4050 EPSS 13%
In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a pot…
-
Unscored —
Race conditions in reference counting code were found through code inspection. These could have resulted in potentially…
-
Unscored —
An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations.…
-
Unscored —
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into grantin…
-
Unscored —
In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in …
-
Unscored —
Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from ano…
-
Unscored —
Use-after-free in workers
During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash. This vulnerability affects Firefox < 115.0.2, Firefox ESR < 115.0.2, and Thunderbird < 115.0.1.
-
Unscored —
Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we presume that …
-
Unscored —
A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confus…
-
Unscored —
A use-after-free condition existed in `NotifyOnHistoryReload` where a `LoadingSessionHistoryEntry` object was freed and…
-
Unscored —
Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a…
-
Unscored —
The use of RTL Arabic characters in the address bar may have allowed for URL spoofing. This vulnerability affects Firef…
-
Unscored —
A website could have obscured the fullscreen notification by using an option element by introducing lag via an expensiv…
-
High 7.8
Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker t…
-
Unscored —
When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by usin…
-
Unscored —
Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed eviden…
-
Unscored —
When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerabili…
-
Unscored —
A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, …
-
Unscored —
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in …
-
Unscored —
An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerab…
-
Medium 5.3CVE-2023-1999 Public exploit
Use after free in libwebp
There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encode…
-
Unscored —
Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed eviden…
-
Unscored —
The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts…
-
Medium 6.5
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable …
-
Critical 9.8
A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious fi…
-
Medium 5.5
A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the servic…
-
Critical 9.8
An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a poten…
-
Unscored —
Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. *Note: This atta…
-
High 8.8
An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 1…
-
High 8.8
Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruptio…
-
Medium 6.5
Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website…
-
High 8.8
While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have…
-
Medium 6.5
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable n…
-
Medium 6.5
Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable c…
-
Unscored —
An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Fir…
-
Unscored —
In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to pot…
-
Unscored —
An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox <…
-
High 8.8
A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permis…