1,430 results · Feed
-
Unscored —
The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script durin…
-
Unscored —
A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by maliciou…
-
Unscored —
A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driv…
-
Unscored —
Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBit…
-
Unscored —
A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and…
-
Unscored —
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check…
-
Unscored —CVE-2019-9813 Public exploit
Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arb…
-
Unscored —
Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph func…
-
Unscored —
Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph.
-
Unscored —
Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function.
-
Unscored —
Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor.
-
Unscored —
Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function.
-
Unscored —
Heap-based Buffer Overflow in Graphite2 library in Firefox before 54 in lz4::decompress function.
-
Unscored —
A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D a…
-
Unscored —
A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location proper…
-
Unscored —
A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select eleme…
-
Unscored —
A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a ra…
-
Unscored —
A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs sh…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some o…
-
Unscored —
A WebExtension can request access to local files without the warning prompt stating that the extension will "Access you…
-
Unscored —
By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through …
-
Unscored —
A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an i…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some o…
-
Unscored —
When manipulating user events in nested loops while opening a document through script, it is possible to trigger a pote…
-
Unscored —
A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other event…
-
Unscored —
An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communica…
-
Unscored —
A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This resul…
-
Unscored —
When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is …
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4. Some o…
-
Medium 5.3
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called un…
-
Unscored —CVE-2018-6126 Public exploit
A precision error in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds …
-
Unscored —
An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a …
-
Unscored —
Incorrect texture handling in Angle in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out …
-
Unscored —
Memory safety bugs present in Firefox 61 and Firefox ESR 60.1. Some of these bugs showed evidence of memory corruption …
-
Unscored —
When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can b…
-
Unscored —
A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dy…
-
Unscored —
A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cach…
-
Unscored —
If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these password…
-
Unscored —
A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in …