1,430 results · Feed
-
Unscored —
A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script. This results in a potential…
-
Unscored —
Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we pr…
-
Unscored —
Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inlin…
-
Unscored —
Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor. This vulnerabil…
-
Unscored —
External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of…
-
High 7.5
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been di…
KEV Jun 22, 2023 -
Unscored —
An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zo…
-
Unscored —
An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in…
-
Unscored —
Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated…
-
Unscored —
Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a…
-
Unscored —
A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amou…
-
Unscored —
The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin …
-
Unscored —
Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption…
-
Unscored —
A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability a…
-
Unscored —
HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will …
-
Unscored —
An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking iss…
-
Unscored —
Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corru…
-
Unscored —
A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability aff…
-
Unscored —
A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially…
-
Unscored —
A use-after-free vulnerability can occur when an editor DOM node is deleted prematurely during tree traversal while sti…
-
Unscored —
A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and…
-
Unscored —
A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" object has been fre…
-
Unscored —
A use-after-free and use-after-scope vulnerability when logging errors from headers for XML HTTP Requests (XHR). This c…
-
Unscored —
Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3. Some of these bugs showed evidence of memory corru…
-
Unscored —
A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) eleme…
-
Unscored —
A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements. This results in a p…
-
Unscored —
A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This results in a potent…
-
Unscored —
A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element. If thes…
-
Unscored —
Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the ad…
-
Unscored —
A use-after-free vulnerability can occur in design mode when image objects are resized if objects referenced during the…
-
Unscored —
The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to be…
-
Unscored —
A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. …
-
Unscored —
On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary…
-
Unscored —
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerpri…
-
Unscored —
A use-after-free vulnerability in IndexedDB when one of its objects is destroyed in memory while a method on it is stil…
-
Unscored —
A use-after-free vulnerability during video control operations when a "<track>" element holds a reference to an older w…
-
Unscored —
During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for l…
-
Unscored —
A buffer overflow will occur when viewing a certificate in the certificate manager if the certificate has an extremely …
-
Unscored —
A use-after-free vulnerability can occur when reading an image observer during frame reconstruction after the observer …
-
Unscored —
The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violatio…