1,432 results · Feed
-
Unscored —
Full screen notification obscured by file open dialog
A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.
-
Unscored —CVE-2023-4050 EPSS 13%
In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a pot…
-
Unscored —
Race conditions in reference counting code were found through code inspection. These could have resulted in potentially…
-
Unscored —
An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations.…
-
Unscored —
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into grantin…
-
Unscored —
In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in …
-
Unscored —
Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from ano…
-
Unscored —
File Extension Spoofing using the Text Direction Override Character
Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show t…
-
Unscored —
Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed eviden…
-
Unscored —
When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerabili…
-
Unscored —
A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, …
-
Unscored —
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in …
-
Unscored —
An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerab…
-
Medium 5.3CVE-2023-1999 Public exploit
Use after free in libwebp
There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encode…
-
Unscored —
Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed eviden…
-
Unscored —
The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts…
-
Medium 6.5
Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certifi…
-
Medium 6.5
If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and …
-
Medium 6.5
OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certi…
-
High 8.8
An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 1…
-
High 8.8
Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruptio…
-
Medium 6.5
Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website…
-
High 8.8
While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have…
-
Medium 6.5
Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable c…
-
Unscored —
An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Fir…
-
Unscored —
In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to pot…
-
Unscored —
An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox <…
-
High 8.8
A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permis…
-
Unscored —
Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCr…
-
Unscored —
A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ES…
-
Unscored —
When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 11…
-
Unscored —
Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resu…
-
Medium 6.5
A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affe…
-
High 8.8
Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run att…
-
High 8.8
Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruptio…
-
Unscored —
An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, res…
-
Unscored —
A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscree…
-
Unscored —
When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename…
-
Medium 6.5
Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers
A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers. This vulnerability affects Firefox < 109, Fi…
-
Unscored —
Arbitrary file read from GTK drag and drop on Linux
Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to `DataTransfer.setData`. This vulnerability affects Firefox …