1,441 results · Feed
-
Unscored —
When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wro…
-
Unscored —
When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service w…
-
Unscored —
Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network…
-
Unscored —
When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes c…
-
Unscored —
When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not trig…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these bugs showed ev…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 83. Some of these bugs showed evidence of memory corr…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence of memory corr…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed ev…
-
Unscored —
When listening for page changes with a Mutation Observer, a malicious web page could confuse Firefox Screenshots into i…
-
Unscored —
Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field…
-
Unscored —
Repeated calls to the history and location interfaces could have been used to hang the browser. This was addressed by i…
-
Unscored —
Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populate…
-
Unscored —
When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do no…
-
Unscored —
If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointer…
-
Unscored —
During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-aft…
-
Unscored —
Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached throu…
-
Unscored —
In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to …
-
Unscored —
It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possib…
-
Unscored —
Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially…
-
Unscored —
A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitizat…
-
Unscored —
In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable…
-
Unscored —
Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap c…
-
Unscored —
When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial …
-
Unscored —
If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distingui…
-
Unscored —
When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could h…
-
Unscored —
When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what applicatio…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some o…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corr…
-
High 8.1
Undefined Behavior in bounded Crossbeam channel
Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not act…
-
Unscored —
When converting coordinates from projective to affine, the modular inversion was not performed in constant time, result…
-
Unscored —
During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication …
-
Unscored —
By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access …
-
Unscored —
Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to remain on the page. …
-
Unscored —
When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) wa…
-
Unscored —
A lock was missing when accessing a data structure and importing certificate information into the trust database. This …
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed ev…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corr…
-
Unscored —
When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially e…