1,441 results · Feed
-
Unscored —
An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to privileged pages being allowed…
-
Unscored —
Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inlin…
-
Unscored —
A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage…
-
Unscored —
Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor. This vulnerabil…
-
Unscored —
Memory safety bugs were reported in Firefox 50.0.2. Some of these bugs showed evidence of memory corruption and we pres…
-
Unscored —
An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.
-
Unscored —
Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin. The rendering by the filter is v…
-
Unscored —
External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of…
-
High 7.5
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been di…
KEV Jun 22, 2023 -
Unscored —
Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to verify whether a kno…
-
Unscored —
An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zo…
-
Unscored —
Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerabil…
-
Unscored —
Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated…
-
Unscored —
A use-after-free during web animations when working with timelines resulting in a potentially exploitable crash. This v…
-
Unscored —
Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a…
-
Unscored —
A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amou…
-
Unscored —
The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin …
-
Unscored —
Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption…
-
Unscored —
A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later writers will overflow the bu…
-
Unscored —
HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will …
-
Unscored —
An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking iss…
-
Unscored —
Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corru…
-
Unscored —
Memory safety bugs were reported in Firefox 49. Some of these bugs showed evidence of memory corruption and we presume …
-
Unscored —
A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability aff…
-
Unscored —
During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Fir…
-
Unscored —
A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially…
-
Unscored —
A potentially exploitable use-after-free crash during actor destruction with service workers. This issue does not affec…
-
Unscored —
Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the c…
-
Unscored —
An error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can…
-
Unscored —
A vulnerability where WebExtensions can download and attempt to open a file of some non-executable file types. This can…
-
Unscored —
A use-after-free vulnerability can occur when an editor DOM node is deleted prematurely during tree traversal while sti…
-
Unscored —
If a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for "<link>" …
-
Unscored —
When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar.…
-
Unscored —
A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and…
-
Unscored —
A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" object has been fre…
-
Unscored —
A use-after-free and use-after-scope vulnerability when logging errors from headers for XML HTTP Requests (XHR). This c…
-
Unscored —
Punycode format text will be displayed for entire qualified international domain names in some instances when a sub-dom…
-
Unscored —
Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3. Some of these bugs showed evidence of memory corru…
-
Unscored —
When an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit t…
-
Unscored —
A use-after-free vulnerability can occur when the layer manager is freed too early when rendering specific SVG content,…