1,441 results · Feed
-
Unscored —
A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) eleme…
-
Unscored —
The combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute o…
-
Unscored —
Inside the JavaScript parser, a cast of an integer to a narrower type can result in data read from outside the buffer b…
-
Unscored —
A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements. This results in a p…
-
Unscored —
A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This results in a potent…
-
Unscored —
A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element. If thes…
-
Unscored —
If a server sends two Strict-Transport-Security (STS) headers for a single connection, they will be rejected as invalid…
-
Unscored —
Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the ad…
-
Unscored —
A use-after-free vulnerability can occur in design mode when image objects are resized if objects referenced during the…
-
Unscored —
Memory safety bugs were reported in Firefox 56. Some of these bugs showed evidence of memory corruption and we presume …
-
Unscored —
SVG loaded through "<img>" tags can use "<meta>" tags within the SVG data to set cookies for that page. This vulnerabil…
-
Unscored —
The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to be…
-
Unscored —
A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. …
-
Unscored —
A content security policy (CSP) "frame-ancestors" directive containing origins with paths allows for comparisons agains…
-
Unscored —
On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary…
-
Unscored —
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerpri…
-
Unscored —
Some Arabic and Indic vowel marker characters can be combined with Latin characters in a domain name to eclipse the non…
-
Unscored —
A use-after-free vulnerability in IndexedDB when one of its objects is destroyed in memory while a method on it is stil…
-
Unscored —
A use-after-free vulnerability during video control operations when a "<track>" element holds a reference to an older w…
-
Unscored —
During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for l…
-
Unscored —
The "instanceof" operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or …
-
Unscored —
A buffer overflow will occur when viewing a certificate in the certificate manager if the certificate has an extremely …
-
Unscored —
A use-after-free vulnerability can occur when reading an image observer during frame reconstruction after the observer …
-
Unscored —
Response header name interning does not have same-origin protections and these headers are stored in a global registry.…
-
Unscored —
If a long user name is used in a username/password combination in a site URL (such as " http://UserName:Password@exampl…
-
Unscored —
The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violatio…
-
Unscored —
On Linux systems, if the content process is compromised, the sandbox broker will allow files to be truncated even thoug…
-
Unscored —
A buffer overflow can occur when manipulating Accessible Rich Internet Applications (ARIA) attributes within the DOM. T…
-
Unscored —
Mixed content blocking of insecure (HTTP) sub-resources in a secure (HTTPS) document was not correctly applied for reso…
-
Unscored —
Memory safety bugs were reported in Firefox 55. Some of these bugs showed evidence of memory corruption and we presume …
-
Unscored —
A vulnerability where the security wrapper does not deny access to some exposed properties using the deprecated "_expos…
-
Unscored —
A use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages d…
-
Unscored —
An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while …
-
Unscored —
Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes…
-
Unscored —
An out-of-bounds read in WebGL with a maliciously crafted "ImageInfo" object during WebGL operations. This vulnerabilit…
-
Unscored —
JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved …
-
Unscored —
On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will h…
-
Unscored —
Memory safety bugs were reported in Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2. Some of these bugs showed evide…
-
Unscored —
A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where…
-
Unscored —
The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 according to the N…