1,429 results · Feed
-
Medium 6.5
If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server t…
-
High 8.8
Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some …
-
High 7.8
When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox…
-
Critical 9.8
If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while refer…
-
Medium 6.5
Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen withou…
-
High 8.8
The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> …
-
Medium 6.5
Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for…
-
Medium 6.5
Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seei…
-
Medium 6.5
Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free …
-
Medium 4.3
Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers be…
-
High 8.8
When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlin…
-
Medium 6.5
Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timin…
-
High 7.5
If an attacker loaded a font using <code>FontFace()</code> on a background worker, a use-after-free could have occurred…
-
Medium 6.5
Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of …
-
Medium 6.1
If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the bro…
-
Medium 6.1
Using the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user to a URL and cause…
-
Medium 6.1
Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access…
-
High 8.8
Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team report…
-
Medium 6.5
Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<…
-
High 8.8
Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105 and Fire…
-
High 8.8
Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could hav…
-
Medium 5.9
Wasmtime vulnerable to out of bounds read/write with zero-memory-pages configuration
Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator when the allocator is configured to give WebAssembly instances a maximum of zero pages of memory. In this c…
-
High 8.6
Wasmtime vulnerable to data leakage between instances in the pooling allocator
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior…
-
Low 3.8
wasmtime_trap_code C API function has out of bounds write vulnerability
Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discr…
-
Unscored —
Prototype pollution vulnerability in beautify-web js-beautify 1.13.7 via the name variable in options.js.
-
Unscored —
Use after free in Codecs in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap …
-
Medium 5.9
Cranelift vulnerable to miscompilation of constant values in division on AArch64
Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can result in incorrect division results at runtime. This affects Wasmtime prior to version 0.38.2 and Cranel…
-
Medium 6.4
Use After Free in Wasmtime
Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection. This means that if a GC happens at…
-
High 8.1
Use after free in Wasmtime
Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explicitly enabling epoch …