357 results · Clear filters · Feed
-
Medium 5.5
An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnera…
-
Medium 6.5
An OpenPGP digital signature includes information about the date when the signature was created. When displaying an ema…
-
Medium 6.5
A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*:…
-
Medium 4.3
By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential use…
-
Medium 6.5
When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the S…
-
Medium 6.5
Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen withou…
-
Medium 6.5
Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for…
-
Medium 6.5
Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seei…
-
Medium 6.5
Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free …
-
Medium 6.5
Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timin…
-
Medium 6.5
Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of …
-
Medium 6.1
If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the bro…
-
Medium 6.1
Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access…
-
Medium 6.5
During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that lea…
-
Medium 6.5
Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a…
-
Medium 6.5
By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context …
-
Medium 6.1
When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected ele…
-
Medium 6.5
Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<…
-
Medium 6.5
If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may …
-
Medium 6.5
After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have l…
-
Medium 6.5
If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so,…
-
Medium 6.5
Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This…
-
Medium 6.5
Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerab…
-
Medium 6.5
When importing resources using Web Workers, error messages would distinguish the difference between <code>application/j…
-
Medium 6.5
Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handli…
-
Medium 4.3
When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made th…
-
Medium 6.5
When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potent…
-
Medium 4.3
When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This…
-
Medium 6.5
Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>…
-
Medium 6.5
When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a…
-
Medium 5.9
Wasmtime vulnerable to out of bounds read/write with zero-memory-pages configuration
Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator when the allocator is configured to give WebAssembly instances a maximum of zero pages of memory. In this c…
-
Medium 4.3
Matrix Javascript SDK improper beacon events can cause availability issues
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process…
-
Medium 5.9
Cranelift vulnerable to miscompilation of constant values in division on AArch64
Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can result in incorrect division results at runtime. This affects Wasmtime prior to version 0.38.2 and Cranel…
-
Medium 6.4
Use After Free in Wasmtime
Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection. This means that if a GC happens at…
-
Medium 6.5CVE-2022-25313 Public exploit
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth…
-
Medium 6.5
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing to…
-
Medium 5.3
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called un…