Vendor
Mozilla
2,559 known vulnerabilities.
Products
Firefox 2,316
Thunderbird 1,814
Firefox ESR 712
Firefox for iOS 63
Firefox for Android 33
Focus for Android 17
Thunderbird ESR 13
Focus for iOS 13
NSS 6
Focus 3
WebThings Gateway 2
Mozilla Bleach 2
Hubs Cloud 2
Mozilla VPN 2
Node-convict 1
Network Security Services (NSS) 1
thin-vec 1
Mozilla VPN 2.28.0 1
hawk 1
rhino 1
Firefox for 1
geckodriver 1
common-voice 1
Convict 1
Bugzilla 1
Persona 1
Network Security Services 1
Nunjucks 1
Klar for iOS 1
neqo 1
Mozilla VPN iOS 1.0.7 1
Mozilla VPN Windows 1
Mozilla VPN Android 1.1.0 1
sccache 1
Mozilla VPN 2.16.1 1
PollBot 1
Thunderbird < 102.8 0
Thunderbird < 102.9 0
Thunderbird < 102.9.1 0
Firefox < 110.1.0 Android 0
62 results · Clear filters · Feed
-
Unscored —CVE-2019-11705 Public exploit
A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processi…
-
Unscored —CVE-2019-11706 Public exploit
A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when pr…
-
High 8.8
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allo…
KEV May 23, 2022 -
Critical 10.0
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can resul…
KEV May 23, 2022 -
Unscored —
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other fi…
-
Unscored —
The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects …
-
Unscored —
The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script durin…
-
Unscored —
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check…
-
Unscored —CVE-2019-9813 Public exploit
Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arb…
-
Unscored —
A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and wri…
-
High 8.8
Malicious PDF can inject JavaScript into PDF Viewer
The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability af…
-
Unscored —
An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks…
-
Unscored —
An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnera…
-
High 7.5
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been di…
KEV Jun 22, 2023 -
Unscored —
A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amou…
-
Unscored —
Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption…
-
Unscored —
If a long user name is used in a username/password combination in a site URL (such as " http://UserName:Password@exampl…
-
Unscored —
An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitab…
-
Unscored —
JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. …
-
Unscored —
An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for othe…
-
Unscored —
A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree an…
-
Unscored —
An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leadi…