712 results · Feed
-
Unscored —
When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been int…
-
Unscored —
The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash…
-
Unscored —
Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking r…
-
Unscored —
The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal…
-
Unscored —
A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary …
-
Unscored —
A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading t…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed e…
-
Unscored —
A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack …
-
Unscored —
Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network…
-
Unscored —
A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an addres…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some o…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed ev…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed ev…
-
Unscored —
If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin informati…
-
Unscored —
Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading…
-
Unscored —
Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially ex…
-
Unscored —
If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reporte…
-
Unscored —
As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure th…
-
Unscored —
When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the conte…
-
Unscored —
Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video …
-
Unscored —
Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been u…
-
Unscored —
When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wro…
-
Unscored —
Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network…
-
Unscored —
When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not trig…
-
Unscored —
If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there w…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these bugs showed ev…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed ev…
-
Unscored —
Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a…
-
Unscored —
Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field…
-
Unscored —
When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do no…
-
Unscored —
If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointer…
-
Unscored —
During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-aft…
-
Unscored —
Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached throu…
-
Unscored —
In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to …
-
Unscored —
It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possib…
-
Unscored —
A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitizat…
-
Unscored —
In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some o…
-
Unscored —
If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from th…
-
Unscored —
By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access …