Vendor
Mozilla
2,559 known vulnerabilities.
Products
Firefox 2,316
Thunderbird 1,814
Firefox ESR 712
Firefox for iOS 63
Firefox for Android 33
Focus for Android 17
Thunderbird ESR 13
Focus for iOS 13
NSS 6
Focus 3
WebThings Gateway 2
Mozilla Bleach 2
Hubs Cloud 2
Mozilla VPN 2
Node-convict 1
Network Security Services (NSS) 1
thin-vec 1
Mozilla VPN 2.28.0 1
hawk 1
rhino 1
Firefox for 1
geckodriver 1
common-voice 1
Convict 1
Bugzilla 1
Persona 1
Network Security Services 1
Nunjucks 1
Klar for iOS 1
neqo 1
Mozilla VPN iOS 1.0.7 1
Mozilla VPN Windows 1
Mozilla VPN Android 1.1.0 1
sccache 1
Mozilla VPN 2.16.1 1
PollBot 1
Thunderbird < 102.8 0
Thunderbird < 102.9 0
Thunderbird < 102.9.1 0
Firefox < 110.1.0 Android 0
2,559 results · Feed
-
High 7.8
The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garb…
-
High 7.5
GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affect…
-
High 8.8
In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads. This…
-
High 7.5
A use-after-free could result if a JavaScript realm was in the process of being initialized when a garbage collection s…
-
Medium 4.3
Dragging Javascript URLs to the address bar could cause them to be loaded, bypassing restrictions and security protecti…
-
High 7.5
If an insecure element was added to a page after a delay, Firefox would not replace the secure icon with a mixed conten…
-
High 8.4
An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript executio…
-
Critical 9.8
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds che…
-
Low 2.7
To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead of attempt t…
-
Critical 9.8
Memory safety bugs present in Firefox 123. Some of these bugs showed evidence of memory corruption and we presume that …
-
High 8.8
Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence…
-
High 7.5
Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption …
-
High 8.1
If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered a crash or p…
-
Medium 5.5
A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permiss…
-
Medium 6.1
Using a markup injection an attacker could have stolen nonce values. This could have been used to bypass strict content…
-
Medium 6.5
NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow…
-
Medium 6.1
The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacki…
-
High 8.4
`AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienc…
-
High 8.1
Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:* This issue on…
-
Low 3.7
Passing invalid data could have led to invalid wasm values being created, such as arbitrary integers turning into point…
-
Medium 5.9
An attacker could have leveraged the Windows Error Reporter to run arbitrary code on the system escaping the sandbox. *…
-
High 7.5
The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email mes…
-
Medium 4.7
Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the cu…
-
High 7.1
Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. T…
-
High 7.8
An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an externa…
-
High 8.1
An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an externa…
-
Medium 6.1
Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website,…
-
Medium 6.5
The incorrect object was checked for NULL in the built-in profiler, potentially leading to invalid memory access and un…
-
High 8.1
Memory safety bugs present in Firefox 122. Some of these bugs showed evidence of memory corruption and we presume that …
-
Critical 9.8
The `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional heade…
-
High 8.3
When opening a website using the `firefox://` protocol handler, SameSite cookies were not properly respected. This vuln…
-
High 8.1
Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs showed evidence…
-
High 7.5
Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* Thi…
-
Medium 6.1
Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control th…
-
Medium 6.1
If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potent…
-
Medium 6.1
A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user…
-
Medium 6.5
Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another w…
-
Medium 4.3
A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led…
-
High 7.5
When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in …
-
Medium 6.1
When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the pa…