Vendor
Mozilla
2,559 known vulnerabilities.
Products
Firefox 2,316
Thunderbird 1,814
Firefox ESR 712
Firefox for iOS 63
Firefox for Android 33
Focus for Android 17
Thunderbird ESR 13
Focus for iOS 13
NSS 6
Focus 3
WebThings Gateway 2
Mozilla Bleach 2
Hubs Cloud 2
Mozilla VPN 2
Node-convict 1
Network Security Services (NSS) 1
thin-vec 1
Mozilla VPN 2.28.0 1
hawk 1
rhino 1
Firefox for 1
geckodriver 1
common-voice 1
Convict 1
Bugzilla 1
Persona 1
Network Security Services 1
Nunjucks 1
Klar for iOS 1
neqo 1
Mozilla VPN iOS 1.0.7 1
Mozilla VPN Windows 1
Mozilla VPN Android 1.1.0 1
sccache 1
Mozilla VPN 2.16.1 1
PollBot 1
Thunderbird < 102.8 0
Thunderbird < 102.9 0
Thunderbird < 102.9.1 0
Firefox < 110.1.0 Android 0
2,559 results · Feed
-
Critical 10.0
A compromised child process could have injected XBL Bindings into privileged CSS rules, resulting in arbitrary code exe…
-
Critical 9.8
Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption and we presume that …
-
Unscored —
When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox…
-
Critical 9.8
An invalid downcast from `nsHTMLDocument` to `nsIContent` could have lead to undefined behavior. This vulnerability aff…
-
High 7.5
The return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null…
-
Unscored —
Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed eviden…
-
Unscored —
The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts…
-
Medium 6.5
When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden…
-
Critical 9.1
Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have …
-
High 7.5
A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below vers…
-
Medium 6.5
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable …
-
Critical 9.8
A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious fi…
-
Medium 5.5
A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the servic…
-
Critical 9.8
An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a poten…
-
Unscored —
Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team rep…
-
Unscored —
Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. *Note: This atta…
-
Unscored —
Documents were incorrectly assuming an ordering of principal objects when ensuring we were loading an appropriately pri…
-
Unscored —
A maliciously crafted favicon could have led to an out of memory crash. This vulnerability affects Firefox < 113.
-
Unscored —
Service workers could reveal script base URL due to dynamic `import()`. This vulnerability affects Firefox < 113.
-
Medium 6.5
Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certifi…
-
Medium 6.5
If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and …
-
Medium 6.5
OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certi…
-
High 8.8
An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 1…
-
High 8.8
Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruptio…
-
High 8.8
Memory safety bugs present in Firefox 110. Some of these bugs showed evidence of memory corruption and we presume that …
-
High 8.8
If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a f…
-
Medium 6.5
Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website…
-
Medium 4.3
The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potent…
-
High 8.8
While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have…
-
Medium 6.5
When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual l…
-
Medium 6.5
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable n…
-
Medium 6.5
Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable c…
-
Unscored —
An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Fir…
-
Unscored —
In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to pot…
-
Unscored —
An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox <…
-
High 8.8
A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permis…
-
Unscored —
Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCr…
-
Unscored —
A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ES…
-
Unscored —
When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 11…
-
Unscored —
Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in …