Vendor
Mozilla
2,559 known vulnerabilities.
Products
Firefox 2,316
Thunderbird 1,814
Firefox ESR 712
Firefox for iOS 63
Firefox for Android 33
Focus for Android 17
Thunderbird ESR 13
Focus for iOS 13
NSS 6
Focus 3
WebThings Gateway 2
Mozilla Bleach 2
Hubs Cloud 2
Mozilla VPN 2
Node-convict 1
Network Security Services (NSS) 1
thin-vec 1
Mozilla VPN 2.28.0 1
hawk 1
rhino 1
Firefox for 1
geckodriver 1
common-voice 1
Convict 1
Bugzilla 1
Persona 1
Network Security Services 1
Nunjucks 1
Klar for iOS 1
neqo 1
Mozilla VPN iOS 1.0.7 1
Mozilla VPN Windows 1
Mozilla VPN Android 1.1.0 1
sccache 1
Mozilla VPN 2.16.1 1
PollBot 1
Thunderbird < 102.8 0
Thunderbird < 102.9 0
Thunderbird < 102.9.1 0
Firefox < 110.1.0 Android 0
2,559 results · Feed
-
Medium 6.5
In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. …
-
Medium 6.5
The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to includ…
-
Medium 6.5
When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conju…
-
High 8.8
SVG's <code><use></code> element could have been used to load unexpected content that could have executed script …
-
Medium 6.5
When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multipl…
-
Medium 5.4
When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the exi…
-
Medium 4.3
When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both…
-
High 8.8
If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could hav…
-
Medium 6.5
After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and pot…
-
Medium 6.5
<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on diffe…
-
Critical 9.8
The search term could have been specified externally to trigger SQL injection. This vulnerability affects Firefox for i…
-
High 8.8CVE-2022-1529 EPSS 18%
An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScr…
-
High 8.8
A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or…
-
Medium 6.5
An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which wa…
-
High 7.5
A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-free vulnerabili…
-
High 8.8
Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Fire…
-
High 8.8
Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR…
-
Medium 4.3
A website that had permission to access the microphone could record audio without the audio notification being shown. T…
-
Medium 6.5
An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was z…
-
High 8.8
Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in F…
-
Medium 6.5
When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have …
-
Medium 6.5
Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. Th…
-
Medium 4.3
The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This…
-
Medium 6.1
When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.<br>*Not…
-
Critical 9.8
Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bu…
-
Medium 6.5
The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instruction…
-
Medium 6.1
An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could…
-
Medium 6.1
Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affe…
-
High 8.8
Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level orig…
-
High 7.5
When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates th…
-
Medium 5.3
When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerabilit…
-
Medium 4.3
When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of pre…
-
Medium 6.1
When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus l…
-
Medium 5.5
When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to un…
-
Critical 9.8
Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs …
-
Medium 6.5
When visiting a website with an overly long URL, the user interface would start to hang. Due to session restore, this c…
-
Medium 6.5
When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resultin…
-
Critical 9.8
Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Team reported …
-
Medium 4.3
If array shift operations are not used, the Garbage Collector may have become confused about valid objects. This vulner…
-
High 8.8
When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly bei…