Vendor
Mozilla
2,559 known vulnerabilities.
Products
Firefox 2,316
Thunderbird 1,814
Firefox ESR 712
Firefox for iOS 63
Firefox for Android 33
Focus for Android 17
Thunderbird ESR 13
Focus for iOS 13
NSS 6
Focus 3
WebThings Gateway 2
Mozilla Bleach 2
Hubs Cloud 2
Mozilla VPN 2
Node-convict 1
Network Security Services (NSS) 1
thin-vec 1
Mozilla VPN 2.28.0 1
hawk 1
rhino 1
Firefox for 1
geckodriver 1
common-voice 1
Convict 1
Bugzilla 1
Persona 1
Network Security Services 1
Nunjucks 1
Klar for iOS 1
neqo 1
Mozilla VPN iOS 1.0.7 1
Mozilla VPN Windows 1
Mozilla VPN Android 1.1.0 1
sccache 1
Mozilla VPN 2.16.1 1
PollBot 1
Thunderbird < 102.8 0
Thunderbird < 102.9 0
Thunderbird < 102.9.1 0
Firefox < 110.1.0 Android 0
2,559 results · Feed
-
High 8.8
A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further…
-
Medium 6.5
An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so b…
-
Critical 9.8
Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs prese…
-
Medium 6.5
An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the…
-
Medium 6.5
Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. T…
-
Critical 9.8
A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerab…
-
Medium 6.5
Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header.…
-
Critical 9.8
A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially e…
-
High 8.8
On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and …
-
High 7.8
When saving or opening an email attachment on macOS, Thunderbird did not set attribute com.apple.quarantine on the rece…
-
High 8.1
If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the <code>meta</code> ta…
-
Medium 4.3
When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to…
-
Unscored —
When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute …
-
Medium 5.5
An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnera…
-
Medium 6.5
An OpenPGP digital signature includes information about the date when the signature was created. When displaying an ema…
-
High 8.8CVE-2022-2200 EPSS 24%
If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScr…
-
High 8.8
Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs …
-
High 8.8
Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs …
-
High 8.6
An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clip…
-
High 8.8
An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited. This vulnerability a…
-
Medium 6.5
The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a us…
-
High 8.8
An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploit…
-
High 8.8
A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious ex…
-
Critical 9.8
A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Fire…
-
High 8.8
Because Firefox did not implement the <code>unsafe-hashes</code> CSP directive, an attacker who was able to inject mark…
-
High 8.8
Mozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team reported memory safet…
-
Medium 6.5
A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*:…
-
High 8.8
Mozilla developers Timothy Nikkel, Ashley Hale, and the Mozilla Fuzzing Team reported memory safety bugs present in Fir…
-
Medium 4.3
By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential use…
-
High 8.8
Mozilla developers and community members Lukas Bernhard, Gabriele Svelto, Randell Jesup, and the Mozilla Fuzzing Team r…
-
Medium 6.5
When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the S…
-
Medium 6.5
If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server t…
-
High 8.8
Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some …
-
High 7.8
When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox…
-
Critical 9.8
If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while refer…
-
High 8.1
If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a…
-
Medium 6.5
Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen withou…
-
High 8.8
The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> …
-
Medium 6.5
Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for…
-
Medium 6.5
Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seei…