Vendor
Mozilla
2,559 known vulnerabilities.
Products
Firefox 2,316
Thunderbird 1,814
Firefox ESR 712
Firefox for iOS 63
Firefox for Android 33
Focus for Android 17
Thunderbird ESR 13
Focus for iOS 13
NSS 6
Focus 3
WebThings Gateway 2
Mozilla Bleach 2
Hubs Cloud 2
Mozilla VPN 2
Node-convict 1
Network Security Services (NSS) 1
thin-vec 1
Mozilla VPN 2.28.0 1
hawk 1
rhino 1
Firefox for 1
geckodriver 1
common-voice 1
Convict 1
Bugzilla 1
Persona 1
Network Security Services 1
Nunjucks 1
Klar for iOS 1
neqo 1
Mozilla VPN iOS 1.0.7 1
Mozilla VPN Windows 1
Mozilla VPN Android 1.1.0 1
sccache 1
Mozilla VPN 2.16.1 1
PollBot 1
Thunderbird < 102.8 0
Thunderbird < 102.9 0
Thunderbird < 102.9.1 0
Firefox < 110.1.0 Android 0
2,559 results · Feed
-
Unscored —
If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses pr…
-
Unscored —
A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. *Thi…
-
Unscored —
If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host - irrespecti…
-
Unscored —
A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library. Updating the library …
-
Unscored —
Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This was corrected …
-
Unscored —
When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page woul…
-
Unscored —
Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or forma…
-
Unscored —
Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bu…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence of memory corr…
-
Unscored —
Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd p…
-
Unscored —
Hubs Cloud allows users to download shared content, specifically HTML and JS, which could allow javascript execution in…
-
Unscored —
If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her ke…
-
Unscored —
Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may cre…
-
Unscored —
An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker …
-
Unscored —
A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vu…
-
Unscored —
When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with…
-
Unscored —
By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, re…
-
Unscored —
Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We …
-
Unscored —
Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS pa…
-
Unscored —
If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and g…
-
Unscored —
A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when…
-
Unscored —
A compromised content process could have performed session history manipulations it should not have been able to due to…
-
Unscored —
When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been int…
-
Unscored —
Lack of escaping allowed HTML injection when a webpage was viewed in Reader View. While a Content Security Policy preve…
-
Unscored —
The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash…
-
Unscored —
Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking r…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 87. Some of these bugs showed e…
-
Unscored —
Signatures are written to disk before and read during verification, which might be subject to a race condition when a m…
-
Unscored —
When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to op…
-
Unscored —
Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task. If the task…
-
Unscored —
The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal…
-
Unscored —
When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that …
-
Unscored —
A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the c…
-
Unscored —
Proxy functionality built into Hubs Cloud’s Reticulum software allowed access to internal URLs, including the metadata …
-
Unscored —
A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary …
-
Unscored —
OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted o…
-
Unscored —
If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional un…
-
Unscored —
When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to…
-
Unscored —
When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully pre…
-
Unscored —
Firefox used to cache the last filename used for printing a file. When generating a filename for printing, Firefox usua…