Vendor
Mozilla
2,559 known vulnerabilities.
Products
Firefox 2,316
Thunderbird 1,814
Firefox ESR 712
Firefox for iOS 63
Firefox for Android 33
Focus for Android 17
Thunderbird ESR 13
Focus for iOS 13
NSS 6
Focus 3
WebThings Gateway 2
Mozilla Bleach 2
Hubs Cloud 2
Mozilla VPN 2
Node-convict 1
Network Security Services (NSS) 1
thin-vec 1
Mozilla VPN 2.28.0 1
hawk 1
rhino 1
Firefox for 1
geckodriver 1
common-voice 1
Convict 1
Bugzilla 1
Persona 1
Network Security Services 1
Nunjucks 1
Klar for iOS 1
neqo 1
Mozilla VPN iOS 1.0.7 1
Mozilla VPN Windows 1
Mozilla VPN Android 1.1.0 1
sccache 1
Mozilla VPN 2.16.1 1
PollBot 1
Thunderbird < 102.8 0
Thunderbird < 102.9 0
Thunderbird < 102.9.1 0
Firefox < 110.1.0 Android 0
2,559 results · Feed
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox…
-
Unscored —
A compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS) attack on content from any …
-
Unscored —
A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters an…
-
Unscored —
Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instance…
-
Unscored —
Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating the…
-
Unscored —
A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. Thi…
-
Unscored —
The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a use…
-
Unscored —
WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even wh…
-
Unscored —
A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using c…
-
Unscored —
A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash. This vulnerability aff…
-
Unscored —
Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as…
-
Unscored —
It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a…
-
Unscored —
The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from ma…
-
Unscored —
A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a va…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thund…
-
Unscored —
As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack …
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 66. Some of these bugs showed e…
-
Unscored —
If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has…
-
Unscored —CVE-2019-9816 Public exploit
A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, a…
-
Unscored —
Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal ima…
-
Unscored —
A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can…
-
Unscored —
A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a pote…
-
Unscored —
A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results …
-
Unscored —
A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers. This result…
-
Unscored —
A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main …
-
Unscored —
A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use,…
-
Unscored —
The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could…
-
Unscored —
A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a…
-
Unscored —
A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when …
-
Unscored —
Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for downloa…
-
Unscored —
If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installe…
-
Unscored —
If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently…
-
Unscored —
A malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page na…
-
Unscored —
A hyperlink using the res: protocol can be used to open local files at a known location in Internet Explorer if a user …
-
Unscored —
The default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS) attacks. This defaul…
-
Unscored —
A hyperlink using protocols associated with Internet Explorer, such as IE.HTTP:, can be used to open local files at a k…
-
Unscored —
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing ce…
-
Unscored —
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when proc…
-
Unscored —CVE-2019-11705 Public exploit
A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processi…
-
Unscored —CVE-2019-11706 Public exploit
A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when pr…