Vendor
Mozilla
2,559 known vulnerabilities.
Products
Firefox 2,316
Thunderbird 1,814
Firefox ESR 712
Firefox for iOS 63
Firefox for Android 33
Focus for Android 17
Thunderbird ESR 13
Focus for iOS 13
NSS 6
Focus 3
WebThings Gateway 2
Mozilla Bleach 2
Hubs Cloud 2
Mozilla VPN 2
Node-convict 1
Network Security Services (NSS) 1
thin-vec 1
Mozilla VPN 2.28.0 1
hawk 1
rhino 1
Firefox for 1
geckodriver 1
common-voice 1
Convict 1
Bugzilla 1
Persona 1
Network Security Services 1
Nunjucks 1
Klar for iOS 1
neqo 1
Mozilla VPN iOS 1.0.7 1
Mozilla VPN Windows 1
Mozilla VPN Android 1.1.0 1
sccache 1
Mozilla VPN 2.16.1 1
PollBot 1
Thunderbird < 102.8 0
Thunderbird < 102.9 0
Thunderbird < 102.9.1 0
Firefox < 110.1.0 Android 0
2,559 results · Feed
-
High 8.8
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allo…
KEV May 23, 2022 -
Critical 10.0
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can resul…
KEV May 23, 2022 -
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some o…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 67. Some of these bugs showed e…
-
Unscored —
When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages …
-
Unscored —
POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS require…
-
Unscored —
A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting …
-
Unscored —
Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in so…
-
Unscored —
Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and l…
-
Unscored —
Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such …
-
Unscored —
A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being use…
-
Unscored —
Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on…
-
Unscored —
When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bo…
-
Unscored —
Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering p…
-
Unscored —
The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar. This allows for doma…
-
Unscored —
A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the …
-
Unscored —
Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been…
-
Unscored —
When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation i…
-
Unscored —
A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1…
-
Unscored —
The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that t…
-
Unscored —
Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before …
-
Unscored —
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other fi…
-
Unscored —CVE-2018-12404 EPSS 44%
A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content…
-
Unscored —
A third party website can access information available to a user with access to a restricted bug entry using the image …
-
Unscored —
A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed …
-
Unscored —
The about:crashcontent and about:crashparent pages can be triggered by web content. These pages are used to crash the l…
-
Unscored —
A crash can occur when processing a crafted S/MIME message or an XPI package containing a crafted signature. This can b…
-
Unscored —
Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImag…
-
Unscored —
A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digi…
-
Unscored —
A use-after-free vulnerability can occur while playing a sound notification in Thunderbird. The memory storing the soun…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 65. Some of these bugs showed e…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thund…
-
Unscored —
The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects …
-
Unscored —
A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, …
-
Unscored —
Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local applicatio…
-
Unscored —
Insufficient bounds checking of data during inter-process communication might allow a compromised content process to be…
-
Unscored —
A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre miti…
-
Unscored —
On Android systems, Firefox can load a library from APITRACE_LIB, which is writable by all users and applications. This…
-
Unscored —
The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script durin…
-
Unscored —
If a Sandbox content process is compromised, it can initiate an FTP download which will then use a child process to ren…