Vendor
Mozilla
2,559 known vulnerabilities.
Products
Firefox 2,316
Thunderbird 1,814
Firefox ESR 712
Firefox for iOS 63
Firefox for Android 33
Focus for Android 17
Thunderbird ESR 13
Focus for iOS 13
NSS 6
Focus 3
WebThings Gateway 2
Mozilla Bleach 2
Hubs Cloud 2
Mozilla VPN 2
Node-convict 1
Network Security Services (NSS) 1
thin-vec 1
Mozilla VPN 2.28.0 1
hawk 1
rhino 1
Firefox for 1
geckodriver 1
common-voice 1
Convict 1
Bugzilla 1
Persona 1
Network Security Services 1
Nunjucks 1
Klar for iOS 1
neqo 1
Mozilla VPN iOS 1.0.7 1
Mozilla VPN Windows 1
Mozilla VPN Android 1.1.0 1
sccache 1
Mozilla VPN 2.16.1 1
PollBot 1
Thunderbird < 102.8 0
Thunderbird < 102.9 0
Thunderbird < 102.9.1 0
Firefox < 110.1.0 Android 0
2,559 results · Feed
-
Unscored —
A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocati…
-
Unscored —
The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), …
-
Unscored —
In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on…
-
Unscored —
A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by maliciou…
-
Unscored —
A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driv…
-
Unscored —
Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBit…
-
Unscored —
A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and…
-
Unscored —
When arbitrary text is sent over an FTP connection and a page reload is initiated, it is possible to create a modal ale…
-
Unscored —
If WebRTC permission is requested from documents with data: or blob: URLs, the permission notifications do not properly…
-
Unscored —
If the source for resources on a page is through an FTP connection, it is possible to trigger a series of modal alert m…
-
Unscored —
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check…
-
Unscored —CVE-2019-9813 Public exploit
Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arb…
-
Unscored —
Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph func…
-
Unscored —
Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph.
-
Unscored —
Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function.
-
Unscored —
Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor.
-
Unscored —
Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function.
-
Unscored —
Heap-based Buffer Overflow in Graphite2 library in Firefox before 54 in lz4::decompress function.
-
Unscored —
A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D a…
-
Unscored —
A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location proper…
-
Unscored —
When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted conte…
-
Unscored —
WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions gra…
-
Unscored —
Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the U…
-
Unscored —
A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select eleme…
-
Unscored —
A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a ra…
-
Unscored —
A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on…
-
Unscored —
Some special resource URIs will cause a non-exploitable crash if loaded with optional parameters following a '?' in the…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs sh…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some o…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 63. Some of these bugs showed e…
-
Unscored —
A WebExtension can request access to local files without the warning prompt stating that the extension will "Access you…
-
Unscored —
A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, …
-
Unscored —
By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through …
-
Unscored —
When a new protocol handler is registered, the API accepts a title argument which can be used to mislead users about wh…
-
Unscored —
If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not di…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 62. Some of these bugs showed e…
-
Unscored —
The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when…
-
Unscored —
A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an i…
-
Unscored —
By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and byp…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some o…