Vendor
Mozilla
2,559 known vulnerabilities.
Products
Firefox 2,316
Thunderbird 1,814
Firefox ESR 712
Firefox for iOS 63
Firefox for Android 33
Focus for Android 17
Thunderbird ESR 13
Focus for iOS 13
NSS 6
Focus 3
WebThings Gateway 2
Mozilla Bleach 2
Hubs Cloud 2
Mozilla VPN 2
Node-convict 1
Network Security Services (NSS) 1
thin-vec 1
Mozilla VPN 2.28.0 1
hawk 1
rhino 1
Firefox for 1
geckodriver 1
common-voice 1
Convict 1
Bugzilla 1
Persona 1
Network Security Services 1
Nunjucks 1
Klar for iOS 1
neqo 1
Mozilla VPN iOS 1.0.7 1
Mozilla VPN Windows 1
Mozilla VPN Android 1.1.0 1
sccache 1
Mozilla VPN 2.16.1 1
PollBot 1
Thunderbird < 102.8 0
Thunderbird < 102.9 0
Thunderbird < 102.9.1 0
Firefox < 110.1.0 Android 0
2,559 results · Feed
-
Unscored —
An audio capture session can started under an incorrect origin from the site making the capture request. Users are stil…
-
Unscored —
WebExtensions can use request redirection and a "filterReponseData" filter to bypass host permission settings to redire…
-
Unscored —
If websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted. This can re…
-
Unscored —
A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of …
-
Unscored —
The screenshot images displayed in the Activity Stream page displayed when a new tab is opened is created from the meta…
-
Unscored —
The reader view will display cross-origin content when CORS headers are set to prohibit the loading of cross-origin con…
-
Unscored —
The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Andr…
-
Unscored —
A use-after-free vulnerability can occur when manipulating floating "first-letter" style elements, resulting in a poten…
-
Unscored —
A vulnerability in the notifications Push API where notifications can be sent through service workers by web content wi…
-
Unscored —
In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the "SEE_MASK_FLAG_NO_UI" flag associated with…
-
Unscored —
A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script. This results in a potential…
-
Unscored —
Redirection from an HTTP connection to a "data:" URL assigns the referring site's origin to the "data:" URL in some cir…
-
Unscored —
Private browsing mode leaves metadata information, such as URLs, for sites visited in "browser.db" and "browser.db-wal"…
-
Unscored —
Two use-after-free errors during DOM operations resulting in potentially exploitable crashes. This vulnerability affect…
-
Unscored —
Use-after-free while manipulating the "navigator" object within WebVR. Note: WebVR is not currently enabled by default.…
-
Unscored —
An issue where a "<select>" dropdown menu can be used to cover location bar content, resulting in potential spoofing at…
-
Unscored —
Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we pr…
-
Unscored —
WebExtensions can bypass security checks to load privileged URLs and potentially escape the WebExtension sandbox. This …
-
Unscored —
An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to privileged pages being allowed…
-
Unscored —
Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inlin…
-
Unscored —
A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage…
-
Unscored —
Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor. This vulnerabil…
-
Unscored —
Memory safety bugs were reported in Firefox 50.0.2. Some of these bugs showed evidence of memory corruption and we pres…
-
Unscored —
An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.
-
Unscored —
Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin. The rendering by the filter is v…
-
Unscored —
External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of…
-
High 7.5
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been di…
KEV Jun 22, 2023 -
Unscored —
A previously installed malicious Android application which defines a specific signature-level permissions used by Firef…
-
Unscored —
Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to verify whether a kno…
-
Unscored —
An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zo…
-
Unscored —
Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerabil…
-
Unscored —
An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in…
-
Unscored —
Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated…
-
Unscored —
A use-after-free during web animations when working with timelines resulting in a potentially exploitable crash. This v…
-
Unscored —
When a new Firefox profile is created on 64-bit Windows installations, the sandbox for 64-bit NPAPI plugins is not enab…
-
Unscored —
Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a…
-
Unscored —
A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amou…
-
Unscored —
The location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode, blocking its exiting, an…
-
Unscored —
The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin …
-
Unscored —
Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption…