Vendor
Mozilla
2,559 known vulnerabilities.
Products
Firefox 2,316
Thunderbird 1,814
Firefox ESR 712
Firefox for iOS 63
Firefox for Android 33
Focus for Android 17
Thunderbird ESR 13
Focus for iOS 13
NSS 6
Focus 3
WebThings Gateway 2
Mozilla Bleach 2
Hubs Cloud 2
Mozilla VPN 2
Node-convict 1
Network Security Services (NSS) 1
thin-vec 1
Mozilla VPN 2.28.0 1
hawk 1
rhino 1
Firefox for 1
geckodriver 1
common-voice 1
Convict 1
Bugzilla 1
Persona 1
Network Security Services 1
Nunjucks 1
Klar for iOS 1
neqo 1
Mozilla VPN iOS 1.0.7 1
Mozilla VPN Windows 1
Mozilla VPN Android 1.1.0 1
sccache 1
Mozilla VPN 2.16.1 1
PollBot 1
Thunderbird < 102.8 0
Thunderbird < 102.9 0
Thunderbird < 102.9.1 0
Firefox < 110.1.0 Android 0
2,559 results · Feed
-
Unscored —
A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later writers will overflow the bu…
-
Unscored —
A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability a…
-
Unscored —
HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will …
-
Unscored —
An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking iss…
-
Unscored —
Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corru…
-
Unscored —
A mechanism where disruption of the loading of a new web page can cause the previous page's favicon and SSL indicator t…
-
Unscored —
This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Mainte…
-
Unscored —
A previously installed malicious Android application with same signature-level permissions as Firefox can intercept Aut…
-
Unscored —
Memory safety bugs were reported in Firefox 49. Some of these bugs showed evidence of memory corruption and we presume …
-
Unscored —
The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the upd…
-
Unscored —
A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability aff…
-
Unscored —
When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be a…
-
Unscored —
During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Fir…
-
Unscored —
A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially…
-
Unscored —
A potentially exploitable use-after-free crash during actor destruction with service workers. This issue does not affec…
-
Unscored —
Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the c…
-
Unscored —
The Firefox installer on Windows can be made to load malicious DLL files stored in the same directory as the installer …
-
Unscored —
An error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can…
-
Unscored —
A vulnerability where WebExtensions can download and attempt to open a file of some non-executable file types. This can…
-
Unscored —
If a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for "<link>" …
-
Unscored —
When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar.…
-
Unscored —
A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and…
-
Unscored —
An error in the "WindowsDllDetourPatcher" where a RWX ("Read/Write/Execute") 4k block is allocated but never protected,…
-
Unscored —
A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" object has been fre…
-
Unscored —
A use-after-free and use-after-scope vulnerability when logging errors from headers for XML HTTP Requests (XHR). This c…
-
Unscored —
Punycode format text will be displayed for entire qualified international domain names in some instances when a sub-dom…
-
Unscored —
Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3. Some of these bugs showed evidence of memory corru…
-
Unscored —
The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the lo…
-
Unscored —
When an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit t…
-
Unscored —
The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data usin…
-
Unscored —
An attack using manipulation of "updater.ini" contents, used by the Mozilla Windows Updater, and privilege escalation t…
-
Unscored —
A use-after-free vulnerability can occur when the layer manager is freed too early when rendering specific SVG content,…
-
Unscored —
A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) eleme…
-
Unscored —
A spoofing vulnerability can occur when a page switches to fullscreen mode without user notification, allowing a fake a…
-
Unscored —
The combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute o…
-
Unscored —
Inside the JavaScript parser, a cast of an integer to a narrower type can result in data read from outside the buffer b…
-
Unscored —
A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements. This results in a p…
-
Unscored —
A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This results in a potent…
-
Unscored —
A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element. If thes…
-
Unscored —
If a server sends two Strict-Transport-Security (STS) headers for a single connection, they will be rejected as invalid…