Vendor
Mozilla
2,559 known vulnerabilities.
Products
Firefox 2,316
Thunderbird 1,814
Firefox ESR 712
Firefox for iOS 63
Firefox for Android 33
Focus for Android 17
Thunderbird ESR 13
Focus for iOS 13
NSS 6
Focus 3
WebThings Gateway 2
Mozilla Bleach 2
Hubs Cloud 2
Mozilla VPN 2
Node-convict 1
Network Security Services (NSS) 1
thin-vec 1
Mozilla VPN 2.28.0 1
hawk 1
rhino 1
Firefox for 1
geckodriver 1
common-voice 1
Convict 1
Bugzilla 1
Persona 1
Network Security Services 1
Nunjucks 1
Klar for iOS 1
neqo 1
Mozilla VPN iOS 1.0.7 1
Mozilla VPN Windows 1
Mozilla VPN Android 1.1.0 1
sccache 1
Mozilla VPN 2.16.1 1
PollBot 1
Thunderbird < 102.8 0
Thunderbird < 102.9 0
Thunderbird < 102.9.1 0
Firefox < 110.1.0 Android 0
2,559 results · Feed
-
Unscored —
Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as part of an IDN this…
-
Unscored —
The "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of libcurl, which an atta…
-
Unscored —
Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the ad…
-
Unscored —
Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affe…
-
Unscored —
A use-after-free vulnerability can occur in design mode when image objects are resized if objects referenced during the…
-
Unscored —
Memory safety bugs were reported in Firefox 56. Some of these bugs showed evidence of memory corruption and we presume …
-
Unscored —
SVG loaded through "<img>" tags can use "<meta>" tags within the SVG data to set cookies for that page. This vulnerabil…
-
Unscored —
RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affect…
-
Unscored —
The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users…
-
Unscored —
The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to be…
-
Unscored —
A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. …
-
Unscored —
A content security policy (CSP) "frame-ancestors" directive containing origins with paths allows for comparisons agains…
-
Unscored —
On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary…
-
Unscored —
The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it. …
-
Unscored —
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerpri…
-
Unscored —
Some Arabic and Indic vowel marker characters can be combined with Latin characters in a domain name to eclipse the non…
-
Unscored —
On Windows systems, if non-null-terminated strings are copied into the crash reporter for some specific registry keys, …
-
Unscored —
A use-after-free vulnerability in IndexedDB when one of its objects is destroyed in memory while a method on it is stil…
-
Unscored —
A use-after-free vulnerability during video control operations when a "<track>" element holds a reference to an older w…
-
Unscored —
During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for l…
-
Unscored —
The "instanceof" operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or …
-
Unscored —
A buffer overflow will occur when viewing a certificate in the certificate manager if the certificate has an extremely …
-
Unscored —
Response header name interning does not have same-origin protections and these headers are stored in a global registry.…
-
Unscored —
If a long user name is used in a username/password combination in a site URL (such as " http://UserName:Password@exampl…
-
Unscored —
Several fonts on OS X display some Tibetan and Arabic characters as whitespace. When used in the addressbar as part of …
-
Unscored —
The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violatio…
-
Unscored —
It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View -> Fee…
-
Unscored —
On Linux systems, if the content process is compromised, the sandbox broker will allow files to be truncated even thoug…
-
Unscored —
A buffer overflow can occur when manipulating Accessible Rich Internet Applications (ARIA) attributes within the DOM. T…
-
Unscored —
Mixed content blocking of insecure (HTTP) sub-resources in a secure (HTTPS) document was not correctly applied for reso…
-
Unscored —
Memory safety bugs were reported in Firefox 55. Some of these bugs showed evidence of memory corruption and we presume …
-
Unscored —
A vulnerability where the security wrapper does not deny access to some exposed properties using the deprecated "_expos…
-
Unscored —
A use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages d…
-
Unscored —
An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while …
-
Unscored —
Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes…
-
Unscored —
An out-of-bounds read in WebGL with a maliciously crafted "ImageInfo" object during WebGL operations. This vulnerabilit…
-
Unscored —
JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved …
-
Unscored —
On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will h…
-
Unscored —
Memory safety bugs were reported in Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2. Some of these bugs showed evide…
-
Unscored —
A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where…