Vendor
Mozilla
2,559 known vulnerabilities.
Products
Firefox 2,316
Thunderbird 1,814
Firefox ESR 712
Firefox for iOS 63
Firefox for Android 33
Focus for Android 17
Thunderbird ESR 13
Focus for iOS 13
NSS 6
Focus 3
WebThings Gateway 2
Mozilla Bleach 2
Hubs Cloud 2
Mozilla VPN 2
Node-convict 1
Network Security Services (NSS) 1
thin-vec 1
Mozilla VPN 2.28.0 1
hawk 1
rhino 1
Firefox for 1
geckodriver 1
common-voice 1
Convict 1
Bugzilla 1
Persona 1
Network Security Services 1
Nunjucks 1
Klar for iOS 1
neqo 1
Mozilla VPN iOS 1.0.7 1
Mozilla VPN Windows 1
Mozilla VPN Android 1.1.0 1
sccache 1
Mozilla VPN 2.16.1 1
PollBot 1
Thunderbird < 102.8 0
Thunderbird < 102.9 0
Thunderbird < 102.9.1 0
Firefox < 110.1.0 Android 0
2,559 results · Feed
-
Unscored —
A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library, used f…
-
Unscored —
The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 according to the N…
-
Unscored —
The "Mark of the Web" was not correctly saved on Windows when files with very long names were downloaded from the Inter…
-
Unscored —
Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local "file:" URLs,…
-
Unscored —
On Windows systems, the logger run by the Windows updater deletes the file "update.log" before it runs in order to writ…
-
Unscored —
The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page sou…
-
Unscored —
Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be …
-
Unscored —
A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressba…
-
Unscored —
JavaScript in the "about:webrtc" page is not sanitized properly being assigned to "innerHTML". Data on this page is sup…
-
Unscored —
An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style dat…
-
Unscored —
A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image c…
-
Unscored —
When a page's content security policy (CSP) header contains a "sandbox" directive, other directives are ignored. This r…
-
Unscored —
It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The …
-
Unscored —
The destructor function for the "WindowsDllDetourPatcher" class can be re-purposed by malicious code in concert with an…
-
Unscored —
If web content on a page is dragged onto portions of the browser UI, such as the tab bar, links can be opened that othe…
-
Unscored —
File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing a…
-
Unscored —
Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4. Some of these bugs showed evidence of memory corru…
-
Unscored —
A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable crash. This vuln…
-
Unscored —
Memory safety bugs were reported in Firefox 54. Some of these bugs showed evidence of memory corruption and we presume …
-
Unscored —
A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the d…
-
Unscored —
A "data:" URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page, allowing for …
-
Unscored —
WebExtensions could use popups and panels in the extension UI to load an "about:" privileged URL, violating security ch…
-
Unscored —
A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are freed when still…
-
Unscored —
A use-after-free vulnerability can occur in WebSockets when the object holding the connection is freed before the disco…
-
Unscored —
An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for this vulnerability d…
-
Unscored —
An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitab…
-
Unscored —
A use-after-free vulnerability occurs when redirecting focus handling which results in a potentially exploitable crash.…
-
Unscored —
Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in ho…
-
Unscored —
Proxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with the full URL path whic…
-
Unscored —
When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the…
-
Unscored —
URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, all…
-
Unscored —
A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions. This…
-
Unscored —
Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. Th…
-
Unscored —
A mechanism to bypass file system access protections in the sandbox using the file system request constructor through a…
-
Unscored —
A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. I…
-
Unscored —
A malicious site could spoof the contents of the print preview window if popup windows are enabled, resulting in user c…
-
Unscored —
Android intents can be used to launch Firefox for Android in reader mode with a user specified URL. This allows an atta…
-
Unscored —
A potential use-after-free found through fuzzing during DOM manipulation of SVG content. This vulnerability affects Thu…
-
Unscored —
The "export" function in the Certificate Viewer can force local filesystem navigation when the "common name" in a certi…
-
Unscored —
Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-…