1,814 results · Feed
-
Unscored —
When processing a message that contains multiple S/MIME signatures, a bug in the MIME processing code caused a null poi…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some o…
-
High 8.8
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are…
KEV Nov 3, 2021 -
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed ev…
-
Unscored —
Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could c…
-
Unscored —
Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race c…
-
Unscored —
When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unpri…
-
Unscored —
When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially explo…
-
Unscored —
The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was poss…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some o…
-
Unscored —
Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these enti…
-
Unscored —
If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call a…
-
Unscored —
By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned i…
-
Unscored —
A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploi…
-
Unscored —
An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This c…
-
Unscored —
Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was install…
-
Unscored —
When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequen…
-
Unscored —
When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a s…
-
Unscored —
Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/fo…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox…
-
Unscored —
A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters an…
-
Unscored —
Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instance…
-
Unscored —
Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating the…
-
Unscored —
A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. Thi…
-
Unscored —
It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a…
-
Unscored —
A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a va…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thund…
-
Unscored —
As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack …
-
Unscored —
If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has…
-
Unscored —CVE-2019-9816 Public exploit
A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, a…
-
Unscored —
Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal ima…
-
Unscored —
A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can…
-
Unscored —
A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a pote…
-
Unscored —
A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results …
-
Unscored —
A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main …
-
Unscored —
A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use,…
-
Unscored —
The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could…
-
Unscored —
A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a…
-
Unscored —
If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently…
-
Unscored —
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing ce…