Vulnerabilities in mozilla
2,453 resultsCVE-2020-6797—By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer.EPSS 1.5%CVE-2021-23961—Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosEPSS 1.5%CVE-2020-6807—When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> task may have been executed after the strEPSS 1.5%CVE-2019-11764—Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed eEPSS 1.5%CVE-2017-5384—Proxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with the full URL path which exposes more informEPSS 1.5%CVE-2021-38498—During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potEPSS 1.5%CVE-2020-12391—Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scriEPSS 1.5%CVE-2022-40959MEDIUMDuring iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissionEPSS 1.5%CVE-2016-5292—During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Firefox < 50.EPSS 1.5%CVE-2017-7804—The destructor function for the "WindowsDllDetourPatcher" class can be re-purposed by malicious code in concert with another vulnerability tEPSS 1.5%CVE-2021-43543—Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vuEPSS 1.5%CVE-2021-29985—A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. This vulnerabilityEPSS 1.5%CVE-2019-11744—Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is poEPSS 1.5%CVE-2019-11738—If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of anyEPSS 1.4%CVE-2018-12371—An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. TEPSS 1.4%CVE-2018-5110—If cursor visibility is toggled by script using from 'none' to an image and back through script, the cursor will be rendered temporarily invEPSS 1.4%CVE-2017-7833—Some Arabic and Indic vowel marker characters can be combined with Latin characters in a domain name to eclipse the non-Latin character withEPSS 1.4%CVE-2018-5121—Low descenders on some Tibetan characters in several fonts on OS X are clipped when rendered in the addressbar. When used as part of an InteEPSS 1.4%CVE-2017-7837—SVG loaded through "<img>" tags can use "<meta>" tags within the SVG data to set cookies for that page. This vulnerability affects Firefox <EPSS 1.4%CVE-2017-5463—Android intents can be used to launch Firefox for Android in reader mode with a user specified URL. This allows an attacker to spoof the conEPSS 1.4%