Vulnerabilities in mozilla
2,453 resultsCVE-2021-43535—A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a poteEPSS 1.1%CVE-2023-5731—Memory safety bugs present in Firefox 118. Some of these bugs showed evidence of memory corruption and we presume that with enough effort soEPSS 1.1%CVE-2021-23981—A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memoEPSS 1.1%CVE-2018-5116—WebExtensions with the "ActiveTab" permission are able to access frames hosted within the active tab even if the frames are cross-origin. MaEPSS 1.1%CVE-2020-15648—Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This EPSS 1.1%CVE-2019-17020—If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not beEPSS 1.1%CVE-2017-7817—A spoofing vulnerability can occur when a page switches to fullscreen mode without user notification, allowing a fake address bar to be dispEPSS 1.1%CVE-2017-7815—On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will have an arbitrary domaEPSS 1.1%CVE-2018-12406—Mozilla developers and community members reported memory safety bugs present in Firefox 63. Some of these bugs showed evidence of memory corEPSS 1.1%CVE-2018-5108—A Blob URL can violate origin attribute segregation, allowing it to be accessed from a private browsing tab and for data to be passed betweeEPSS 1.1%CVE-2019-9802—If a Sandbox content process is compromised, it can initiate an FTP download which will then use a child process to render the downloaded daEPSS 1.1%CVE-2018-12370—In Reader View SameSite cookie protections are not checked on exiting. This allows for a payload to be triggered when Reader View is exited EPSS 1.1%CVE-2019-11724—Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been retired and now rediEPSS 1.1%CVE-2021-24002—When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and EPSS 1.1%CVE-2023-4046—In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilationEPSS 1.1%CVE-2021-29982—Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a singlEPSS 1.1%CVE-2017-7839—Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasteEPSS 1.1%CVE-2016-9903—Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resoEPSS 1.1%CVE-2017-7840—JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved bookmarks. If the resEPSS 1.1%CVE-2020-15669—When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. This results in a useEPSS 1.1%