Vulnerabilities in mozilla
2,453 resultsCVE-2019-9799—Insufficient bounds checking of data during inter-process communication might allow a compromised content process to be able to read memory EPSS 1.1%CVE-2019-11728—The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that the accessible to a usEPSS 1.1%CVE-2023-5171—During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes,EPSS 1.1%CVE-2023-5168CRITICALA compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potenEPSS 1.1%CVE-2017-7763—Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as part of an IDN this can be used for domaEPSS 1.1%CVE-2021-23984—A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fEPSS 1.1%CVE-2011-2668—Mozilla Firefox through 1.5.0.3 has a vulnerability in processing the content-length headerEPSS 1.1%CVE-2017-7770—A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendereEPSS 1.1%CVE-2019-9797—Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the imageEPSS 1.1%CVE-2021-38495—Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. Some of these bugs showed evidence of memory corruption and wEPSS 1.1%CVE-2024-2607HIGHReturn registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:* This issue only affected Armv7-A sEPSS 1.1%CVE-2022-31736CRITICALA malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects ThunderEPSS 1.1%CVE-2020-6808—When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is thenEPSS 1.1%CVE-2022-29167HIGHReDoS vulnerability in header parsing in hawkEPSS 1.1%CVE-2021-38502—Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercEPSS 1.1%CVE-2020-15647—A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage, leading to sensitiveEPSS 1.1%CVE-2021-23976—When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed deEPSS 1.1%CVE-2023-5169—A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds write, leading to a poteEPSS 1.1%CVE-2018-18499—A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a reEPSS 1.1%CVE-2023-6859—A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability affects Firefox ESR < 115.6, ThunderbEPSS 1.1%