Vulnerabilities in mozilla
2,453 resultsCVE-2022-34481HIGHIn the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the number of elements to replEPSS 0.8%CVE-2024-11693CRITICALThe executable file warning was not presented when downloading .library-ms files.
*Note: This issue only affected Windows operating systemEPSS 0.8%CVE-2021-29968—When drawing text onto a canvas with WebRender disabled, an out of bounds read could occur. *This bug only affects Firefox on Windows. OtherEPSS 0.8%CVE-2021-38499—Mozilla developers reported memory safety bugs present in Firefox 92. Some of these bugs showed evidence of memory corruption and we presumeEPSS 0.8%CVE-2022-45410MEDIUMWhen a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownEPSS 0.8%CVE-2022-46872HIGHAn attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC mesEPSS 0.8%CVE-2017-7808—A content security policy (CSP) "frame-ancestors" directive containing origins with paths allows for comparisons against those paths insteadEPSS 0.8%CVE-2023-4576—Integer Overflow in RecordedSourceSurfaceCreationEPSS 0.8%CVE-2023-0767HIGHAn attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributesEPSS 0.8%CVE-2021-29964—A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds reEPSS 0.8%CVE-2021-23997—Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We presume that with enoEPSS 0.8%CVE-2024-3863CRITICALThe executable file warning was not presented when downloading .xrm-ms files.
*Note: This issue only affected Windows operating systems. OEPSS 0.8%CVE-2021-29973—Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This was corrected to require user interEPSS 0.8%CVE-2021-29956—OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local diEPSS 0.8%CVE-2024-10466HIGHBy sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive.EPSS 0.8%CVE-2024-11697HIGHWhen handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialogEPSS 0.8%CVE-2026-6758HIGHUse-after-free in the JavaScript: WebAssembly componentEPSS 0.8%CVE-2022-22760MEDIUMWhen importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> respEPSS 0.8%CVE-2023-5721—It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient actiEPSS 0.8%CVE-2024-5696HIGHBy manipulating the text in an `<input>` tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash.EPSS 0.8%