Vulnerabilities in mozilla
2,453 resultsCVE-2023-4055—When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent witEPSS 0.7%CVE-2021-29993—Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI spoofs. *This bug onlyEPSS 0.7%CVE-2019-17002—If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was nEPSS 0.7%CVE-2023-32207HIGHA missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerabiEPSS 0.7%CVE-2026-4686HIGHIncorrect boundary conditions in the Graphics: Canvas2D componentEPSS 0.7%CVE-2020-26979—When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event andEPSS 0.7%CVE-2022-26383MEDIUMWhen resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This vulnerability affectEPSS 0.7%CVE-2024-11699HIGHMemory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence of memory corruptionEPSS 0.7%CVE-2020-15649—Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of EPSS 0.7%CVE-2022-34485CRITICALMozilla developers Bryce Seager van Dyk and the Mozilla Fuzzing Team reported potential vulnerabilities present in Firefox 101. Some of thesEPSS 0.7%CVE-2024-8384CRITICALThe JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two paEPSS 0.7%CVE-2023-28176HIGHMemory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruption and we presume thatEPSS 0.7%CVE-2021-23996—By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofingEPSS 0.7%CVE-2023-5170—In canvas rendering, a compromised content process could have caused a surface to change unexpectedly, leading to a memory leak of a privileEPSS 0.7%CVE-2020-6817HIGHbleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with anEPSS 0.7%CVE-2024-1546HIGHWhen storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memoEPSS 0.7%CVE-2022-45416MEDIUMKeyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as PriEPSS 0.7%CVE-2024-0753MEDIUMIn specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox < 122, Firefox ESR <EPSS 0.7%CVE-2023-25735HIGHCross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment EPSS 0.7%CVE-2023-37206—Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a malicious website. TEPSS 0.7%