Vulnerabilidades em Mozilla

2.453 resultados
Análise Vexday

Com 1.857 CVEs catalogadas e 189 classificadas como críticas, o histórico de vulnerabilidades da Mozilla reflete a complexidade de manter um navegador amplamente adotado. A taxa de exploração ativa — 9 entradas no CISA KEV, representando 0,48% do total — está em linha com a média geral do catálogo, o que indica um nível de exposição operacional compatível com o setor, sem desvio negativo expressivo. O tipo de falha mais recorrente é CWE-416 (use-after-free), uma classe de vulnerabilidade de memória com alto potencial de execução de código, e a CVE mais perigosa atualmente ativa, CVE-2016-9079, apresenta EPSS de 0,8792 — valor elevado que sugere probabilidade significativa de exploração continuada. Os 144 CVEs surgidos nos últimos 90 dias e a existência de 27 provas de conceito públicas reforçam a necessidade de monitoramento contínuo e priorização ágil de patches para ambientes que dependem de produtos Mozilla.

CVE-2016-9070—A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage in limited JavaScripEPSS 1.9%CVE-2020-6814—Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evidence of memory corruptEPSS 1.9%CVE-2019-17021—During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses fromEPSS 1.9%CVE-2017-5471—Memory safety bugs were reported in Firefox 53. Some of these bugs showed evidence of memory corruption and we presume that with enough effoEPSS 1.9%CVE-2020-12420—When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and EPSS 1.9%CVE-2019-9790—A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then EPSS 1.9%CVE-2021-29951—The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access EPSS 1.9%CVE-2018-12375—Memory safety bugs present in Firefox 61. Some of these bugs showed evidence of memory corruption and we presume that with enough effort thaEPSS 1.8%CVE-2020-12421—When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by EPSS 1.8%CVE-2016-9071—Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to verify whether a known site is within a uEPSS 1.8%CVE-2016-9067—Two use-after-free errors during DOM operations resulting in potentially exploitable crashes. This vulnerability affects Firefox < 50.EPSS 1.8%CVE-2018-12381—Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message's mail columns are EPSS 1.8%CVE-2021-43542—Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. ThiEPSS 1.8%CVE-2019-9804—In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause theEPSS 1.8%CVE-2017-5413—A segmentation fault can occur during some bidirectional layout operations. This vulnerability affects Firefox < 52 and Thunderbird < 52.EPSS 1.8%CVE-2019-9815—If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.EPSS 1.8%CVE-2016-9078—Redirection from an HTTP connection to a "data:" URL assigns the referring site's origin to the "data:" URL in some circumstances. This can EPSS 1.8%CVE-2018-12364—NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 rEPSS 1.8%CVE-2019-11727—A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures whenEPSS 1.8%CVE-2021-43536—Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability affEPSS 1.8%