Vulnerabilidades em Mozilla

2.453 resultados
Análise Vexday

Com 1.857 CVEs catalogadas e 189 classificadas como críticas, o histórico de vulnerabilidades da Mozilla reflete a complexidade de manter um navegador amplamente adotado. A taxa de exploração ativa — 9 entradas no CISA KEV, representando 0,48% do total — está em linha com a média geral do catálogo, o que indica um nível de exposição operacional compatível com o setor, sem desvio negativo expressivo. O tipo de falha mais recorrente é CWE-416 (use-after-free), uma classe de vulnerabilidade de memória com alto potencial de execução de código, e a CVE mais perigosa atualmente ativa, CVE-2016-9079, apresenta EPSS de 0,8792 — valor elevado que sugere probabilidade significativa de exploração continuada. Os 144 CVEs surgidos nos últimos 90 dias e a existência de 27 provas de conceito públicas reforçam a necessidade de monitoramento contínuo e priorização ágil de patches para ambientes que dependem de produtos Mozilla.

CVE-2018-5174—In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the "SEE_MASK_FLAG_NO_UI" flag associated with downloaded files andEPSS 1.8%CVE-2019-17015—During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploEPSS 1.8%CVE-2016-9895—Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vuEPSS 1.8%CVE-2016-9065—The location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode, blocking its exiting, and creating of a fake EPSS 1.8%CVE-2017-5450—A mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI. On Firefox for Android, the base domain is parsed incorreEPSS 1.8%CVE-2017-7791—On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary domains following paEPSS 1.8%CVE-2019-11743—Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload evenEPSS 1.8%CVE-2017-5374—Memory safety bugs were reported in Firefox 50.1. Some of these bugs showed evidence of memory corruption and we presume that with enough efEPSS 1.8%CVE-2018-5173—The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This cEPSS 1.8%CVE-2018-5128—A use-after-free vulnerability can occur when manipulating elements, events, and selection ranges during editor operations. This results in EPSS 1.8%CVE-2018-5092—A use-after-free vulnerability can occur when the thread for a Web Worker is freed from memory prematurely instead of from memory in the maiEPSS 1.8%CVE-2019-9794—A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handlerEPSS 1.8%CVE-2018-5126—Memory safety bugs were reported in Firefox 58. Some of these bugs showed evidence of memory corruption and we presume that with enough effoEPSS 1.8%CVE-2021-38504—When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have resulted, leading to EPSS 1.8%CVE-2017-7829—It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's addressEPSS 1.8%CVE-2018-5101—A use-after-free vulnerability can occur when manipulating floating "first-letter" style elements, resulting in a potentially exploitable crEPSS 1.8%CVE-2021-38509—Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be dEPSS 1.8%CVE-2021-23994—A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects FEPSS 1.8%CVE-2017-5416—In certain circumstances a networking event listener can be prematurely released. This appears to result in a null dereference in practice. EPSS 1.7%CVE-2017-5406—A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip intersection and emptEPSS 1.7%