Vulnerabilidades em Mozilla

2.453 resultados
Análise Vexday

Com 1.857 CVEs catalogadas e 189 classificadas como críticas, o histórico de vulnerabilidades da Mozilla reflete a complexidade de manter um navegador amplamente adotado. A taxa de exploração ativa — 9 entradas no CISA KEV, representando 0,48% do total — está em linha com a média geral do catálogo, o que indica um nível de exposição operacional compatível com o setor, sem desvio negativo expressivo. O tipo de falha mais recorrente é CWE-416 (use-after-free), uma classe de vulnerabilidade de memória com alto potencial de execução de código, e a CVE mais perigosa atualmente ativa, CVE-2016-9079, apresenta EPSS de 0,8792 — valor elevado que sugere probabilidade significativa de exploração continuada. Os 144 CVEs surgidos nos últimos 90 dias e a existência de 27 provas de conceito públicas reforçam a necessidade de monitoramento contínuo e priorização ágil de patches para ambientes que dependem de produtos Mozilla.

CVE-2017-7789—If a server sends two Strict-Transport-Security (STS) headers for a single connection, they will be rejected as invalid and HTTP Strict TranEPSS 1.7%CVE-2018-5184—Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR < 52.8 and ThEPSS 1.7%CVE-2016-5288—Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pageEPSS 1.7%CVE-2016-9076—An issue where a "<select>" dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks. This attack reEPSS 1.7%CVE-2021-43539—Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing EPSS 1.7%CVE-2017-5392—Weak proxy objects have weak references on multiple threads when they should only have them on one, resulting in incorrect memory usage and EPSS 1.7%CVE-2017-5391—Special "about:" pages used by web content, such as RSS feeds, can load privileged "about:" pages in an iframe. If a content-injection bug wEPSS 1.7%CVE-2018-5107—The printing process can bypass local access protections to read files available through symlinks, bypassing local file restrictions. The prEPSS 1.7%CVE-2020-12410—Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evidence of memory corrEPSS 1.7%CVE-2017-7848—RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird < 52.5.EPSS 1.7%CVE-2019-9800—Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of EPSS 1.7%CVE-2020-12389—The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only afEPSS 1.7%CVE-2017-5411—A use-after-free can occur during buffer storage operations within the ANGLE graphics library, used for WebGL content. The buffer storage caEPSS 1.7%CVE-2017-5379—Use-after-free vulnerability in Web Animations when interacting with cycle collection found through fuzzing. This vulnerability affects FireEPSS 1.7%CVE-2017-7844—A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image can be used to determiEPSS 1.7%CVE-2021-43545—Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thunderbird < 91.4.0, FiEPSS 1.7%CVE-2019-11746—A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a potentEPSS 1.7%CVE-2019-11714—Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in some instances. This vuEPSS 1.7%CVE-2019-9795—A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to triggEPSS 1.7%CVE-2018-5170—It is possible to spoof the filename of an attachment and display an arbitrary attachment name. This could lead to a user opening a remote aEPSS 1.7%