Vulnerabilidades em Mozilla

2.453 resultados
Análise Vexday

Com 1.857 CVEs catalogadas e 189 classificadas como críticas, o histórico de vulnerabilidades da Mozilla reflete a complexidade de manter um navegador amplamente adotado. A taxa de exploração ativa — 9 entradas no CISA KEV, representando 0,48% do total — está em linha com a média geral do catálogo, o que indica um nível de exposição operacional compatível com o setor, sem desvio negativo expressivo. O tipo de falha mais recorrente é CWE-416 (use-after-free), uma classe de vulnerabilidade de memória com alto potencial de execução de código, e a CVE mais perigosa atualmente ativa, CVE-2016-9079, apresenta EPSS de 0,8792 — valor elevado que sugere probabilidade significativa de exploração continuada. Os 144 CVEs surgidos nos últimos 90 dias e a existência de 27 provas de conceito públicas reforçam a necessidade de monitoramento contínuo e priorização ágil de patches para ambientes que dependem de produtos Mozilla.

CVE-2020-26976—When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have inteEPSS 1.6%CVE-2019-9820—A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially explEPSS 1.6%CVE-2019-11711—When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomaiEPSS 1.6%CVE-2019-9793—A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disEPSS 1.6%CVE-2018-5134—WebExtensions may use "view-source:" URLs to view local "file:" URL content, as well as content stored in "about:cache", bypassing restrictiEPSS 1.6%CVE-2018-5137—A legacy extension's non-contentaccessible, defined resources can be loaded by an arbitrary web page through script. This script does this bEPSS 1.6%CVE-2020-26973—Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer byEPSS 1.6%CVE-2020-12390—Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. This vulnerability affects Firefox < 76.EPSS 1.6%CVE-2017-5385—Data sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will ignore the referrer-policy response header, leadEPSS 1.6%CVE-2018-12398—By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and bypass Content Security EPSS 1.6%CVE-2018-18511—Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *NoteEPSS 1.6%CVE-2020-12426—Mozilla developers and community members reported memory safety bugs present in Firefox 77. Some of these bugs showed evidence of memory corEPSS 1.6%CVE-2020-6823—A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the PromiEPSS 1.6%CVE-2017-5388—A STUN server in conjunction with a large number of "webkitRTCPeerConnection" objects can be used to send large STUN packets in a short periEPSS 1.6%CVE-2020-12424—When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been tEPSS 1.6%CVE-2019-11692—A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potenEPSS 1.6%CVE-2016-9073—WebExtensions can bypass security checks to load privileged URLs and potentially escape the WebExtension sandbox. This vulnerability affectsEPSS 1.6%CVE-2020-6812—The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites wiEPSS 1.6%CVE-2018-5152—WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to networEPSS 1.6%CVE-2017-7825—Several fonts on OS X display some Tibetan and Arabic characters as whitespace. When used in the addressbar as part of an IDN this can be usEPSS 1.6%