Vulnerabilidades em Mozilla

2.452 resultados
Análise Vexday

Com 1.857 CVEs catalogadas e 189 classificadas como críticas, o histórico de vulnerabilidades da Mozilla reflete a complexidade de manter um navegador amplamente adotado. A taxa de exploração ativa — 9 entradas no CISA KEV, representando 0,48% do total — está em linha com a média geral do catálogo, o que indica um nível de exposição operacional compatível com o setor, sem desvio negativo expressivo. O tipo de falha mais recorrente é CWE-416 (use-after-free), uma classe de vulnerabilidade de memória com alto potencial de execução de código, e a CVE mais perigosa atualmente ativa, CVE-2016-9079, apresenta EPSS de 0,8792 — valor elevado que sugere probabilidade significativa de exploração continuada. Os 144 CVEs surgidos nos últimos 90 dias e a existência de 27 provas de conceito públicas reforçam a necessidade de monitoramento contínuo e priorização ágil de patches para ambientes que dependem de produtos Mozilla.

CVE-2018-5111—When the text of a specially formatted URL is dragged to the addressbar from page content, the displayed URL can be spoofed to show a differEPSS 1.5%CVE-2023-6858HIGHFirefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling. This vulnerability affects Firefox EEPSS 1.5%CVE-2020-26974—When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulteEPSS 1.5%CVE-2020-6799—Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types. This requirEPSS 1.5%CVE-2021-23978—Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evidence of memory corrEPSS 1.5%CVE-2018-5119—The reader view will display cross-origin content when CORS headers are set to prohibit the loading of cross-origin content by a site. This EPSS 1.5%CVE-2018-5114—If an existing cookie is changed to be "HttpOnly" while a document is open, the original value remains accessible through script until that EPSS 1.5%CVE-2018-5118—The screenshot images displayed in the Activity Stream page displayed when a new tab is opened is created from the meta tags of websites. AnEPSS 1.5%CVE-2019-17011—Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-freeEPSS 1.5%CVE-2019-17010—Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have cEPSS 1.5%CVE-2020-15656—JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various prEPSS 1.5%CVE-2023-5724HIGHDrivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. This vulnerability afEPSS 1.5%CVE-2020-15655—A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential discEPSS 1.5%CVE-2018-12402—The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are loEPSS 1.5%CVE-2017-5466—If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will ruEPSS 1.5%CVE-2020-26968—Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corrEPSS 1.5%CVE-2017-7842—If a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for "<link>" elements instead of oEPSS 1.5%CVE-2017-7834—A "data:" URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page, allowing for bypasses of the policEPSS 1.5%CVE-2020-6793—When processing an email message with an ill-formed envelope, Thunderbird could read data from a random memory location. This vulnerability EPSS 1.5%CVE-2019-9812—Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firEPSS 1.5%