Vulnerabilidades em Mozilla

2.453 resultados
Análise Vexday

Com 1.857 CVEs catalogadas e 189 classificadas como críticas, o histórico de vulnerabilidades da Mozilla reflete a complexidade de manter um navegador amplamente adotado. A taxa de exploração ativa — 9 entradas no CISA KEV, representando 0,48% do total — está em linha com a média geral do catálogo, o que indica um nível de exposição operacional compatível com o setor, sem desvio negativo expressivo. O tipo de falha mais recorrente é CWE-416 (use-after-free), uma classe de vulnerabilidade de memória com alto potencial de execução de código, e a CVE mais perigosa atualmente ativa, CVE-2016-9079, apresenta EPSS de 0,8792 — valor elevado que sugere probabilidade significativa de exploração continuada. Os 144 CVEs surgidos nos últimos 90 dias e a existência de 27 provas de conceito públicas reforçam a necessidade de monitoramento contínuo e priorização ágil de patches para ambientes que dependem de produtos Mozilla.

CVE-2019-9812—Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firEPSS 1.5%CVE-2019-11694—A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making aEPSS 1.5%CVE-2020-6828—A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a fileEPSS 1.5%CVE-2021-38506—Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to EPSS 1.5%CVE-2018-5185—Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderbird ESR < 52.8 and ThEPSS 1.5%CVE-2021-23985—If an attacker is able to alter specific about:config values (for example malware running on the user's computer), the Devtools remote debugEPSS 1.5%CVE-2021-43546—It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects ThunderbiEPSS 1.5%CVE-2020-6821—When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification rEPSS 1.5%CVE-2018-5135—WebExtensions can bypass normal restrictions in some circumstances and use "browser.tabs.executeScript" to inject scripts into contexts wherEPSS 1.5%CVE-2019-11715—Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards onEPSS 1.5%CVE-2019-11756—Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnEPSS 1.5%CVE-2017-7835—Mixed content blocking of insecure (HTTP) sub-resources in a secure (HTTPS) document was not correctly applied for resources that redirect fEPSS 1.5%CVE-2018-5133—If the "app.support.baseURL" preference is changed by a malicious local program to contain HTML and script content, this content is not saniEPSS 1.5%CVE-2017-5382—Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of internEPSS 1.5%CVE-2020-6805—When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentiaEPSS 1.5%CVE-2020-6809—When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web ExteEPSS 1.5%CVE-2017-7832—The combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or grave, can be spoofEPSS 1.5%CVE-2021-29955—A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and EPSS 1.5%CVE-2017-5451—A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event could be used by scriptEPSS 1.5%CVE-2020-6829—When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about theEPSS 1.5%