Vulnerabilidades em Mozilla

2.453 resultados
Análise Vexday

Com 1.857 CVEs catalogadas e 189 classificadas como críticas, o histórico de vulnerabilidades da Mozilla reflete a complexidade de manter um navegador amplamente adotado. A taxa de exploração ativa — 9 entradas no CISA KEV, representando 0,48% do total — está em linha com a média geral do catálogo, o que indica um nível de exposição operacional compatível com o setor, sem desvio negativo expressivo. O tipo de falha mais recorrente é CWE-416 (use-after-free), uma classe de vulnerabilidade de memória com alto potencial de execução de código, e a CVE mais perigosa atualmente ativa, CVE-2016-9079, apresenta EPSS de 0,8792 — valor elevado que sugere probabilidade significativa de exploração continuada. Os 144 CVEs surgidos nos últimos 90 dias e a existência de 27 provas de conceito públicas reforçam a necessidade de monitoramento contínuo e priorização ágil de patches para ambientes que dependem de produtos Mozilla.

CVE-2021-43538—By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screEPSS 1.2%CVE-2022-40957MEDIUMInconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<br>*This bug only affEPSS 1.2%CVE-2020-15666—When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MEPSS 1.2%CVE-2017-5381—The "export" function in the Certificate Viewer can force local filesystem navigation when the "common name" in a certificate contains slashEPSS 1.2%CVE-2017-5418—An out of bounds read error occurs when parsing some HTTP digest authorization responses, resulting in information leakage through the readiEPSS 1.2%CVE-2019-11718—Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream EPSS 1.2%CVE-2017-7812—If web content on a page is dragged onto portions of the browser UI, such as the tab bar, links can be opened that otherwise would not be alEPSS 1.2%CVE-2017-7816—WebExtensions could use popups and panels in the extension UI to load an "about:" privileged URL, violating security checks that disallow thEPSS 1.2%CVE-2020-26956—In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerabiliEPSS 1.2%CVE-2016-5298—A mechanism where disruption of the loading of a new web page can cause the previous page's favicon and SSL indicator to not be reset when tEPSS 1.2%CVE-2020-6801—Mozilla developers reported memory safety bugs present in Firefox 72. Some of these bugs showed evidence of memory corruption and we presumeEPSS 1.2%CVE-2021-29976—Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bugs showed evidence ofEPSS 1.2%CVE-2020-6813—When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attackerEPSS 1.2%CVE-2020-26969—Mozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence of memory corruption and we presumeEPSS 1.2%CVE-2019-9789—Mozilla developers and community members reported memory safety bugs present in Firefox 65. Some of these bugs showed evidence of memory corEPSS 1.2%CVE-2021-23969—As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file isEPSS 1.2%CVE-2025-1009CRITICALUse-after-free in XSLTEPSS 1.2%CVE-2021-29945—The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. *Note: This issue oEPSS 1.2%CVE-2023-5174CRITICALIf Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting inEPSS 1.2%CVE-2021-29969—If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completionEPSS 1.2%