Vulnerabilidades em Mozilla

2.453 resultados
Análise Vexday

Com 1.857 CVEs catalogadas e 189 classificadas como críticas, o histórico de vulnerabilidades da Mozilla reflete a complexidade de manter um navegador amplamente adotado. A taxa de exploração ativa — 9 entradas no CISA KEV, representando 0,48% do total — está em linha com a média geral do catálogo, o que indica um nível de exposição operacional compatível com o setor, sem desvio negativo expressivo. O tipo de falha mais recorrente é CWE-416 (use-after-free), uma classe de vulnerabilidade de memória com alto potencial de execução de código, e a CVE mais perigosa atualmente ativa, CVE-2016-9079, apresenta EPSS de 0,8792 — valor elevado que sugere probabilidade significativa de exploração continuada. Os 144 CVEs surgidos nos últimos 90 dias e a existência de 27 provas de conceito públicas reforçam a necessidade de monitoramento contínuo e priorização ágil de patches para ambientes que dependem de produtos Mozilla.

CVE-2020-15669—When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. This results in a useEPSS 1.1%CVE-2019-11728—The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that the accessible to a usEPSS 1.1%CVE-2023-5168CRITICALA compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potenEPSS 1.1%CVE-2023-5171—During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes,EPSS 1.1%CVE-2017-7763—Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as part of an IDN this can be used for domaEPSS 1.1%CVE-2021-23984—A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fEPSS 1.1%CVE-2011-2668—Mozilla Firefox through 1.5.0.3 has a vulnerability in processing the content-length headerEPSS 1.1%CVE-2017-7770—A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendereEPSS 1.1%CVE-2019-9797—Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the imageEPSS 1.1%CVE-2021-38495—Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. Some of these bugs showed evidence of memory corruption and wEPSS 1.1%CVE-2024-2607HIGHReturn registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:* This issue only affected Armv7-A sEPSS 1.1%CVE-2022-31736CRITICALA malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects ThunderEPSS 1.1%CVE-2020-6808—When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is thenEPSS 1.1%CVE-2022-29167HIGHReDoS vulnerability in header parsing in hawkEPSS 1.1%CVE-2021-38502—Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercEPSS 1.1%CVE-2020-15647—A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage, leading to sensitiveEPSS 1.1%CVE-2021-23976—When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed deEPSS 1.1%CVE-2023-5169—A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds write, leading to a poteEPSS 1.1%CVE-2018-18499—A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a reEPSS 1.1%CVE-2023-6859—A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability affects Firefox ESR < 115.6, ThunderbEPSS 1.1%