Vulnerabilidades em Mozilla

2.453 resultados
Análise Vexday

Com 1.857 CVEs catalogadas e 189 classificadas como críticas, o histórico de vulnerabilidades da Mozilla reflete a complexidade de manter um navegador amplamente adotado. A taxa de exploração ativa — 9 entradas no CISA KEV, representando 0,48% do total — está em linha com a média geral do catálogo, o que indica um nível de exposição operacional compatível com o setor, sem desvio negativo expressivo. O tipo de falha mais recorrente é CWE-416 (use-after-free), uma classe de vulnerabilidade de memória com alto potencial de execução de código, e a CVE mais perigosa atualmente ativa, CVE-2016-9079, apresenta EPSS de 0,8792 — valor elevado que sugere probabilidade significativa de exploração continuada. Os 144 CVEs surgidos nos últimos 90 dias e a existência de 27 provas de conceito públicas reforçam a necessidade de monitoramento contínuo e priorização ágil de patches para ambientes que dependem de produtos Mozilla.

CVE-2024-2612HIGHIf an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered a crash or potentially be leveragEPSS 1.0%CVE-2021-23965—Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evidence of memory corruption and we presumeEPSS 1.0%CVE-2022-46871HIGHAn out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited. This vulnerability affects Firefox < 108.EPSS 1.0%CVE-2026-4696CRITICALUse-after-free in the Layout: Text and Fonts componentEPSS 1.0%CVE-2022-22756HIGHIf a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an exeEPSS 1.0%CVE-2020-15646—If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechanEPSS 1.0%CVE-2021-29975—Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or formatting, could be overlEPSS 1.0%CVE-2026-74943CRITICALUse-after-free in the Graphics: ImageLib componentEPSS 1.0%CVE-2020-12408—When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path information in the addEPSS 1.0%CVE-2023-6860—The `VideoBridge` allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox. ThisEPSS 1.0%CVE-2022-34468HIGHAn iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link. This vulnerability affecEPSS 1.0%CVE-2019-9818—A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can lead to a use-after-EPSS 1.0%CVE-2022-1097MEDIUM<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leadingEPSS 1.0%CVE-2023-6862—A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during start-up. This vulnerability affeEPSS 1.0%CVE-2023-4056—Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these bEPSS 0.9%CVE-2026-2796CRITICALJIT miscompilation in the JavaScript: WebAssembly componentEPSS 0.9%CVE-2023-6212—Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruptionEPSS 0.9%CVE-2020-15680—If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken imEPSS 0.9%CVE-2026-6746HIGHUse-after-free in the DOM: Core & HTML componentEPSS 0.9%CVE-2021-29987—After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a differentEPSS 0.9%