Vulnerabilidades em Mozilla

1.860 resultados
Análise Vexday

Com 1.857 CVEs catalogadas e 189 classificadas como críticas, o histórico de vulnerabilidades da Mozilla reflete a complexidade de manter um navegador amplamente adotado. A taxa de exploração ativa — 9 entradas no CISA KEV, representando 0,48% do total — está em linha com a média geral do catálogo, o que indica um nível de exposição operacional compatível com o setor, sem desvio negativo expressivo. O tipo de falha mais recorrente é CWE-416 (use-after-free), uma classe de vulnerabilidade de memória com alto potencial de execução de código, e a CVE mais perigosa atualmente ativa, CVE-2016-9079, apresenta EPSS de 0,8792 — valor elevado que sugere probabilidade significativa de exploração continuada. Os 144 CVEs surgidos nos últimos 90 dias e a existência de 27 provas de conceito públicas reforçam a necessidade de monitoramento contínuo e priorização ágil de patches para ambientes que dependem de produtos Mozilla.

CVE-2020-26967—When listening for page changes with a Mutation Observer, a malicious web page could confuse Firefox Screenshots into interacting with elemeEPSS 0.8%CVE-2019-11765—A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown.EPSS 0.8%CVE-2021-29959—When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website fromEPSS 0.8%CVE-2019-11696—Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even thoughEPSS 0.8%CVE-2022-26381HIGHAn attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash. This vuEPSS 0.8%CVE-2021-29974—When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would allow the user to oEPSS 0.8%CVE-2020-26963—Repeated calls to the history and location interfaces could have been used to hang the browser. This was addressed by introducing rate-limitEPSS 0.8%CVE-2024-0750HIGHA bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vEPSS 0.8%CVE-2023-5175CRITICALDuring process shutdown, it was possible that an `ImageBitmap` was created that would later be used after being freed from a different codepEPSS 0.8%CVE-2024-11693CRITICALThe executable file warning was not presented when downloading .library-ms files. *Note: This issue only affected Windows operating systemEPSS 0.8%CVE-2020-12408—When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path information in the addEPSS 0.8%CVE-2022-42928HIGHCertain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corrEPSS 0.8%CVE-2013-1689—Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash), related to event handling with frames.EPSS 0.8%CVE-2021-29960—Firefox used to cache the last filename used for printing a file. When generating a filename for printing, Firefox usually suggests the web EPSS 0.8%CVE-2023-4048—An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations. This vulnerability aEPSS 0.8%CVE-2023-6204—On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the EPSS 0.8%CVE-2021-29968—When drawing text onto a canvas with WebRender disabled, an out of bounds read could occur. *This bug only affects Firefox on Windows. OtherEPSS 0.8%CVE-2019-9817—Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a differEPSS 0.8%CVE-2023-6212—Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruptionEPSS 0.8%CVE-2020-26955—When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operaEPSS 0.8%