Vulnerabilidades em mozilla
2.105 resultadosAnálise Vexday
A Mozilla apresenta um perfil de risco baixo com apenas 3 vulnerabilidades catalogadas, nenhuma sob exploração ativa ou crítica. A fraqueza dominante identificada é CWE-400 (Uncontrolled Resource Consumption), que tipicamente afeta disponibilidade; a ausência de publicações recentes sugere que o risco atual não é imediato.
CVE-2016-9079HIGHA use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild EPSS 87.4%KEVCVE-2024-4367MEDIUMA type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulneraEPSS 70.7%CVE-2019-11708CRITICALInsufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxeEPSS 55.9%KEVCVE-2019-17026HIGHIncorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted atEPSS 46.3%KEVCVE-2020-26950—In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condiEPSS 42.3%CVE-2018-12404—A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant oEPSS 39.6%CVE-2019-11707HIGHA type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable EPSS 37.7%KEVCVE-2019-9810—Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overfloEPSS 29.7%CVE-2022-1802HIGHIf an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution EPSS 26.7%CVE-2022-2200HIGHIf an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading tEPSS 23.9%CVE-2024-9680CRITICALAn attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had repEPSS 23.2%KEVCVE-2024-29943CRITICALAn attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. This EPSS 22.9%CVE-2023-6856—The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issueEPSS 20.6%CVE-2019-11730—A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same direcEPSS 20.3%CVE-2019-9791—The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled throughEPSS 19.9%CVE-2017-5375—JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability afEPSS 19.8%CVE-2021-43527—NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-EPSS 17.6%CVE-2022-1529HIGHAn attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading tEPSS 17.1%CVE-2016-9899—Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. This vulnerability EPSS 16.0%CVE-2018-5159—An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possibEPSS 14.5%