Vulnerabilidades em mozilla
2.453 resultadosAnálise Vexday
A Mozilla apresenta um perfil de risco baixo com apenas 3 vulnerabilidades catalogadas, nenhuma sob exploração ativa ou crítica. A fraqueza dominante identificada é CWE-400 (Uncontrolled Resource Consumption), que tipicamente afeta disponibilidade; a ausência de publicações recentes sugere que o risco atual não é imediato.
CVE-2019-25136CRITICALA compromised child process could have injected XBL Bindings into privileged CSS rules, resulting in arbitrary code execution and a sandbox EPSS 0.7%CVE-2022-26387HIGHWhen installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underEPSS 0.7%CVE-2023-4574—Memory corruption in IPC ColorPickerShownCallbackEPSS 0.7%CVE-2024-6611CRITICALIncorrect handling of SameSite cookiesEPSS 0.7%CVE-2024-0745HIGHThe WebAudio `OscillatorNode` object was susceptible to a stack buffer overflow. This could have led to a potentially exploitable crash. ThiEPSS 0.7%CVE-2022-29914MEDIUMWhen reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofEPSS 0.7%CVE-2023-4051—Full screen notification obscured by file open dialogEPSS 0.7%CVE-2021-23955—The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to clickjacking attacks.EPSS 0.7%CVE-2026-2805CRITICALInvalid pointer in the DOM: Core & HTML componentEPSS 0.7%CVE-2021-23963—When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to EPSS 0.7%CVE-2023-4575—Memory corruption in IPC FilePickerShownCallbackEPSS 0.7%CVE-2024-7652HIGHType Confusion in Async Generators in Javascript EngineEPSS 0.7%CVE-2026-4705CRITICALUndefined behavior in the WebRTC: Signaling componentEPSS 0.7%CVE-2024-11705CRITICAL`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV)EPSS 0.7%CVE-2024-5691MEDIUMBy tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would EPSS 0.7%CVE-2017-7759—Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local "file:" URLs, allowing for the reaEPSS 0.7%CVE-2023-4577—Memory corruption in JIT UpdateRegExpStaticsEPSS 0.7%CVE-2020-12399—NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerabEPSS 0.7%CVE-2026-4704HIGHDenial-of-service in the WebRTC: Signaling componentEPSS 0.7%CVE-2022-22753HIGHA Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrarEPSS 0.7%