Mozilla
Page 15 of 38 — Mozilla CVEs from a corpus of 3730, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-6820 | High | 8.1 | 2020-04-24 | Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing thi… |
CVE-2020-6819 | High | 8.1 | 2020-04-24 | Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abu… |
CVE-2020-6815 | Critical | 9.8 | 2020-03-25 | Mozilla developers reported memory safety and script safety bugs present in Firefox 73. Some of these bugs showed evidence of memory corruption or escalation o… |
CVE-2020-6814 | Critical | 9.8 | 2020-03-25 | Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evidence of memory corruption and we presume… |
CVE-2020-6813 | Medium | 5.3 | 2020-03-25 | When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker to inject arbitrar… |
CVE-2020-6812 | Medium | 5.3 | 2020-03-25 | The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microp… |
CVE-2020-6811 | High | 8.8 | 2020-03-25 | The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user use… |
CVE-2020-6810 | Medium | 4.3 | 2020-03-25 | After a website had entered fullscreen mode, it could have used a previously opened popup to obscure the notification that indicates the browser is in fullscre… |
CVE-2020-6809 | High | 7.5 | 2020-03-25 | When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web Extension to read local… |
CVE-2020-6808 | Medium | 6.5 | 2020-03-25 | When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is then presented. Previou… |
CVE-2020-6807 | High | 8.8 | 2020-03-25 | When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> task may have been executed after the stream was destroyed… |
CVE-2020-6806 | High | 8.8 | 2020-03-25 | By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could h… |
CVE-2020-6805 | High | 8.8 | 2020-03-25 | When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable cra… |
CVE-2020-6816 | Medium | 6.1 | 2020-03-24 | In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False. |
CVE-2020-6802 | Medium | 6.1 | 2020-03-24 | In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option. |
CVE-2020-6801 | High | 8.8 | 2020-03-02 | Mozilla developers reported memory safety bugs present in Firefox 72. Some of these bugs showed evidence of memory corruption and we presume that with enough e… |
CVE-2020-6800 | High | 8.8 | 2020-03-02 | Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some of these bugs showed evidence of memory c… |
CVE-2020-6799 | High | 8.8 | 2020-03-02 | Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types. This required Firefox to be co… |
CVE-2020-6798 | Medium | 6.1 | 2020-03-02 | If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed. A site that… |
CVE-2020-6797 | Medium | 4.3 | 2020-03-02 | By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer. The attacker is re… |
CVE-2020-6796 | High | 8.8 | 2020-03-02 | A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write. This could have cau… |
CVE-2020-6795 | Medium | 6.5 | 2020-03-02 | When processing a message that contains multiple S/MIME signatures, a bug in the MIME processing code caused a null pointer dereference, leading to an unexploi… |
CVE-2020-6794 | Medium | 6.5 | 2020-03-02 | If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is becau… |
CVE-2020-6793 | Medium | 6.5 | 2020-03-02 | When processing an email message with an ill-formed envelope, Thunderbird could read data from a random memory location. This vulnerability affects Thunderbird… |
CVE-2020-6792 | Medium | 4.3 | 2020-03-02 | When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. This vulnerability affects Thunderbird < 6… |
CVE-2019-17026 | High | 8.8 | 2020-03-02 | Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild a… |
CVE-2020-6804 | High | 8.8 | 2020-02-28 | A reflected XSS vulnerability exists within the gateway, allowing an attacker to craft a specialized URL which could steal the user's authentication token. Whe… |
CVE-2020-6803 | Medium | 5.4 | 2020-02-28 | An open redirect is present on the gateway's login page, which could cause a user to be redirected to a malicious site after logging in. |
CVE-2013-4227 | High | 8.8 | 2020-02-18 | Cross-site request forgery (CSRF) vulnerability in the persona_xsrf_token function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for… |
CVE-2013-5594 | Medium | 4.3 | 2020-02-18 | Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml binding |
CVE-2020-1933 | Medium | 6.1 | 2020-01-28 | A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in… |
CVE-2011-2669 | Medium | 6.5 | 2020-01-21 | Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates. |
CVE-2011-2668 | High | 8.8 | 2020-01-21 | Mozilla Firefox through 1.5.0.3 has a vulnerability in processing the content-length header |
CVE-2011-2670 | Medium | 6.1 | 2020-01-13 | Mozilla Firefox before 3.6 is vulnerable to XSS via the rendering of Cascading Style Sheets |
CVE-2019-9812 | Critical | 9.3 | 2020-01-08 | Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that pr… |
CVE-2019-17025 | High | 8.8 | 2020-01-08 | Mozilla developers reported memory safety bugs present in Firefox 71. Some of these bugs showed evidence of memory corruption and we presume that with enough e… |
CVE-2019-17024 | High | 8.8 | 2020-01-08 | Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presu… |
CVE-2019-17023 | Medium | 6.5 | 2020-01-08 | After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Mach… |
CVE-2019-17022 | Medium | 6.1 | 2020-01-08 | When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting… |
CVE-2019-17021 | Medium | 5.3 | 2020-01-08 | During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process… |
CVE-2019-17020 | Medium | 6.5 | 2020-01-08 | If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the con… |
CVE-2019-17019 | High | 8.8 | 2020-01-08 | When Python was installed on Windows, a python file being served with the MIME type of text/plain could be executed by Python instead of being opened as a text… |
CVE-2019-17018 | Medium | 5.3 | 2020-01-08 | When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve the accuracy of the keyboard. This vulnerability affec… |
CVE-2019-17017 | High | 8.8 | 2020-01-08 | Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could… |
CVE-2019-17016 | Medium | 6.1 | 2020-01-08 | When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for inj… |
CVE-2019-17015 | High | 8.8 | 2020-01-08 | During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the… |
CVE-2019-17014 | High | 7.4 | 2020-01-08 | If an image had not loaded correctly (such as when it is not actually an image), it could be dragged and dropped cross-domain, resulting in a cross-origin info… |
CVE-2019-17013 | High | 8.8 | 2020-01-08 | Mozilla developers reported memory safety bugs present in Firefox 70. Some of these bugs showed evidence of memory corruption and we presume that with enough e… |
CVE-2019-17012 | High | 8.8 | 2020-01-08 | Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we presu… |
CVE-2019-17011 | High | 7.5 | 2020-01-08 | Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a po… |
CVE-2019-17010 | High | 7.5 | 2020-01-08 | Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-f… |
CVE-2019-17009 | High | 7.8 | 2020-01-08 | When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a… |
CVE-2019-17008 | High | 8.8 | 2020-01-08 | When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects… |
CVE-2019-17005 | High | 8.8 | 2020-01-08 | The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array… |
CVE-2019-17002 | Medium | 4.3 | 2020-01-08 | If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to http… |
CVE-2019-17001 | Medium | 6.1 | 2020-01-08 | A Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the protected document (cross-site scripti… |
CVE-2019-17000 | Medium | 6.1 | 2020-01-08 | An object tag with a data URI did not correctly inherit the document's Content Security Policy. This allowed a CSP bypass in a cross-origin frame if the docume… |
CVE-2019-11765 | Medium | 6.5 | 2020-01-08 | A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown. However, due to la… |
CVE-2019-11764 | High | 8.8 | 2020-01-08 | Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory c… |
CVE-2019-11763 | Medium | 6.1 | 2020-01-08 | Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML commen… |
CVE-2019-11762 | Medium | 6.1 | 2020-01-08 | If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on… |
CVE-2019-11761 | Medium | 5.4 | 2020-01-08 | By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this o… |
CVE-2019-11760 | High | 8.8 | 2020-01-08 | A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vuln… |
CVE-2019-11759 | High | 8.8 | 2020-01-08 | An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute a… |
CVE-2019-11758 | High | 8.8 | 2020-01-08 | Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory c… |
CVE-2019-11757 | High | 8.8 | 2020-01-08 | When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use… |
CVE-2019-11756 | High | 8.8 | 2020-01-08 | Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects F… |
CVE-2019-11745 | High | 8.8 | 2020-01-08 | When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. Th… |
CVE-2013-1689 | Medium | 6.5 | 2019-12-10 | Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash), related to event handling with frames. |
CVE-2016-5285 | High | 7.5 | 2019-11-15 | A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMAC… |
CVE-2019-14953 | Medium | 6.1 | 2019-10-01 | JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser. |
CVE-2019-11755 | High | 7.5 | 2019-09-27 | A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature, although the sign… |
CVE-2019-11754 | Medium | 4.3 | 2019-09-27 | When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given. This could allow a malicious website to hijack the mo… |
CVE-2019-11753 | High | 7.8 | 2019-09-27 | The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malw… |
CVE-2019-11752 | High | 8.8 | 2019-09-27 | It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a potentially exploi… |
CVE-2019-11751 | High | 8.8 | 2019-09-27 | Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks on malicious links i… |
CVE-2019-11750 | Medium | 6.5 | 2019-09-27 | A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1. |
CVE-2019-11749 | Medium | 4.3 | 2019-09-27 | A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using constraints to reveal device properties o… |
CVE-2019-11748 | Medium | 6.5 | 2019-09-27 | WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party context. In light of… |
CVE-2019-11747 | Medium | 6.5 | 2019-09-27 | The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site. This includes remo… |
CVE-2019-11746 | High | 8.8 | 2019-09-27 | A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a potentially exploitable c… |
CVE-2019-11744 | Medium | 6.1 | 2019-09-27 | Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a li… |
CVE-2019-11743 | Low | 3.7 | 2019-09-27 | Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload event, which restricts… |
CVE-2019-11742 | Medium | 6.5 | 2019-09-27 | A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> element due to an err… |
CVE-2019-11741 | Medium | 6.1 | 2019-09-27 | A compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS) attack on content from any site it can cause to be loaded in the sa… |
CVE-2019-11740 | High | 8.8 | 2019-09-27 | Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8. Some of these bugs showed evidenc… |
CVE-2019-11739 | Medium | 6.5 | 2019-09-27 | Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunde… |
CVE-2019-11738 | Medium | 6.3 | 2019-09-27 | If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs w… |
CVE-2019-11737 | Medium | 5.3 | 2019-09-27 | If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive will be ignored, leadi… |
CVE-2019-11736 | High | 7.0 | 2019-09-27 | The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local f… |
CVE-2019-11735 | High | 8.8 | 2019-09-27 | Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68. Some of these bugs showed evidence of memory cor… |
CVE-2019-11734 | Critical | 9.8 | 2019-09-27 | Mozilla developers and community members reported memory safety bugs present in Firefox 68. Some of these bugs showed evidence of memory corruption and we pres… |
CVE-2019-11733 | Critical | 9.8 | 2019-09-27 | When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that local… |
CVE-2019-9821 | High | 8.1 | 2019-07-23 | A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers. This results in a potentially exploitable crash. Th… |
CVE-2019-9820 | Critical | 9.8 | 2019-07-23 | A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This… |
CVE-2019-9819 | Critical | 9.8 | 2019-07-23 | A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerab… |
CVE-2019-9818 | High | 8.3 | 2019-07-23 | A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can lead to a use-after-free in the main pr… |
CVE-2019-9817 | Medium | 5.3 | 2019-07-23 | Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violati… |
CVE-2019-9816 | Medium | 5.9 | 2019-07-23 | A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security ch… |
CVE-2019-9815 | High | 8.1 | 2019-07-23 | If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to… |