Skip to contentMozilla vulnerabilities
Newest
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreAn integer overflow can occur in the SwizzleData code while calculating buffer sizes. The...CVE-2018-12361Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA use-after-free vulnerability can occur when deleting an input element during a mutation event...CVE-2018-12360Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA buffer overflow can occur when rendering canvas content while adjusting the height and width of...CVE-2018-12359Fix available8.8 High
- mozilla firefox, canonical ubuntu linux +1 moreService workers can use redirection to avoid the tainting of cross-origin resources in some...CVE-2018-12358Fix available4.3 Medium
- mozilla firefoxIn 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected...CVE-2018-51655.3 Medium
- mozilla firefoxA spoofing vulnerability can occur when a malicious site with an extremely long domain name is...CVE-2018-51385.3 Medium
- mozilla firefoxLow descenders on some Tibetan characters in several fonts on OS X are clipped when rendered in...CVE-2018-51215.3 Medium
- mozilla firefoxIf cursor visibility is toggled by script using from 'none' to an image and back through script,...CVE-2018-51105.3 Medium
- mozilla firefoxA combination of an external SVG image referenced on a page and the coloring of anchor links...CVE-2017-7844Fix available6.5 Medium
- mozilla firefoxThe "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of...CVE-2017-78367.8 High
- mozilla firefoxA spoofing vulnerability can occur when a page switches to fullscreen mode without user...CVE-2017-78175.3 Medium
- mozilla firefoxOn Windows systems, the logger run by the Windows updater deletes the file "update.log" before it...CVE-2017-77964.7 Medium
- mozilla firefoxOn Windows systems, if non-null-terminated strings are copied into the crash reporter for some...CVE-2017-77907.5 High
- mozilla firefoxA mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then...CVE-2017-77705.9 Medium
- google android, mozilla firefox +1 moreAndroid intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs...CVE-2017-77597.5 High
- mozilla firefoxAndroid intents can be used to launch Firefox for Android in reader mode with a user specified...CVE-2017-54635.3 Medium
- mozilla firefoxMalicious sites can display a spoofed addressbar on a page when the existing location bar on the...CVE-2017-54524.3 Medium
- mozilla firefoxA mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI. On Firefox for...CVE-2017-54507.5 High
- mozilla firefoxThe cache directory on the local file system is set to be world writable. Firefox defaults to...CVE-2017-53979.8 Critical
- mozilla firefoxMalicious sites can display a spoofed location bar on a subsequently loaded page when the...CVE-2017-53954.3 Medium
- mozilla firefoxA location bar spoofing attack where the location bar of loaded page will be shown over the...CVE-2017-53948.8 High
- mozilla firefoxWeak proxy objects have weak references on multiple threads when they should only have them on...CVE-2017-53929.8 Critical
- mozilla firefoxWhen a new Firefox profile is created on 64-bit Windows installations, the sandbox for 64-bit...CVE-2016-90727.5 High
- mozilla firefoxThe location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode,...CVE-2016-90657.5 High
- mozilla firefoxPrivate browsing mode leaves metadata information, such as URLs, for sites visited in "browser.db...CVE-2016-90623.3 Low
- mozilla firefoxA previously installed malicious Android application which defines a specific signature-level...CVE-2016-90617.5 High
- mozilla firefoxA previously installed malicious Android application with same signature-level permissions as...CVE-2016-52997.5 High
- mozilla firefoxA mechanism where disruption of the loading of a new web page can cause the previous page's...CVE-2016-52986.5 Medium
- mozilla firefoxThis vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate...CVE-2016-52957.8 High
- mozilla firefox, firefox esr, debian linux +2 moreWhen the Mozilla Updater is run, if the Updater's log file in the working directory points to a...CVE-2016-52935.5 Medium
- mozilla nunjucks, hackerone nunjucks node module +1 moreCross-Site Scripting in nunjucksCVE-2016-10547Fix available6.1 Medium
- mozilla thunderbird, thunderbird esr, canonical ubuntu linux +7 more +9 morePlaintext of decrypted emails can leak through by user submitting an embedded form. This...CVE-2018-5185Fix available6.5 Medium
- mozilla thunderbird, thunderbird esr, canonical ubuntu linux +8 more +10 moreUsing remote content in encrypted messages can lead to the disclosure of plaintext. This...CVE-2018-5184Fix available7.5 High
- mozilla thunderbird, thunderbird esr, canonical ubuntu linux +7 more +9 moreIt is possible to spoof the filename of an attachment and display an arbitrary attachment name....CVE-2018-5170Fix available4.3 Medium
- mozilla thunderbird, thunderbird esr, canonical ubuntu linux +7 more +9 morePlaintext of decrypted emails can leak through the src attribute of remote images, or links. This...CVE-2018-5162Fix available7.5 High
- mozilla thunderbird, thunderbird esr, canonical ubuntu linux +7 more +9 moreCrafted message headers can cause a Thunderbird process to hang on receiving the message. This...CVE-2018-5161Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIn the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the "SEE_MASK_FLAG_NO_UI...CVE-2018-51747.5 High
- 9folders nine, apple mail, bloop airmail +14 more +16 moreThe S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can...CVE-2017-17689Fix available5.9 Medium
- apple mail, bloop airmail, emclient +8 more +10 more** DISPUTED ** The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget...CVE-2017-17688Fix availableDisputed5.9 Medium
- mozilla firefox, canonical ubuntu linux +1 moreIf a text string that happens to be a filename in the operating system's native format is dragged...CVE-2018-5182Fix available7.5 High
- mozilla firefox, canonical ubuntu linux +1 moreIf a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a...CVE-2018-5181Fix available7.5 High
- mozilla firefox, canonical ubuntu linux +1 moreA use-after-free vulnerability can occur during WebGL operations. While this results in a...CVE-2018-5180Fix available7.5 High
- mozilla firefox, canonical ubuntu linux +1 moreA vulnerability exists in XSLT during number formatting where a negative buffer size may be...CVE-2018-5177Fix available7.5 High
- mozilla firefox, canonical ubuntu linux +1 moreThe JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including ...CVE-2018-5176Fix available6.1 Medium
- mozilla firefox, canonical ubuntu linux +1 moreA mechanism to bypass Content Security Policy (CSP) protections on sites that have a "script-src"...CVE-2018-5175Fix available6.1 Medium
- mozilla firefox, canonical ubuntu linux +1 moreThe filename appearing in the "Downloads" panel improperly renders some Unicode characters,...CVE-2018-5173Fix available5.3 Medium
- mozilla firefox, canonical ubuntu linux +1 moreThe Live Bookmarks page and the PDF viewer can run injected script content if a user pastes...CVE-2018-5172Fix available4.3 Medium
- mozilla firefox, canonical ubuntu linux +1 moreIf manipulated hyperlinked text with "chrome:" URL contained in it is dragged and dropped on the ...CVE-2018-5169Fix available6.5 Medium
- mozilla firefox, canonical ubuntu linux +1 moreThe web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both...CVE-2018-5167Fix available4.3 Medium
- mozilla firefox, canonical ubuntu linux +1 moreWebExtensions can use request redirection and a "filterReponseData" filter to bypass host...CVE-2018-5166Fix available7.5 High
- Show moreLoading…