Skip to contentMozilla vulnerabilities
Newest
- mozilla firefox, thunderbird +1 moreUsing object or embed tags, it was possible to frame other websites, even if they disallowed...CVE-2020-15648Fix available6.5 Medium
- mozilla firefox, firefox for +1 moreA Content Provider in Firefox for Android allowed local files accessible by the browser to be...CVE-2020-156477.4 High
- mozilla firefox for ios, firefox mobile +1 moreA rogue webpage could override the injected WKUserScript used by the download feature, this...CVE-2020-156626.5 Medium
- mozilla firefox for ios, firefox mobile +1 moreA rogue webpage could override the injected WKUserScript used by the logins autofill, this...CVE-2020-156616.5 Medium
- mozilla firefox, firefox for android, firefox mobile +2 moreWhen performing EC scalar point multiplication, the wNAF point multiplication algorithm was used;...CVE-2020-6829Fix available5.3 Medium
- mozilla firefox, firefox for android, firefox mobile +2 moreDuring ECDSA signature generation, padding applied in the nonce designed to ensure constant-time...CVE-2020-12401Fix available4.7 Medium
- mozilla firefox, firefox for android, firefox mobile +2 moreWhen converting coordinates from projective to affine, the modular inversion was not performed in...CVE-2020-12400Fix available4.7 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreFirefox could be made to load attacker-supplied DLL files from the installation directory. This...CVE-2020-15657Fix available7.8 High
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreMozilla developers and community members reported memory safety bugs present in Firefox 78 and...CVE-2020-15659Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreThe code for downloading files did not properly take care of special characters, which led to an...CVE-2020-15658Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreJIT optimizations involving the Javascript arguments object could confuse later optimizations....CVE-2020-15656Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreA redirected HTTP request which is observed or modified through a web extension could bypass...CVE-2020-15655Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen in an endless loop, a website specifying a custom cursor using CSS could make it look like...CVE-2020-15654Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreAn iframe sandbox element with the allow-popups flag could be bypassed when using noopener links....CVE-2020-15653Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreBy observing the stack trace for JavaScript errors in web workers, it was possible to leak the...CVE-2020-15652Fix available6.5 Medium
- mozilla firefox for ios, firefox mobile +1 moreIndexedDB should be cleared when leaving private browsing mode and it is not, the API for...CVE-2020-124146.5 Medium
- mozilla firefoxBy navigating a tab using the history API, an attacker could cause the address bar to display the...CVE-2020-12412Fix available4.3 Medium
- mozilla firefox for ios, firefox mobile +1 moreFor native-to-JS bridging the app requires a unique token to be passed that ensures non-app code...CVE-2020-124044.3 Medium
- mozilla firefoxWhen the Windows DLL "webauthn.dll" was missing from the Operating System, and a malicious one...CVE-2020-12423Fix available7.8 High
- mozilla thunderbirdIf an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using...CVE-2020-15646Fix available5.9 Medium
- mozilla firefox, opensuse leap +1 moreMozilla developers and community members reported memory safety bugs present in Firefox 77. Some...CVE-2020-12426Fix available8.8 High
- mozilla firefoxDue to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read...CVE-2020-12425Fix available6.5 Medium
- mozilla firefox, opensuse leap +1 moreWhen constructing a permission prompt for WebRTC, a URI was supplied from the content process....CVE-2020-12424Fix available6.5 Medium
- mozilla firefox, opensuse leap +1 moreIn non-standard configurations, a JPEG image created by JavaScript could have caused an internal...CVE-2020-12422Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen performing add-on updates, certificate chains terminating in non-built-in-roots were...CVE-2020-12421Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreWhen trying to connect to a STUN server, a race condition could have caused a use-after-free of a...CVE-2020-12420Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreWhen processing callbacks that occurred during window flushing in the parent process, the...CVE-2020-12419Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreManipulating individual parts of a URL object could have caused an out-of-bounds read, leaking...CVE-2020-12418Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreDue to confusion about ValueTags on JavaScript Objects, an object may pass through the type...CVE-2020-12417Fix available8.8 High
- mozilla firefox, opensuse leap +1 moreA VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster:...CVE-2020-12416Fix available8.8 High
- mozilla firefox, opensuse leap +1 moreWhen "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused...CVE-2020-12415Fix available6.5 Medium
- mozilla firefox, debian linux, fedoraproject fedora +1 more +3 moreDuring RSA key generation, bignum implementations used a variation of the Binary Extended...CVE-2020-12402Fix available4.4 Medium
- mozilla thunderbird, canonical ubuntu linux +1 moreIf Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH...CVE-2020-12398Fix available7.5 High
- libjpeg-turbo, mozilla mozjpeg +1 morelibjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in...CVE-2020-13790Fix available8.1 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some...CVE-2020-12410Fix available8.8 High
- mozilla firefoxMozilla developers reported memory safety bugs present in Firefox 76. Some of these bugs showed...CVE-2020-12411Fix available8.8 High
- mozilla firefoxWhen using certain blank characters in a URL, they where incorrectly rendered as spaces instead...CVE-2020-12409Fix available8.8 High
- mozilla firefoxWhen browsing a document hosted on an IP address, an attacker could insert certain characters to...CVE-2020-12408Fix available6.5 Medium
- mozilla firefoxMozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain...CVE-2020-12407Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal,...CVE-2020-12406Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen browsing a malicious page, a race condition in our SharedWorkerService could occur and lead...CVE-2020-12405Fix available5.3 Medium
- mozilla firefox for ios, firefox mobile +1 moreFor native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code...CVE-2020-68307.5 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreNSS has shown timing differences when performing DSA signatures, which was exploitable and could...CVE-2020-12399Fix available4.4 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a...CVE-2020-12393Fix available7.8 High
- mozilla firefox, firefox esr +1 moreThe Firefox content processes did not sufficiently lockdown access control which could result in...CVE-2020-12389Fix available10.0 Critical
- mozilla firefox, firefox esr +1 moreThe Firefox content processes did not sufficiently lockdown access control which could result in...CVE-2020-12388Fix available10.0 Critical
- mozilla thunderbird, canonical ubuntu linux +1 moreBy encoding Unicode whitespace characters within the From email header, an attacker can spoof the...CVE-2020-12397Fix available4.3 Medium
- mozilla firefoxMozilla developers and community members reported memory safety bugs present in Firefox 75. Some...CVE-2020-12396Fix available9.8 Critical
- mozilla firefoxA logic flaw in our location bar implementation could have allowed a local attacker to spoof the...CVE-2020-12394Fix available3.3 Low
- mozilla firefoxDocuments formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating...CVE-2020-12391Fix available7.5 High
- Show moreLoading…