Skip to contentMozilla vulnerabilities
Newest
- mozilla firefoxAn attacker who could have convinced a user to drag and drop an image to a filesystem could have...CVE-2022-34482Fix available8.8 High
- mozilla firefoxWithin the <code>lg_init()</code> function, if several allocations succeed but then one fails, an...CVE-2022-34480Fix available8.8 High
- mozilla firefoxThe MediaError message property should be consistent to avoid leaking information about cross...CVE-2022-34477Fix available7.5 High
- mozilla firefoxASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the...CVE-2022-34476Fix available9.8 Critical
- mozilla firefoxSVG <code><use></code> tags that referenced a same-origin document could have resulted in...CVE-2022-34475Fix available6.1 Medium
- mozilla firefoxEven when an iframe was sandboxed with <code>allow-top-navigation-by-user-activation</code>, if...CVE-2022-34474Fix available6.1 Medium
- mozilla firefoxThe HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code><use>...CVE-2022-34473Fix available6.1 Medium
- mozilla firefoxWhen downloading an update for an addon, the downloaded addon update's version was not verified...CVE-2022-34471Fix available6.5 Medium
- mozilla thunderbirdAn OpenPGP digital signature includes information about the date when the signature was created....CVE-2022-2226Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of...CVE-2022-34484Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreIn the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have...CVE-2022-34481Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA malicious website that could create a popup could have resized the popup to overlay the address...CVE-2022-34479Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIf there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests...CVE-2022-34472Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreSession history navigations may have led to a use-after-free and potentially exploitable crash....CVE-2022-34470Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreAn iframe that was not permitted to run scripts could do so if the user clicked on a <code...CVE-2022-34468Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreIf an object prototype was corrupted by an attacker, they would have been able to set undesired...CVE-2022-2200Fix availableEPSS 23.9%8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen downloading files on Windows, the % character was not escaped, which could have lead to a...CVE-2022-31739Fix available8.8 High
- mozilla firefoxMozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla...CVE-2022-31748Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported...CVE-2022-31747Fix available9.8 Critical
- mozilla firefoxIf array shift operations are not used, the Garbage Collector may have become confused about...CVE-2022-31745Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have injected CSS into stylesheets accessible via internal URIs, such as...CVE-2022-31744Fix available6.5 Medium
- mozilla firefoxFirefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity...CVE-2022-31743Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have exploited a timing attack by sending a large number of allowCredential...CVE-2022-31742Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA crafted CMS message could have been processed incorrectly, leading to an invalid memory read,...CVE-2022-31741Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreOn arm64, WASM code could have resulted in incorrect assembly generation leading to a register...CVE-2022-31740Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen exiting fullscreen mode, an iframe could have confused the browser about the current state...CVE-2022-31738Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory...CVE-2022-31737Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreA malicious website could have learned the size of a cross-origin resource that supported Range...CVE-2022-31736Fix available9.8 Critical
- mozilla thunderbirdWhen displaying the sender of an email, and the sender name contained the Braille Pattern Blank...CVE-2022-1834Fix available6.5 Medium
- mozilla firefox, firefox esr, firefox for android +1 more +3 moreIf an attacker was able to corrupt the methods of an Array object in JavaScript via prototype...CVE-2022-1802Public exploitFix availableEPSS 28.5%8.8 High
- mozilla firefox, firefox esr, firefox for android +1 more +3 moreAn attacker could have sent a message to the parent process where the contents were used to...CVE-2022-1529Fix availableEPSS 17.6%8.8 High
- mozilla convictPrototype PollutionCVE-2022-21190Fix available7.5 High
- mozilla firefoxMozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory...CVE-2022-29918Fix available8.8 High
- mozilla firefoxThe Performance API did not properly hide the fact whether a request cross-origin resource has...CVE-2022-29915Fix available4.3 Medium
- mozilla hawkReDoS vulnerability in header parsing in hawkCVE-2022-29167Fix available7.4 High
- mozilla thunderbirdThe parent process would not properly check whether the Speech Synthesis feature is enabled, when...CVE-2022-29913Fix available6.5 Medium
- mozilla thunderbirdWhen viewing an email message A, which contains an attached message B, where B is encrypted or...CVE-2022-1520Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team...CVE-2022-29917Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreFirefox behaved slightly differently for already known resources when loading CSS resources...CVE-2022-29916Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen reusing existing popups Firefox would have allowed them to cover the fullscreen notification...CVE-2022-29914Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreRequests initiated through reader mode did not properly omit cookies with a SameSite attribute....CVE-2022-29912Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user...CVE-2022-29911Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreDocuments in deeply-nested cross-origin browsing contexts could have obtained permissions granted...CVE-2022-29909Fix available8.8 High
- mozilla geckodriverImproved Host header checks to reject requests not sent to a well-known local hostname or IP, or...CVE-2021-41385.3 Medium
- mozilla convictPrototype PollutionCVE-2022-22143Fix available7.5 High
- mozilla firefoxMozilla developers and community members Randell Jesup, Sebastian Hengst, and the Mozilla Fuzzing...CVE-2022-28288Fix available8.8 High
- mozilla firefoxIn unusual circumstances, selecting text could cause text selection caching to behave incorrectly...CVE-2022-28287Fix available6.5 Medium
- mozilla firefoxSVG's <code><use></code> element could have been used to load unexpected content that could...CVE-2022-28284Fix available8.8 High
- mozilla firefoxThe sourceMapURL feature in devtools was missing security checks that would have allowed a...CVE-2022-28283Fix available6.5 Medium
- mozilla thunderbirdWhen importing a revoked key that specified key compromise as the revocation reason, Thunderbird...CVE-2022-1197Fix available5.4 Medium
- Show moreLoading…