Skip to contentMozilla vulnerabilities
Newest
- mozilla firefox, firefox esr, thunderbird +2 moreIf a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have...CVE-2022-45418Fix available6.1 Medium
- mozilla firefoxService Workers did not detect Private Browsing Mode correctly in all cases, which could have led...CVE-2022-454174.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreKeyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread...CVE-2022-45416Fix available6.5 Medium
- mozilla firefoxWhen downloading an HTML file, if the title of the page was formatted as a filename with a...CVE-2022-454157.8 High
- mozilla firefoxUsing the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a...CVE-2022-45413Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be...CVE-2022-45412Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreCross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing...CVE-2022-45411Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the...CVE-2022-45410Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe garbage collector could have been aborted in several states and zones and <code>GCRuntime:...CVE-2022-45409Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreThrough a series of popups that reuse windowName, an attacker can cause a window to go fullscreen...CVE-2022-45408Fix available6.5 Medium
- mozilla firefoxIf an attacker loaded a font using <code>FontFace()</code> on a background worker, a use-after...CVE-2022-454077.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreIf an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may...CVE-2022-45406Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreFreeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have...CVE-2022-45405Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThrough a series of popup and <code>window.print()</code> calls, an attacker can cause a window...CVE-2022-45404Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreService Workers should not be able to infer information about opaque cross-origin responses; but...CVE-2022-45403Fix available6.5 Medium
- mozilla thunderbirdWhen saving or opening an email attachment on macOS, Thunderbird did not set attribute com.apple...CVE-2022-31557.8 High
- mozilla firefoxLogins saved by Firefox should be managed by the Password Manager component which uses encryption...CVE-2022-42931Fix available3.3 Low
- mozilla firefoxIf two Workers were simultaneously initializing their CacheStorage, a data race could have...CVE-2022-42930Fix available7.1 High
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present...CVE-2022-42932Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreIf a website called <code>window.print()</code> in a particular way, it could cause a denial of...CVE-2022-42929Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreCertain types of allocations were missing annotations that, if the Garbage Collector was in a...CVE-2022-42928Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking...CVE-2022-42927Fix available8.1 High
- mozilla nss, network security services +1 moreA vulnerability found in nss. By this security vulnerability, nss client auth crash without a...CVE-2022-3479Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreInconsistent data in instruction and data cache when creating wasm code could lead to a...CVE-2022-40957Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn out-of-bounds read can occur when decoding H264 video. This results in a potentially...CVE-2022-3266Fix available5.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the...CVE-2022-40962Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreConcurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a...CVE-2022-40960Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreDuring iframe navigation, certain pages did not have their FeaturePolicy fully initialized...CVE-2022-40959Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreBy injecting a cookie with certain special characters, an attacker on a shared subdomain which is...CVE-2022-40958Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen injecting an HTML base element, some requests would ignore the CSP's base-uri settings and...CVE-2022-40956Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen opening a Windows shortcut from the local filesystem, an attacker could supply a remote path...CVE-2022-36314Fix available5.5 Medium
- mozilla firefoxWhen a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should...CVE-2022-34469Fix available8.1 High
- mozilla thunderbirdWhen receiving an HTML email that specified to load an <code>iframe</code> element from a remote...CVE-2022-3034Fix available4.3 Medium
- mozilla thunderbirdIf a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with...CVE-2022-3033Fix available8.1 High
- mozilla thunderbirdWhen receiving an HTML email that contained an <code>iframe</code> element, which used a <code...CVE-2022-3032Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMembers the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR...CVE-2022-38478Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present...CVE-2022-38477Fix available8.8 High
- mozilla firefox esr, thunderbird +1 moreA data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use...CVE-2022-38476Fix available7.5 High
- mozilla firefoxAn attacker could have written a value to the first element in a zero-length JavaScript array....CVE-2022-38475Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions ...CVE-2022-38473Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have abused XSLT error handling to associate attacker-controlled content with...CVE-2022-38472Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox...CVE-2022-2505Fix available8.8 High
- mozilla firefoxMozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox...CVE-2022-36320Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreWhen combining CSS properties for overflow and transform, the mouse cursor could interact with...CVE-2022-36319Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen visiting directory listings for `chrome://` URLs as source text, some parameters were...CVE-2022-36318Fix available5.3 Medium
- mozilla firefoxWhen using the Performance API, an attacker was able to notice subtle differences between...CVE-2022-36316Fix available6.1 Medium
- mozilla firefoxWhen loading a script with Subresource Integrity, attackers with an injection capability could...CVE-2022-36315Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver...CVE-2022-34478Fix available6.5 Medium
- mozilla firefoxMozilla developers Bryce Seager van Dyk and the Mozilla Fuzzing Team reported potential...CVE-2022-34485Fix available9.8 Critical
- mozilla firefoxAn attacker who could have convinced a user to drag and drop an image to a filesystem could have...CVE-2022-34483Fix available8.8 High
- Show moreLoading…