Skip to contentMozilla vulnerabilities
Newest
- mozilla firefox, firefox esr, thunderbird +2 moreThe Firefox updater created a directory writable by non-privileged users. When uninstalling...CVE-2023-4052Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreFull screen notification obscured by external programCVE-2023-4053Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreFull screen notification obscured by file open dialogCVE-2023-4051Fix available7.5 High
- mozilla firefox, firefox esr, debian linux +2 moreIn some cases, an untrusted input stream was copied to a stack buffer without checking its size....CVE-2023-4050Fix availableEPSS 12.6%7.5 High
- mozilla firefox, firefox esr, debian linux +2 moreRace conditions in reference counting code were found through code inspection. These could have...CVE-2023-4049Fix available5.9 Medium
- mozilla firefox, firefox esr, debian linux +2 moreAn out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in...CVE-2023-4048Fix available7.5 High
- mozilla firefox, firefox esr, debian linux +2 moreA bug in popup notifications delay calculation could have made it possible for an attacker to...CVE-2023-4047Fix available8.8 High
- mozilla firefox, firefox esr, debian linux +2 moreIn some circumstances, a stale value could have been used for a global variable in WASM JIT...CVE-2023-4046Fix available5.3 Medium
- mozilla firefox, firefox esr, debian linux +2 moreOffscreen Canvas did not properly track cross-origin tainting, which could have been used to...CVE-2023-4045Fix available5.3 Medium
- mozilla thunderbird, debian linux +1 moreFile Extension Spoofing using the Text Direction Override CharacterCVE-2023-3417Fix available7.5 High
- mozilla firefox, firefox for ios +1 moreThe session restore helper crashed whenever there was no parameter sent to the message handler....CVE-2023-37456Public exploit6.5 Medium
- mozilla firefox, firefox for ios +1 moreThe permission request prompt from the site in the background tab was overlaid on top of the site...CVE-2023-374555.4 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreUse-after-free in workersCVE-2023-3600Fix available8.8 High
- mozilla firefoxMemory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory...CVE-2023-37212Fix available8.8 High
- mozilla firefoxA website could prevent a user from exiting full-screen mode via alert and prompt calls. This...CVE-2023-37210Fix available6.5 Medium
- mozilla firefoxA use-after-free condition existed in `NotifyOnHistoryReload` where a `LoadingSessionHistoryEntry...CVE-2023-37209Fix available8.8 High
- mozilla firefoxUploading files which contain symlinks may have allowed an attacker to trick a user into...CVE-2023-37206Fix available6.5 Medium
- mozilla firefoxThe use of RTL Arabic characters in the address bar may have allowed for URL spoofing. This...CVE-2023-37205Fix available6.5 Medium
- mozilla firefoxA website could have obscured the fullscreen notification by using an option element by...CVE-2023-37204Fix available6.5 Medium
- mozilla firefoxInsufficient validation in the Drag and Drop API in conjunction with social engineering, may have...CVE-2023-37203Fix available7.8 High
- mozilla firefoxWhen Firefox is configured to block storage of all cookies, it was still possible to store data...CVE-2023-3482Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMemory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of...CVE-2023-37211Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen opening Diagcab files, Firefox did not warn the user that these files may contain malicious...CVE-2023-37208Fix available7.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA website could have obscured the fullscreen notification by using a URL with a scheme handled by...CVE-2023-37207Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreCross-compartment wrappers wrapping a scripted proxy could have caused objects from other...CVE-2023-37202Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreAn attacker could have triggered a use-after-free condition when creating a WebRTC connection...CVE-2023-37201Fix available8.8 High
- mozilla firefoxA compromised child process could have injected XBL Bindings into privileged CSS rules, resulting...CVE-2019-2513610.0 Critical
- mozilla firefox for android, focus for android, firefox focus +1 more +3 moreWhen recording the screen while in Private Browsing on Firefox for Android the address bar and...CVE-2023-295466.5 Medium
- mozilla firefox for android, focus for android, firefox focus +1 more +3 moreDifferent techniques existed to obscure the fullscreen notification in Firefox and Focus for...CVE-2023-295349.1 Critical
- mozilla firefox for android, firefox mobile +1 moreA potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on...CVE-2023-257477.5 High
- mozilla firefoxMemory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory...CVE-2023-34417Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreMemory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of...CVE-2023-34416Fix available9.8 Critical
- mozilla firefoxWhen choosing a site-isolated process for a document loaded from a data: URL that was the result...CVE-2023-34415Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe error page for sites with invalid TLS certificates was missing the
activation-delay Firefox...CVE-2023-34414Fix available3.1 Low
- mozilla firefoxAfter downloading a Windows <code>.scf</code> script from the local filesystem, an attacker could...CVE-2023-257408.8 High
- mozilla firefoxNotification permissions persisted between Normal and Private Browsing on AndroidCVE-2023-236006.5 Medium
- mozilla sccacheLocal Privilege Escalation in sccacheCVE-2023-1521Public exploitFix available7.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreProtocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of...CVE-2023-32214Fix available7.5 High
- mozilla firefoxMemory safety bugs present in Firefox 112. Some of these bugs showed evidence of memory...CVE-2023-32216Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough,...CVE-2023-32215Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen reading a file, an uninitialized value could have been used as read limit. This...CVE-2023-32213Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have positioned a <code>datalist</code> element to obscure the address bar....CVE-2023-32212Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA type checking bug would have led to invalid code being compiled. This vulnerability affects...CVE-2023-32211Fix available6.5 Medium
- mozilla firefoxDocuments were incorrectly assuming an ordering of principal objects when ensuring we were...CVE-2023-32210Fix available6.5 Medium
- mozilla firefoxA maliciously crafted favicon could have led to an out of memory crash. This vulnerability...CVE-2023-32209Fix available7.5 High
- mozilla firefoxService workers could reveal script base URL due to dynamic `import()`. This vulnerability...CVE-2023-32208Fix available5.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA missing delay in popup notifications could have made it possible for an attacker to trick a...CVE-2023-32207Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability...CVE-2023-32206Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIn multiple cases browser prompts could have been obscured by popups controlled by content. These...CVE-2023-32205Fix available4.3 Medium
- mozilla nunjucksNunjucks autoescape bypass leads to cross site scriptingCVE-2023-2142Fix available6.1 Medium
- Show moreLoading…