Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2019-11715Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on
- CVE-2019-11716Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPrope
- CVE-2019-11717A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, all
- CVE-2019-11718Activity Stream can display content from sent from the Snippet Service website.
- CVE-2019-11719When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Netw
- CVE-2019-11720Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors.
- CVE-2019-11721The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar.
- CVE-2019-11723A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context.
- CVE-2019-11724Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been retired and now redi
- CVE-2019-11725When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation is interrupted but res
- CVE-2019-11727A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when
- CVE-2019-11728The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that the accessible to a us
- CVE-2019-11729Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into mem
- CVE-2019-11730A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same direc
- CVE-2018-12404A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content.
- CVE-2018-5123A third party website can access information available to a user with access to a restricted bug entry using the image generation in report.
- CVE-2019-9806A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed and cannot be immedia
- CVE-2019-9805A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, leading to potential
- CVE-2019-9804In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the
- CVE-2019-9803The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same-
- CVE-2019-9802If a Sandbox content process is compromised, it can initiate an FTP download which will then use a child process to render the downloaded da
- CVE-2019-9801Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matchi
- CVE-2019-9799Insufficient bounds checking of data during inter-process communication might allow a compromised content process to be able to read memory
- CVE-2019-9798On Android systems, Firefox can load a library from APITRACE_LIB, which is writable by all users and applications.
- CVE-2019-9797Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image
- CVE-2019-9796A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a
- CVE-2019-9795A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to trigg
- CVE-2019-9794A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler
- CVE-2019-9793A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been dis
- CVE-2019-9792The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout.