Vulnerabilities in Mozilla

1,860 results
Vexday analysis

Com 1.857 CVEs catalogadas e 189 classificadas como críticas, o histórico de vulnerabilidades da Mozilla reflete a complexidade de manter um navegador amplamente adotado. A taxa de exploração ativa — 9 entradas no CISA KEV, representando 0,48% do total — está em linha com a média geral do catálogo, o que indica um nível de exposição operacional compatível com o setor, sem desvio negativo expressivo. O tipo de falha mais recorrente é CWE-416 (use-after-free), uma classe de vulnerabilidade de memória com alto potencial de execução de código, e a CVE mais perigosa atualmente ativa, CVE-2016-9079, apresenta EPSS de 0,8792 — valor elevado que sugere probabilidade significativa de exploração continuada. Os 144 CVEs surgidos nos últimos 90 dias e a existência de 27 provas de conceito públicas reforçam a necessidade de monitoramento contínuo e priorização ágil de patches para ambientes que dependem de produtos Mozilla.

CVE-2021-23957—Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox. Note: This issue only affecteEPSS 0.8%CVE-2021-4138—Improved Host header checks to reject requests not sent to a well-known local hostname or IP, or the server-specified hostname.EPSS 0.8%CVE-2021-38499—Mozilla developers reported memory safety bugs present in Firefox 92. Some of these bugs showed evidence of memory corruption and we presumeEPSS 0.8%CVE-2019-11761—By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact fEPSS 0.8%CVE-2019-9807—When arbitrary text is sent over an FTP connection and a page reload is initiated, it is possible to create a modal alert message with this EPSS 0.8%CVE-2022-45412HIGHWhen resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a sEPSS 0.8%CVE-2023-6207—Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and EPSS 0.8%CVE-2021-29964—A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds reEPSS 0.8%CVE-2020-12404—For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That tokEPSS 0.8%CVE-2022-34478MEDIUMThe <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applications, bypassing theEPSS 0.8%CVE-2017-5394—A location bar spoofing attack where the location bar of loaded page will be shown over the content of another tab due to a series of JavaScEPSS 0.8%CVE-2023-5721—It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient actiEPSS 0.8%CVE-2023-34417CRITICALMemory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption and we presume that with enough effort soEPSS 0.8%CVE-2023-32216—Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bEPSS 0.8%CVE-2021-38494—Mozilla developers reported memory safety bugs present in Firefox 91. Some of these bugs showed evidence of memory corruption and we presumeEPSS 0.8%CVE-2022-45409HIGHThe garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> may not have been calEPSS 0.8%CVE-2020-12412—By navigating a tab using the history API, an attacker could cause the address bar to display the incorrect domain (with the https:// schemeEPSS 0.8%CVE-2022-34481HIGHIn the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the number of elements to replEPSS 0.8%CVE-2023-25734HIGHAfter downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote path that would lead to EPSS 0.8%CVE-2024-5699CRITICALIn violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by spec they should be EPSS 0.8%