Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 504

Export CSV
CVE-2013-0757

Mozilla: Chrome Object Wrapper (COW) bypass through changing prototype (MFSA 2013-14)

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not prevent modifications to the prototype of an object, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by referencing Object.prototype.__proto__ in a crafted HTML document.

CVSS 2.0 · 9.3 Critical EPSS 60.9% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 6 more
CVE-2013-0758

Mozilla: Chrome Object Wrapper (COW) bypass through plugin objects (MFSA 2013-15)

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging improper interaction between plugin objects and SVG elements.

CVSS 2.0 · 9.3 Critical EPSS 73.4% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 13 more
CVE-2013-0759

Mozilla: URL spoofing in addressbar during page loads (MFSA 2013-04)

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to spoof the address bar via vectors involving authentication information in the userinfo field of a URL, in conjunction with a 204 (aka No Content) HTTP status code.

CVSS 2.0 · 5.0 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 13 more
CVE-2013-0760

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

Buffer overflow in the CharDistributionAnalysis::HandleOneChar function in Mozilla Firefox before 18.0, Thunderbird before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted document.

CVSS 2.0 · 9.3 Critical EPSS 5.3% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 6 more
CVE-2013-0761

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

Use-after-free vulnerability in the mozilla::TrackUnionStream::EndTrack implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.4% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 6 more
CVE-2013-0762

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

Use-after-free vulnerability in the imgRequest::OnStopFrame function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.7% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 13 more
CVE-2013-0763

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

Use-after-free vulnerability in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to Mesa drivers and a resized WebGL canvas.

CVSS 2.0 · 9.3 Critical EPSS 4.4% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 11 more
CVE-2013-0764

Mozilla: Crash due to handling of SSL on threads (MFSA 2013-07)

The nsSOCKSSocketInfo::ConnectToProxy function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not ensure thread safety for SSL sessions, which allows remote attackers to execute arbitrary code via crafted data, as demonstrated by e-mail message data.

CVSS 2.0 · 9.3 Critical EPSS 3.1% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 6 more
CVE-2013-0766

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

Use-after-free vulnerability in the ~nsHTMLEditRules implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.7% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 13 more
CVE-2013-0767

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

The nsSVGPathElement::GetPathLengthScale function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.8% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 13 more
CVE-2013-0768

Mozilla: Buffer Overflow in Canvas (MFSA 2013-03)

Stack-based buffer overflow in the Canvas implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via an HTML document that specifies invalid width and height values.

CVSS 2.0 · 9.3 Critical EPSS 7.6% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 10 more
CVE-2013-0769

Mozilla: Miscellaneous memory safety hazards (rv:10.0.12) (MFSA 2013-01)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 9.3 Critical EPSS 5.8% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 13 more
CVE-2013-0770

Mozilla: Miscellaneous memory safety hazards (rv:18.0/rv:17.0.1) (MFSA 2013-01)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 18.0, Thunderbird before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 9.3 Critical EPSS 5.9% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 6 more
CVE-2013-0771

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

Heap-based buffer overflow in the gfxTextRun::ShrinkToLigatureBoundaries function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted document.

CVSS 2.0 · 9.3 Critical EPSS 5.3% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 6 more
CVE-2013-0800

Mozilla: Out-of-bounds write in Cairo library (MFSA 2013-31)

Integer signedness error in the pixman_fill_sse2 function in pixman-sse2.c in Pixman, as distributed with Cairo and used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to execute arbitrary code via crafted values that trigger attempted use of a (1) negative box boundary or (2) negative box size, leading to an out-of-bounds write operation.

CVSS 2.0 · 6.8 Medium EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 9 more
CVE-2012-2039

flash-plugin: multiple code execution flaws (APSB12-14)

Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.7% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Air Flash Player Macos and 11 more
CVE-2013-1861

mysql: geometry query crashes mysqld (CPU July 2013)

MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is not properly handled when processing the binary representation of this feature, related to a numeric calculation error.

CVSS 2.0 · 5.0 Medium EPSS 18.8% KEV · Not listed
Vendors
Canonical Debian Mariadb and 4 more
Products
Ubuntu Linux Debian Linux Mariadb and 6 more
CVE-2013-2555

flash-plugin: Remote attackers able to execute arbitrary code via vectors that leverage an 'overflow' (CanSecWest 2013)

Integer overflow in Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.

CVSS 2.0 · 10.0 Critical EPSS 8.5% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Air Flash Player Macos and 11 more
CVE-2013-2728

flash-plugin: multiple code execution flaws (APSB13-14)

Adobe Flash Player before 10.3.183.86 and 11.x before 11.7.700.202 on Windows and Mac OS X, before 10.3.183.86 and 11.x before 11.2.202.285 on Linux, before 11.1.111.54 on Android 2.x and 3.x, and before 11.1.115.58 on Android 4.x; Adobe AIR before 3.7.0.1860; and Adobe AIR SDK & Compiler before 3.7.0.1860 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-3324, CVE-2013-3325, CVE-2013-3326, CVE-2013-3327, CVE-2013-3328, CVE-2013-3329, CVE-2013-3330, CVE-2013-3331, CVE-2013-3332, CVE-2013-3333, CVE-2013-3334, and CVE-2013-3335.

CVSS 2.0 · 10.0 Critical EPSS 5.3% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Adobe Air Adobe Air Sdk Flash Player and 12 more
CVE-2013-3324

flash-plugin: multiple code execution flaws (APSB13-14)

Adobe Flash Player before 10.3.183.86 and 11.x before 11.7.700.202 on Windows and Mac OS X, before 10.3.183.86 and 11.x before 11.2.202.285 on Linux, before 11.1.111.54 on Android 2.x and 3.x, and before 11.1.115.58 on Android 4.x; Adobe AIR before 3.7.0.1860; and Adobe AIR SDK & Compiler before 3.7.0.1860 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2728, CVE-2013-3325, CVE-2013-3326, CVE-2013-3327, CVE-2013-3328, CVE-2013-3329, CVE-2013-3330, CVE-2013-3331, CVE-2013-3332, CVE-2013-3333, CVE-2013-3334, and CVE-2013-3335.

CVSS 2.0 · 10.0 Critical EPSS 5.4% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Adobe Air Adobe Air Sdk Flash Player and 12 more