Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 545

Export CSV
CVE-2018-5165

Mozilla: Checkbox for enabling Flash protected mode is inverted in 32-bit Firefox

In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected mode" is unchecked by default even though the Adobe Flash sandbox is actually enabled. The displayed state is the reverse of the true setting, resulting in user confusion. This could cause users to select this setting intending to activate it and inadvertently turn protections off. This vulnerability affects Firefox < 60.

CVSS 3.1 · 5.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Mozilla
Products
Firefox
CVE-2018-18509

thunderbird: flaw in verification of S/MIME signature resulting in signature spoofing

A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird < 60.5.1.

CVSS 3.0 · 5.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Mozilla Redhat
Products
Thunderbird Enterprise Linux
CVE-2018-12382

Mozilla: Addressbar spoofing with javascript URI on Firefox for Android

The displayed addressbar URL can be spoofed on Firefox for Android using a javascript: URI in concert with JavaScript to insert text before the loaded domain name, scrolling the loaded domain out of view to the right. This can lead to user confusion. *This vulnerability only affects Firefox for Android < 62.*

CVSS 3.0 · 5.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Google Mozilla
Products
Android Firefox
CVE-2018-12368

Mozilla: No warning when opening executable SettingContent-ms files

Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the "Mark of the Web." Without the warning, unsuspecting users unfamiliar with this new file type might run an unwanted executable. This also allows a WebExtension with the limited downloads.open permission to execute arbitrary code without user interaction on Windows 10 systems. *Note: this issue only affects Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

CVSS 3.0 · 8.1 High EPSS 4.8% KEV · Not listed
Vendors
Microsoft Mozilla
Products
Windows 10 Firefox Firefox Esr and 1 more
CVE-2024-7529

mozilla: Document content could partially obscure security prompts

The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 6 more