| CVE-2022-22761 |
Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors…
|
8.8
High
|
Dec 22, 2022 |
| CVE-2022-22751 |
Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith,…
|
8.8
High
|
Dec 22, 2022 |
| CVE-2022-22741 |
When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode
|
7.5
High
|
Dec 22, 2022 |
| CVE-2022-1802 |
If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have…
|
8.8
High
|
Dec 22, 2022 |
| CVE-2022-1529 |
An attacker could have sent a message to the parent process where the contents were used to double-index into a…
|
8.8
High
|
Dec 22, 2022 |
| CVE-2022-1097 |
NSSToken objects were referenced via direct points, and could have been accessed in an unsafe way on different…
|
6.5
Medium
|
Dec 22, 2022 |
| CVE-2022-0843 |
Mozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present in Firefox 97
|
8.8
High
|
Dec 22, 2022 |
| CVE-2022-0511 |
Mozilla developers and community members Gabriele Svelto, Sebastian Hengst, Randell Jesup, Luan Herrera, Lars T…
|
8.8
High
|
Dec 22, 2022 |
| CVE-2021-4221 |
If a domain name contained a RTL character, it would cause the domain to be rendered to the right of the path
|
4.3
Medium
|
Dec 22, 2022 |
| CVE-2021-4140 |
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox
|
9.8
Critical
|
Dec 22, 2022 |
| CVE-2021-4129 |
Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler,…
|
9.8
Critical
|
Dec 22, 2022 |
| CVE-2021-4128 |
When transitioning in and out of fullscreen mode, a graphics object was not correctly protected; resulting in memory…
|
6.5
Medium
|
Dec 22, 2022 |
| CVE-2021-38503 |
The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions…
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-38504 |
When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have…
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-38505 |
Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied…
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-38506 |
Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-38507 |
The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while…
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-38508 |
By displaying a form validity message in the correct location at the same time as a permission prompt (such as for…
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-38509 |
Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled)…
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-38510 |
The executable file warning was not presented when downloading .inetloc files, which, due to a flaw in Mac OS, can run…
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-43530 |
A Universal XSS vulnerability was present in Firefox for Android resulting from improper sanitization when processing…
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-43531 |
When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element…
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-43532 |
The 'Copy Image Link' context menu action would copy the final image URL after redirects
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-43533 |
When parsing internationalized domain names, high bits of the characters in the URLs were sometimes stripped,…
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-43534 |
Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2
|
Not rated
|
Dec 8, 2021 |