Export limit exceeded: 419441 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (4248 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-26975 | 1 Mozilla | 1 Firefox Mobile | 2026-08-19 | 6.5 Medium |
| When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 84. | ||||
| CVE-2020-15668 | 1 Mozilla | 2 Firefox, Firefox Mobile | 2026-08-19 | 4.3 Medium |
| A lock was missing when accessing a data structure and importing certificate information into the trust database. This vulnerability affects Firefox < 80 and Firefox for Android < 80. | ||||
| CVE-2020-15670 | 1 Mozilla | 4 Firefox, Firefox Esr, Firefox Mobile and 1 more | 2026-08-19 | 8.8 High |
| Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 80, Firefox ESR < 78.2, Thunderbird < 78.2, and Firefox for Android < 80. | ||||
| CVE-2020-15666 | 1 Mozilla | 2 Firefox, Firefox Mobile | 2026-08-19 | 6.5 Medium |
| When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message. This level of information leakage is inconsistent with the standardized onerror/onsuccess disclosure and can lead to inferring login status to services or device discovery on a local network among other attacks. This vulnerability affects Firefox < 80 and Firefox for Android < 80. | ||||
| CVE-2020-26977 | 1 Mozilla | 1 Firefox Mobile | 2026-08-19 | 6.5 Medium |
| By attempting to connect a website using an unresponsive port, an attacker could have controlled the content of a tab while the URL bar displayed the original domain. *Note: This issue only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 84. | ||||
| CVE-2020-15671 | 1 Mozilla | 1 Firefox Mobile | 2026-08-19 | 3.1 Low |
| When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input field, resulting in the typed password being saved to the keyboard dictionary. This vulnerability affects Firefox for Android < 80. | ||||
| CVE-2020-12400 | 2 Mozilla, Redhat | 4 Firefox, Firefox Mobile, Enterprise Linux and 1 more | 2026-08-19 | 4.7 Medium |
| When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80. | ||||
| CVE-2020-12401 | 2 Mozilla, Redhat | 4 Firefox, Firefox Mobile, Enterprise Linux and 1 more | 2026-08-19 | 4.7 Medium |
| During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80. | ||||
| CVE-2023-29541 | 2 Mozilla, Redhat | 10 Firefox, Firefox Esr, Firefox Mobile and 7 more | 2026-08-19 | 8.8 High |
| Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands. <br>*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. | ||||
| CVE-2020-6829 | 2 Mozilla, Redhat | 4 Firefox, Firefox Mobile, Enterprise Linux and 1 more | 2026-08-19 | 5.3 Medium |
| When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation. Given an electro-magnetic trace of a few signature generations, the private key could have been computed. This vulnerability affects Firefox < 80 and Firefox for Android < 80. | ||||
| CVE-2023-29543 | 1 Mozilla | 3 Firefox, Firefox Mobile, Focus | 2026-08-19 | 8.8 High |
| An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. | ||||
| CVE-2026-74976 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | 6.5 Medium |
| JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | ||||
| CVE-2026-74951 | 1 Mozilla | 2 Firefox, Firefox Mobile | 2026-08-19 | 6.5 Medium |
| Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154. | ||||
| CVE-2026-74965 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | 8.8 High |
| Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | ||||
| CVE-2026-74963 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | 5.4 Medium |
| Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | ||||
| CVE-2026-74958 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | 7.5 High |
| Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | ||||
| CVE-2026-74956 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | 9.1 Critical |
| Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | ||||
| CVE-2026-74955 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | 8.8 High |
| Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | ||||
| CVE-2026-74954 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | 7.5 High |
| Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | ||||
| CVE-2026-74950 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | 8.8 High |
| Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | ||||