Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
Firefox
MEDIUM 5.3
On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will have an arbitrary domains as th…
Firefox
MEDIUM 5.3
WebExtensions could use popups and panels in the extension UI to load an "about:" privileged URL, violating security checks that disallow this behavi…
Firefox
MEDIUM 5.3
A spoofing vulnerability can occur when a page switches to fullscreen mode without user notification, allowing a fake address bar to be displayed. Th…
Firefox
HIGH 7.5
If a long user name is used in a username/password combination in a site URL (such as " http://UserName:[email protected]"), the resulting modal p…
Firefox
HIGH 7.5
The destructor function for the "WindowsDllDetourPatcher" class can be re-purposed by malicious code in concert with another vulnerability to write a…
Firefox
HIGH 7.5
The "Mark of the Web" was not correctly saved on Windows when files with very long names were downloaded from the Internet. Without the Mark of the W…
Firefox
MEDIUM 5.9
A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendered. This w…
Firefox
MEDIUM 5.3
Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name s…
Firefox
MEDIUM 5.3
Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rend…
Firefox
MEDIUM 5.3
Android intents can be used to launch Firefox for Android in reader mode with a user specified URL. This allows an attacker to spoof the contents of …
Firefox
HIGH 7.5
A mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI. On Firefox for Android, the base domain is parsed incorrectly, mak…
Firefox
HIGH 7.5
A malicious site could spoof the contents of the print preview window if popup windows are enabled, resulting in user confusion of what site is curre…
Firefox
HIGH 7.5
If a malicious site uses the "view-source:" protocol in a series within a single hyperlink, it can trigger a non-exploitable browser crash when the h…
Firefox
MEDIUM 6.5
A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an attacker t…
Firefox
MEDIUM 5.3
When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the addressbar so that the displa…
Firefox
MEDIUM 5.3
An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leading to user confusion and furth…
Firefox
HIGH 7.5
The location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode, blocking its exiting, and creating of a fake location …
Firefox
MEDIUM 5.9
An issue where a "<select>" dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks. This attack requires e1…
Firefox
MEDIUM 6.5
During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Firefox < 50.
Firefox
MEDIUM 6.5
A mechanism where disruption of the loading of a new web page can cause the previous page's favicon and SSL indicator to not be reset when the new pa…
Firefox
MEDIUM 5.5
A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45.5, Firef…
Firefox
MEDIUM 5.5
When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be appended to an arbitrary local …
Firefox
MEDIUM 5.5
The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerabilit…
An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character en…
Firefox
HIGH 7.4
Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinnin…
Firefox
HIGH 8.8
The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 does not properly perform a cast …
Firefox
MEDIUM 5.3
Mozilla Firefox before 48.0 on Android allows remote attackers to spoof the address bar via left-to-right characters in conjunction with a right-to-l…
Firefox
MEDIUM 6.5
Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 on Linux make cairo _cairo_surface_get_extents calls that do not properly interact with …
Firefox
HIGH 7.4
Mozilla Firefox before 44.0 allows user-assisted remote attackers to spoof a trailing substring in the address bar by leveraging a user's paste of a …
Firefox
MEDIUM 5.0
Mozilla Firefox before 43.0 mishandles the # (number sign) character in a data: URI, which allows remote attackers to spoof web sites via unspecified…