Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the ch…
UXSS in Focus for iOS / Klar Webkit navigation. This vulnerability was fixed in Focus for iOS 151.3.1 and Klar for iOS 151.3.1.
Firefox
MEDIUM 5.4
Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders. A malicious page could include a…
Firefox
MEDIUM 5.4
Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata. A malicious page could inject markup that changed Reader View beha…
Firefox
CRITICAL 9.1
Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
Firefox
MEDIUM 5.3
Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderb…
Firefox
MEDIUM 5.3
Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
Firefox
HIGH 8.1
Spoofing issue in the Site Permissions component. This vulnerability was fixed in Firefox 143 and Thunderbird 143.
Firefox Focus
MEDIUM 6.1
Dragging JavaScript links to the URL bar in Focus for iOS could be utilized to run malicious scripts, potentially resulting in XSS attacks. This vuln…
Firefox
MEDIUM 6.1
When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `<embed>…
The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containin…
Firefox
MEDIUM 6.1
Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shi…
In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If ther…
Firefox
MEDIUM 6.1
In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, whic…
Firefox
HIGH 7.5
An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin. This could allow…
Firefox
MEDIUM 6.1
Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Firefox for…
Firefox
MEDIUM 6.1
Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129.
Firefox
MEDIUM 6.1
The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129.
Firefox
MEDIUM 6.1
Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a site protected by Content Secur…
Firefox
HIGH 8.2
A file dialog shown while in full-screen mode could have resulted in the window remaining disabled. This vulnerability affects Firefox < 126.
Firefox Focus
MEDIUM 6.1
Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a link to t…
Firefox Focus
MEDIUM 6.1
An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascript URI leading to unauthoriz…
Firefox
MEDIUM 6.1
When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scripting (XSS…
Common Voice is the web app for Mozilla Common Voice, a platform for collecting speech donations in order to create public domain datasets for traini…
Firefox
MEDIUM 6.1
Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.
A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script…
Firefox
MEDIUM 6.1
Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and …
Firefox
MEDIUM 6.5
Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, re…
Firefox
MEDIUM 6.1
When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vuln…
If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the <code>meta</code> tag having the <code>http-equiv=…