Browse CVEs

MEDIUM 6.5 CVE-2024-10465 A clipboard "paste" button could persist across tabs which allowed a spoofing attack. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, … Firefox 128.4.0 / 132.0+ Fix from $1,6002024-10-29 MEDIUM 6.5 CVE-2024-10474 Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circumventing s… Firefox Focus 132.0+ Fix from $1,6002024-10-29 MEDIUM 5.3 CVE-2024-10468 Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash. This vulnerability affects Fi… Firefox 132.0+ Fix from $1,6002024-10-29 HIGH 7.5 CVE-2024-10458 A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects Firefox <… Firefox 115.17 / 128.4.0+ Fix from $1,9502024-10-29 HIGH 7.5 CVE-2024-10459 An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects… Firefox 115.17 / 128.4.0+ Fix from $1,9502024-10-29 MEDIUM 6.5 CVE-2024-10462 Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Th… Firefox 128.4.0 / 132.0+ Fix from $1,6002024-10-29 MEDIUM 6.1 CVE-2024-10461 In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, whic… Firefox 128.4.0 / 132.0+ Fix from $1,6002024-10-29 MEDIUM 5.3 CVE-2024-10460 The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects Firefox <… Firefox 128.4 / 128.4.0+ Fix from $1,6002024-10-29 CRITICAL 9.1 CVE-2024-10004 Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in the padloc… Firefox 131.2.0+ Fix from $2,3002024-10-15 MEDIUM 6.5 CVE-2024-9936 When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitable crash.… Firefox 131.0.3+ Fix from $1,6002024-10-14 CRITICAL 9.8 CVE-2024-9680 KEVEPSS 23% An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of t… Firefox 115.16.0 / 115.16.1+ Fix from $2,3002024-10-09 CRITICAL 9.8 CVE-2024-9401 Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory… Firefox 115.16.0 / 128.3.0+ Fix from $2,3002024-10-01 CRITICAL 9.8 CVE-2024-9402 Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we p… Firefox 128.3.0 / 131.0+ Fix from $2,3002024-10-01 HIGH 8.8 CVE-2024-9400 A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compi… Firefox 128.3.0 / 131.0+ Fix from $1,9502024-10-01 HIGH 7.3 CVE-2024-9403 Memory safety bugs present in Firefox 130. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of the… Firefox 131.0+ Fix from $1,9502024-10-01 CRITICAL 9.8 CVE-2024-9392 A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox < 131, Firefox E… Firefox 115.6.0 / 128.3.0+ Fix from $2,3002024-10-01 HIGH 8.8 CVE-2024-9396 It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to memory cor… Firefox 128.3.0 / 131.0+ Fix from $1,9502024-10-01 HIGH 7.5 CVE-2024-9393 An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin. This could allow t… Firefox 115.16.0 / 128.3+ Fix from $1,9502024-10-01 HIGH 7.5 CVE-2024-9394 An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin. This could allow… Firefox 115.16.0 / 128.3+ Fix from $1,9502024-10-01 HIGH 7.5 CVE-2024-9399 A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service condition. T… Firefox 128.3.0 / 131.0+ Fix from $1,9502024-10-01 MEDIUM 6.5 CVE-2024-9391 A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spo… Firefox 131.0+ Fix from $1,6002024-10-01 MEDIUM 6.1 CVE-2024-9397 A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking. This vu… Firefox 128.3 / 128.3.0+ Fix from $1,6002024-10-01 MEDIUM 5.3 CVE-2024-9395 A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog. *This bug … Firefox 131.0+ Fix from $1,6002024-10-01 MEDIUM 5.3 CVE-2024-9398 By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implem… Firefox 128.3 / 128.3.0+ Fix from $1,6002024-10-01 HIGH 7.5 CVE-2024-8900 An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vulnerability… Firefox 129.0+ Fix from $1,9502024-09-17 MEDIUM 6.1 CVE-2024-8897EPSS 7% Under certain conditions, an attacker with the ability to redirect users to a malicious site via an open redirect on a trusted site, may be able to s… Firefox 130.0.1+ Fix from $1,6002024-09-17 HIGH 7.5 CVE-2024-7652 An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption… Firefox 115.13.0 / 128.0+ Fix from $1,9502024-09-06 MEDIUM 6.5 CVE-2024-8394 When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash.… Thunderbird 128.2.0+ Fix from $1,6002024-09-06 CRITICAL 9.8 CVE-2024-8389 Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of the… Firefox Mitigation only Fix from $2,3002024-09-03 CRITICAL 9.8 CVE-2024-8381 A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment. This v… Firefox 115.15 / 128.2+ Fix from $2,3002024-09-03