CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 02/03/2020 |
| CVE-2020-6794 | 보통6.5 | If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on t | 02/03/2020 |
| CVE-2020-6793 | 보통6.5 | When processing an email message with an ill-formed envelope, Thunderbird could read data from a random memory location. This vulnerability affects Thunderbird < 68.5. | 02/03/2020 |
| CVE-2020-6792 | 보통4.3 | When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. This vulnerability affects Thunderbird < 68.5. | 02/03/2020 |
| CVE-2019-17026KEV | 높음8.8 | Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1. | 02/03/2020 |
| CVE-2020-6804 | 보통6.1 | A reflected XSS vulnerability exists within the gateway, allowing an attacker to craft a specialized URL which could steal the user's authentication token. When combined with CVE-2020-6803, an attacker could fully compromise the system. | 28/02/2020 |
| CVE-2020-6803 | 보통6.1 | An open redirect is present on the gateway's login page, which could cause a user to be redirected to a malicious site after logging in. | 28/02/2020 |
| CVE-2013-4227 | 높음8.8 | Cross-site request forgery (CSRF) vulnerability in the persona_xsrf_token function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for Drupal allows remote attackers to hijack the authentication of aribitrary users via a security token that is not a string data type. | 18/02/2020 |
| CVE-2013-5594 | 보통4.3 | Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml binding | 18/02/2020 |
| CVE-2011-2669 | 보통6.5 | Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates. | 21/01/2020 |
| CVE-2011-2668 | 높음8.8 | Mozilla Firefox through 1.5.0.3 has a vulnerability in processing the content-length header | 21/01/2020 |
| CVE-2011-2670 | 보통6.1 | Mozilla Firefox before 3.6 is vulnerable to XSS via the rendering of Cascading Style Sheets | 13/01/2020 |
| CVE-2019-9812 | 심각9.3 | Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox Sync account. Preference settings that disable the sandbox are then synchronized to the local machine and the c | 08/01/2020 |
| CVE-2019-17025 | 높음8.8 | Mozilla developers reported memory safety bugs present in Firefox 71. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 72. | 08/01/2020 |
| CVE-2019-17024 | 높음8.8 | Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. | 08/01/2020 |
| CVE-2019-17023 | 보통6.5 | After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72. | 08/01/2020 |
| CVE-2019-17022 | 보통6.1 | When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copie | 08/01/2020 |
| CVE-2019-17021 | 보통5.3 | During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. | 08/01/2020 |