Mozilla

Records4205All Threatist records

Exploited (KEV)15In CISA KEV

CVSS critical1086CVSS 9.0–10.0

CVSS high1350CVSS 7.0–8.9

Exploited now

Mozilla records in CISA KEV

TI-2010-03577 Mozilla Multiple Products Remote Code Execution Vulnerability CRITICAL 100KEV 2025-10-06 TI-2024-08981 Mozilla Firefox Use-After-Free Vulnerability CRITICAL 100KEV 2024-10-15 TI-2023-04799 Google Chromium libvpx Heap Buffer Overflow Vulnerability CRITICAL 97KEV 2023-10-02 TI-2023-04477 Google Chromium WebP Heap-Based Buffer Overflow Vulnerability CRITICAL 97KEV 2023-09-13 TI-2016-07433 Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability CRITICAL 90KEV 2023-06-22 TI-2015-03773 Mozilla Firefox Security Feature Bypass Vulnerability CRITICAL 97KEV 2022-05-25

Components

Products in the NVD configurations · select one to filter the records

Firefox 3445 records CRITICAL Thunderbird 2068 records CRITICAL Seamonkey 704 records CRITICAL Firefox Esr 487 records HIGH Thunderbird Esr 228 records CRITICAL Bugzilla 145 records MEDIUM Mozilla 108 records MEDIUM Firefox Mobile 87 records CRITICAL

Records

228 records in Thunderbird Esr · all components

TI-2013-01487 CVE-2013-1690 · GHSA-m5w3-m6g8-4mhf

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7…

CRITICAL 97KEV

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which al…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.69021 Published 2013-06-26 Partial fix CWE-119

TI-2013-01472 CVE-2013-1675 · GHSA-7cv2-f4f9-vw96

Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6…

CRITICAL 86KEV

Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDO…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.06696 Published 2013-05-16 Partial fix CWE-665

TI-2013-00642 CVE-2013-0758 · GHSA-7p7h-fc6x-mhrh

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2…

HIGH 78

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.73364 Published 2013-01-13 Partial fix CWE-94

TI-2013-00641 CVE-2013-0757 · GHSA-vw2x-fj5h-mmwq

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox…

HIGH 75

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not prevent mod…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.60859 Published 2013-01-13 No fix listed CWE-20

TI-2013-00637 CVE-2013-0753 · GHSA-6x74-c24h-qxmw

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer…

HIGH 72

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thund…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.51324 Published 2013-01-13 Partial fix CWE-416

TI-2013-01505 CVE-2013-1710 · GHSA-q7cm-8gjh-863h

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x…

HIGH 71

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows remote attackers to…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.41711 Published 2013-08-07 Partial fix CWE-20

TI-2012-03413 CVE-2012-3993 · GHSA-3587-g6j7-969g

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox…

HIGH 69

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not properly inte…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.42609 Published 2012-10-10 Fixed CWE-269

TI-2013-02271 CVE-2013-2566 · GHSA-f67x-vqh9-8p43

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte…

HIGH 68

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a l…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.84424 Published 2013-03-14 Will not fix CWE-327

TI-2018-03723 CVE-2018-5159 · GHSA-qchp-2hvj-gj3q

Integer overflow in Mozilla Thunderbird

MEDIUM 61

An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds writes.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.20641 Published 2018-06-11 Fixed in 52.8, 60 CWE-190

TI-2012-03577 CVE-2012-4188 · GHSA-2vjp-w357-hqrg

Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0…

MEDIUM 56

Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.147 Published 2012-10-10 Fixed CWE-119

TI-2012-03575 CVE-2012-4186 · GHSA-q5f9-pv86-jvpw

Heap-based buffer overflow in the nsWaveReader::DecodeAudioData function in Mozilla…

MEDIUM 56

Heap-based buffer overflow in the nsWaveReader::DecodeAudioData function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.147 Published 2012-10-10 Fixed CWE-119

TI-2012-00423 CVE-2012-0470 · GHSA-r5mf-grcq-wjjg

Heap-based buffer overflow in the nsSVGFEDiffuseLightingElement::LightPixel function in…

MEDIUM 55

Heap-based buffer overflow in the nsSVGFEDiffuseLightingElement::LightPixel function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4,…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.10175 Published 2012-04-25 Fixed CWE-119

TI-2013-00680 CVE-2013-0796 · GHSA-7f9w-h963-rcwv

The WebGL subsystem in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5…

MEDIUM 54

The WebGL subsystem in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 on Linux does not properly interact with Mesa d…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.07953 Published 2013-04-03 Partial fix

TI-2012-04872 CVE-2012-5835 · GHSA-wqr9-hj2x-xfmw

Integer overflow in the WebGL subsystem in Mozilla Firefox before 17.0, Firefox ESR 10.x…

MEDIUM 54

Integer overflow in the WebGL subsystem in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.08528 Published 2012-11-21 Fixed CWE-190

TI-2012-03590 CVE-2012-4202 · GHSA-3346-5fc6-qhpc

Heap-based buffer overflow in the image::RasterImage::DrawFrameTo function in Mozilla…

MEDIUM 53

Heap-based buffer overflow in the image::RasterImage::DrawFrameTo function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey befo…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.11079 Published 2012-11-21 Fixed CWE-787

TI-2012-03378 CVE-2012-3957 · GHSA-52qm-v8p3-wc8p

Heap-based buffer overflow in the nsBlockFrame::MarkLineDirty function in Mozilla Firefox…

MEDIUM 53

Heap-based buffer overflow in the nsBlockFrame::MarkLineDirty function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.1…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.07762 Published 2012-08-29 Fixed CWE-787

TI-2012-00422 CVE-2012-0469 · GHSA-86c5-mchr-88xj

Use-after-free vulnerability in the…

MEDIUM 53

Use-after-free vulnerability in the mozilla::dom::indexedDB::IDBKeyRange::cycleCollection::Trace function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.07288 Published 2012-04-25 Fixed CWE-399

TI-2013-04783 CVE-2013-5597 · GHSA-h685-5vjr-p4m8

Use-after-free vulnerability in the nsDocLoader::doStopDocumentLoad function in Mozilla…

MEDIUM 52

Use-after-free vulnerability in the nsDocLoader::doStopDocumentLoad function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06273 Published 2013-10-30 Fixed

TI-2013-01526 CVE-2013-1732 · GHSA-82v3-8qpg-x8r6

Buffer overflow in the nsFloatManager::GetFlowArea function in Mozilla Firefox before…

MEDIUM 52

Buffer overflow in the nsFloatManager::GetFlowArea function in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows re…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.08894 Published 2013-09-18 Partial fix CWE-119

TI-2013-00651 CVE-2013-0767 · GHSA-q6xj-ccv4-mg5m

The nsSVGPathElement::GetPathLengthScale function in Mozilla Firefox before 18.0, Firefox…

MEDIUM 52

The nsSVGPathElement::GetPathLengthScale function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05815 Published 2013-01-13 Partial fix CWE-125

TI-2012-03569 CVE-2012-4180 · GHSA-5gp9-q9jf-wgmv

Heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in…

MEDIUM 52

Heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonk…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.09274 Published 2012-10-10 Fixed CWE-119

TI-2012-03389 CVE-2012-3968 · GHSA-qcpm-mq3m-89w8

Use-after-free vulnerability in the WebGL implementation in Mozilla Firefox before 15.0…

MEDIUM 52

Use-after-free vulnerability in the WebGL implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remot…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05899 Published 2012-08-29 Fixed CWE-416

TI-2012-03384 CVE-2012-3963 · GHSA-6pm7-78w9-hj44

Use-after-free vulnerability in the js::gc::MapAllocToTraceKind function in Mozilla…

MEDIUM 52

Use-after-free vulnerability in the js::gc::MapAllocToTraceKind function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05949 Published 2012-08-29 Fixed CWE-416

TI-2012-03382 CVE-2012-3961 · GHSA-3892-r6vc-28jh

Use-after-free vulnerability in the RangeData implementation in Mozilla Firefox before…

MEDIUM 52

Use-after-free vulnerability in the RangeData implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows r…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06664 Published 2012-08-29 Fixed CWE-416

TI-2013-04789 CVE-2013-5603 · GHSA-82rc-4rrx-5cj2

Use-after-free vulnerability in the nsContentUtils::ContentIsHostIncludingDescendantOf…

MEDIUM 51

Use-after-free vulnerability in the nsContentUtils::ContentIsHostIncludingDescendantOf function in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 allows remo…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05416 Published 2013-10-30 No fix listed

Open these records in search →

Critical	1086
High	1350
Medium	1667
Low	102
No CVSS	0