CVE Vulnerability Catalog

Under specific circumstances a WebExtension may have received a jar:file:/// URI instead of a moz-extension:/// URI during a load request. This leaked directory paths on the user's machine. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced, resulting in memory corruption and a potentially exploitable crash. Affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

A website could obscure the fullscreen notification by using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. This could lead to user confusion and possible spoofing attacks. Affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would resolve those in the context of the current user. This bug only affects Firefox on Windows.

When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have led future code to be incorrect and vulnerable. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially exploitable crash. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Members of the DEVMODEW struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the browser to attempt out of bounds access to related variables. This bug only affects Firefox on Windows.

A background script invoking requestFullscreen and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

The Content-Security-Policy-Report-Only header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Firefox allowed navigation when dragging a URL from a cross-origin iframe into the same tab, which could lead to website spoofing attacks. The vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7.

When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7.

Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged, a website could arbitrarily read a file via a call to DataTransfer.setData. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7.

Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 102.10 and Firefox ESR < 102.10.

If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way, Thunderbird repeatedly attempts to process and display the message, which could cause the user interface to lock up and stop responding. An attacker could send a crafted message with this structure to attempt a DoS attack. This vulnerability affects Thunderbird < 102.8.

Thunderbird versions from 68 to 102.9.1 did not check the OCSP revocation status of recipient certificates when sending S/MIME encrypted email, so revoked certificates were accepted. The vulnerability affects Thunderbird < 102.10.

Certificate OCSP revocation status was not checked when verifying S/MIME signatures. Mail signed with a revoked certificate would be displayed as having a valid signature. Thunderbird versions from 68 to 102.7.0 were affected.

A critical vulnerability has been found in Campcodes Retro Cellphone Online Store version 1.0. Manipulation of the 'category' argument in the /admin/modal_add_product.php file leads to SQL injection, allowing for remote attack execution.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository zadam/trilium prior to version 0.59.4, allowing for the storage of malicious code.