2018

A buffer overflow vulnerability while parsing "application/http-index-format" format content when the header contains im

An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a p

The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions. On OS OX, this matc

If a malicious site uses the "view-source:" protocol in a series within a single hyperlink, it can trigger a non-exploit

A malicious site could spoof the contents of the print preview window if popup windows are enabled, resulting in user co

If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-respons

In certain circumstances a networking event listener can be prematurely released. This appears to result in a null deref

A buffer overflow read during SVG filter color value operations, resulting in data exposure. This vulnerability affects

A use-after-free can occur during buffer storage operations within the ANGLE graphics library, used for WebGL content. T

A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip i

A location bar spoofing attack where the location bar of loaded page will be shown over the content of another tab due t

A STUN server in conjunction with a large number of "webkitRTCPeerConnection" objects can be used to send large STUN pac

WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, le

Data sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will ignore the referrer-policy r

Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for th

The "export" function in the Certificate Viewer can force local filesystem navigation when the "common name" in a certif

Use-after-free vulnerability in Web Animations when interacting with cycle collection found through fuzzing. This vulner

Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address c

A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability af

An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zon

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin o

External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of

Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a

Use-after-free while manipulating the "navigator" object within WebVR. Note: WebVR is not currently enabled by default.

A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later writers will overflow the buf

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been dis

Redirection from an HTTP connection to a "data:" URL assigns the referring site's origin to the "data:" URL in some circ

Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin. The rendering by the filter is va

WebExtensions can bypass security checks to load privileged URLs and potentially escape the WebExtension sandbox. This v

When a new Firefox profile is created on 64-bit Windows installations, the sandbox for 64-bit NPAPI plugins is not enabl

A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage

A use-after-free during web animations when working with timelines resulting in a potentially exploitable crash. This vu

A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amoun

The location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode, blocking its exiting, and

A previously installed malicious Android application which defines a specific signature-level permissions used by Firefo

A previously installed malicious Android application with same signature-level permissions as Firefox can intercept Auth

A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially

This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Mainten

Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Window

In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on

Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x

The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externa

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class ins

The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary c

The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.External

A vulnerability in open build service allows remote attackers to gain access to source files even though source access i

md_build_attribute in md4c.c in md4c 0.2.6 allows remote attackers to cause a denial of service (Segmentation fault and

portfolioCMS 1.0.5 has SQL Injection via the admin/portfolio.php preview parameter.

An issue was discovered in Free Lossless Image Format (FLIF) 0.3. The TransformPaletteC<FileIO>::process function in tra

tinyexr 0.9.5 has a memory leak in ParseEXRHeaderFromMemory in tinyexr.h.