2021

Mozilla developers reported memory safety bugs present in Firefox 88. Some of these bugs showed evidence of memory corru

A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to

A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to

Address bar search suggestions in private browsing mode were re-using session data from normal mode. *This bug only affe

Firefox for Android would become unstable and hard-to-recover when a website opened too many popups. *This bug only affe

When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping which allowed an atta

Firefox used to cache the last filename used for printing a file. When generating a filename for printing, Firefox usual

When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prev

When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to

If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unp

OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on

A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary m

Proxy functionality built into Hubs Cloud’s Reticulum software allowed access to internal URLs, including the metadata s

A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the co

When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that w

The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal

Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task. If the task

When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to ope

Signatures are written to disk before and read during verification, which might be subject to a race condition when a ma

Mozilla developers and community members reported memory safety bugs present in Firefox 87. Some of these bugs showed ev

Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking re

The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash.

Lack of escaping allowed HTML injection when a webpage was viewed in Reader View. While a Content Security Policy preven

exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input befo

exacqVision Enterprise Manager 20.12 does not sufficiently validate, filter, escape, and/or encode user-controllable inp

When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been inte

A compromised content process could have performed session history manipulations it should not have been able to due to

A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when

If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and gr

Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS pag

Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We p

By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, res

When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with

A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vul

An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker c

Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may crea

If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 thr

Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14

A potential vulnerability has been identified in HPE OneView Global Dashboard release 2.31 which could lead to a local d

The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out

In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum pass

A smart STB product of ZTE is impacted by a permission and access control vulnerability. Due to insufficient protection

A vulnerability in agent program of HelpU remote control solution could allow an authenticated remote attacker to execut

Stored XSS injection vulnerabilities were discovered in the Avaya Aura Experience Portal Web management which could allo

A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any un

A privilege escalation vulnerability was discovered in Avaya Aura Appliance Virtualization Platform Utilities (AVPU) tha

An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Appliance Virt

A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local us

A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local us