2023

Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of th

eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnera

eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnera

Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8 via evvtgendoc.

Cross-Site Request Forgery (CSRF) in GitHub repository tsolucio/corebos prior to 8.

Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.

Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.

Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.

An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox <

A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ESR

An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Fire

In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to pote

Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may

A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affec

When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, w

If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused mem

Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in s

Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-ext

Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resul

A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen

Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website

When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable na

When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual lo

The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potenti

When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within

Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorre

Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private brows

Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to thes

By displaying a prompt with a long description, the fullscreen notification could have been hidden, resulting in potenti

When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. This

When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shippe

Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resu

A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser in

The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted

A duplicate `SystemPrincipal` object could be created when parsing a non-system html document via `DOMParser::ParseFromS

Regular expressions used to filter out forbidden properties and values from style directives in calls to `console.log` w

A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src head

Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to webs

Per origin notification permissions were being stored in a way that didn't take into account what browsing context the p

When copying a network request from the developer tools panel as a curl command the output was not being properly saniti

Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing f

A compromised web child process could disable web security opening restrictions, leading to a new child process being sp

Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable cr

If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and d

OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certif

Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certific

A vulnerability classified as critical has been found in Campcodes Retro Cellphone Online Store 1.0. Affected is an unkn

Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4.

A vulnerability was found in code-projects Agro-School Management System 1.0. It has been classified as critical. Affect

A vulnerability was found in code-projects Agro-School Management System 1.0 and classified as critical. This issue affe