| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| Mitigation bypass in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| Sandbox escape in the Agent component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| Sandbox escape in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| In EuiccPort.buildUiccAccessRule of EuiccPort.java, there is a possible Confused Deputy due to a confused deputy. This could lead to remote escalation of privilege with execution privileges needed. User interaction is for exploitation. |
| Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| In createDataFlowAsync of data_flow_manager.cc, there is a possible way to trigger an out of bounds write in shared memory due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| In EncodeT140 of TextRtpPayloadEncoderNode.cpp, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| In smmu_unmap_visit_leaf of arm-smmu-v3.c, there is a possible way to release active direct memory access page references during unmapping due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
| Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| In smmu_detach_dev of private/google-modules/iommu/arm-smmu-v3/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c, there is a possible Use After Free due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. |
| In km_os_regen_salt of storage.c, there is a possible way to recover deleted keys due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/save_config by setting pushurl, pushid, and enabled. WindowsPhoneNotify.send in src/pyload/plugins/addons/WindowsPhoneNotify.py then uses http.client.HTTPConnection without pyLoad's pycurl destination validation. When a download completes, the global notification event causes a blind POST from the pyLoad server to the attacker-selected internal host, port, and path. The response is not returned, but the request can probe internal services, reach cloud metadata endpoints, or trigger state-changing internal HTTP endpoints. This issue is fixed in version 0.5.0b3.dev102. |
