Thu, Mar 27 · 02:15 PM CDTCVE-2025-2857
10.0/10 · Must read/watchNVDvuln
Summary
Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the
CVECVE-2025-2857
SeverityCRITICAL
TypeUPDATED
PublishedThu, Mar 27 · 02:15 PM CDT
ModifiedMon, Apr 13 · 03:16 PM CDT
CVE-2025-0247
9.8/10 · Must read/watchNVDvuln
Summary
Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 134 and Thunderbird 134.
CVECVE-2025-0247
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jan 07 · 04:15 PM CST
ModifiedMon, Apr 13 · 03:16 PM CDT
CVE-2025-1009
9.8/10 · Must read/watchNVDvuln
Summary
An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
CVECVE-2025-1009
SeverityCRITICAL
TypeUPDATED
PublishedTue, Feb 04 · 02:15 PM CST
ModifiedMon, Apr 13 · 03:16 PM CDT
CVE-2025-1016
9.8/10 · Must read/watchNVDvuln
Summary
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability w
CVECVE-2025-1016
SeverityCRITICAL
TypeUPDATED
PublishedTue, Feb 04 · 02:15 PM CST
ModifiedMon, Apr 13 · 03:16 PM CDT
CVE-2025-1017
9.8/10 · Must read/watchNVDvuln
Summary
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135, Firefox ESR 128
CVECVE-2025-1017
SeverityCRITICAL
TypeUPDATED
PublishedTue, Feb 04 · 02:15 PM CST
ModifiedMon, Apr 13 · 03:16 PM CDT
CVE-2025-1020
9.8/10 · Must read/watchNVDvuln
Summary
Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135 and Thunderbird 135.
CVECVE-2025-1020
SeverityCRITICAL
TypeUPDATED
PublishedTue, Feb 04 · 02:15 PM CST
ModifiedMon, Apr 13 · 03:16 PM CDT
CVE-2025-1942
9.8/10 · Must read/watchNVDvuln
Summary
When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string. This vulnerability was fixed in Firefox 136 and Thunderbird 136.
CVECVE-2025-1942
SeverityCRITICAL
TypeUPDATED
PublishedTue, Mar 04 · 02:15 PM CST
ModifiedMon, Apr 13 · 03:16 PM CDT
CVE-2025-4918
9.8/10 · Must read/watchNVDvuln
Summary
An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2.
CVECVE-2025-4918
SeverityCRITICAL
TypeUPDATED
PublishedSat, May 17 · 10:15 PM CDT
ModifiedMon, Apr 13 · 03:17 PM CDT
CVE-2022-36323
9.1/10 · Must read/watchNVDvuln
Summary
Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell.
CVECVE-2022-36323
SeverityCRITICAL
TypeUPDATED
PublishedWed, Aug 10 · 12:15 PM CDT
ModifiedTue, Apr 14 · 09:16 AM CDT
CVE-2023-44373
9.1/10 · Must read/watchNVDvuln
Summary
Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell. Follow-up of CVE-2022-36323.
CVECVE-2023-44373
SeverityCRITICAL
TypeUPDATED
PublishedTue, Nov 14 · 11:15 AM CST
ModifiedTue, Apr 14 · 09:16 AM CDT
CVE-2025-1941
9.1/10 · Must read/watchNVDvuln
Summary
Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability was fixed in Firefox 136.
CVECVE-2025-1941
SeverityCRITICAL
TypeUPDATED
PublishedTue, Mar 04 · 02:15 PM CST
ModifiedMon, Apr 13 · 03:16 PM CDT
CVE-2025-4083
9.1/10 · Must read/watchNVDvuln
Summary
A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR
CVECVE-2025-4083
SeverityCRITICAL
TypeUPDATED
PublishedTue, Apr 29 · 02:15 PM CDT
ModifiedMon, Apr 13 · 03:16 PM CDT
CVE-2022-31765
8.8/10 · Worth your timeNVDvuln
Summary
Affected devices do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileges.
CVECVE-2022-31765
SeverityHIGH
TypeUPDATED
PublishedTue, Oct 11 · 11:15 AM CDT
ModifiedTue, Apr 14 · 09:16 AM CDT
CVE-2023-21529
8.8/10 · Worth your timeNVDvuln
Summary
Microsoft Exchange Server Remote Code Execution Vulnerability
CVECVE-2023-21529
SeverityHIGH
TypeUPDATED
PublishedTue, Feb 14 · 08:15 PM CST
ModifiedMon, Apr 13 · 07:00 PM CDT
CVE-2025-1010
8.8/10 · Worth your timeNVDvuln
Summary
An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
CVECVE-2025-1010
SeverityHIGH
TypeUPDATED
PublishedTue, Feb 04 · 02:15 PM CST
ModifiedMon, Apr 13 · 03:16 PM CDT
CVE-2025-1011
8.8/10 · Worth your timeNVDvuln
Summary
A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
CVECVE-2025-1011
SeverityHIGH
TypeUPDATED
PublishedTue, Feb 04 · 02:15 PM CST
ModifiedMon, Apr 13 · 03:16 PM CDT
CVE-2025-1014
8.8/10 · Worth your timeNVDvuln
Summary
Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
CVECVE-2025-1014
SeverityHIGH
TypeUPDATED
PublishedTue, Feb 04 · 02:15 PM CST
ModifiedMon, Apr 13 · 03:16 PM CDT
CVE-2025-1930
8.8/10 · Worth your timeNVDvuln
Summary
On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
CVECVE-2025-1930
SeverityHIGH
TypeUPDATED
PublishedTue, Mar 04 · 02:15 PM CST
ModifiedMon, Apr 13 · 03:16 PM CDT
CVE-2025-2817
8.8/10 · Worth your timeNVDvuln
Summary
Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled by
CVECVE-2025-2817
SeverityHIGH
TypeUPDATED
PublishedTue, Apr 29 · 02:15 PM CDT
ModifiedMon, Apr 13 · 03:16 PM CDT
CVE-2025-4919
8.8/10 · Worth your timeNVDvuln
Summary
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2.
CVECVE-2025-4919
SeverityHIGH
TypeUPDATED
PublishedSat, May 17 · 10:15 PM CDT
ModifiedMon, Apr 13 · 03:17 PM CDT
CVE-2024-56181
8.2/10 · Worth your timeNVDvuln
Summary
A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC IPC BX-21A (All versions < V31.01.07), SIMATIC IPC BX-32A (All versions < V29.01.07), SIMATIC IPC BX-39A (All versions < V29.01.07), SIMATIC IPC BX-59A (All versions < V32.01.04), SIMATIC IPC PX-32A (All versions < V29.01.07), SIMATIC IP
CVECVE-2024-56181
SeverityHIGH
TypeUPDATED
PublishedTue, Mar 11 · 10:15 AM CDT
ModifiedTue, Apr 14 · 09:16 AM CDT
CVE-2024-56182
8.2/10 · Worth your timeNVDvuln
Summary
A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC Field PG M6 (All versions < V26.01.12), SIMATIC IPC BX-21A (All versions < V31.01.07), SIMATIC IPC BX-32A (All versions < V29.01.07), SIMATIC IPC BX-39A (All versions < V29.01.07), SIMATIC IPC BX-59A (All versions < V32.01.04), SIMATIC I
CVECVE-2024-56182
SeverityHIGH
TypeUPDATED
PublishedTue, Mar 11 · 10:15 AM CDT
ModifiedTue, Apr 14 · 09:16 AM CDT
CVE-2025-1943
8.2/10 · Worth your timeNVDvuln
Summary
Memory safety bugs present in Firefox 135 and Thunderbird 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 136 and Thunderbird 136.
CVECVE-2025-1943
SeverityHIGH
TypeUPDATED
PublishedTue, Mar 04 · 02:15 PM CST
ModifiedMon, Apr 13 · 03:16 PM CDT
CVE-2025-1932
8.1/10 · Worth your timeNVDvuln
Summary
An inconsistent comparator in xslt/txNodeSorter could have resulted in potentially exploitable out-of-bounds access. Only affected version 122 and later. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
CVECVE-2025-1932
SeverityHIGH
TypeUPDATED
PublishedTue, Mar 04 · 02:15 PM CST
ModifiedMon, Apr 13 · 03:16 PM CDT
CVE-2025-3030
8.1/10 · Worth your timeNVDvuln
Summary
Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 137, Firefox ESR 128
CVECVE-2025-3030
SeverityHIGH
TypeUPDATED
PublishedTue, Apr 01 · 01:15 PM CDT
ModifiedMon, Apr 13 · 03:16 PM CDT
