Vulnerabilities > Mozilla > Thunderbird
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-12-09 | CVE-2020-26956 | Cross-site Scripting vulnerability in Mozilla Firefox In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. | 6.1 |
| 2020-12-09 | CVE-2020-26953 | Improper Restriction of Rendered UI Layers or Frames vulnerability in Mozilla Firefox It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the user. | 4.3 |
| 2020-12-09 | CVE-2020-26951 | Cross-site Scripting vulnerability in Mozilla Firefox A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. | 6.1 |
| 2020-12-09 | CVE-2020-26950 | Use After Free vulnerability in Mozilla Firefox ESR In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. | 8.8 |
| 2020-10-22 | CVE-2020-15683 | Use After Free vulnerability in multiple products Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. | 9.8 |
| 2020-10-08 | CVE-2020-15646 | Unspecified vulnerability in Mozilla Thunderbird If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechanism, and the attacker sends a crafted response, then Thunderbird sends username and password over https to a server controlled by the attacker. | 5.9 |
| 2020-10-01 | CVE-2020-15670 | Reachable Assertion vulnerability in Mozilla Firefox and Firefox ESR Mozilla developers reported memory safety bugs present in Firefox for Android 79. | 8.8 |
| 2020-10-01 | CVE-2020-15669 | Use After Free vulnerability in Mozilla Firefox ESR When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. | 8.8 |
| 2020-10-01 | CVE-2020-15664 | Incorrect Authorization vulnerability in Mozilla Firefox and Firefox ESR By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. | 6.5 |
| 2020-10-01 | CVE-2020-15663 | Uncontrolled Search Path Element vulnerability in Mozilla Firefox If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. | 8.8 |