Open Source Vulnerabilities

perl-spreadsheet-parseexcel

Spreadsheet::ParseExcel version 0

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could have obscured the prompt, resulting in th...

nodejs-23, nodejs18, nodejs18

untrusted search path vulnerability exists in Node

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HTTP connection, including being same-origin...

nodejs-23, nodejs18, nodejs18

cryptographic vulnerability exists in Node

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user

nodejs-23, nodejs18, nodejs18

privilege escalation vulnerability exists in Node

libidn

stringprep_utf8_nfkc_normalize function in lib/nfkc

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it available on other computers in certa...

libidn

idn in libidn before 1

nodejs-23, nodejs18, nodejs18

privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16

wazuh-dashboard-alerting-dashboards-plugin-fips

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have resulted, leading to memory corruption and a potentially exploitable crash

wazuh-dashboard-alerting-dashboards-plugin-fips

libidn

idna_to_ascii_4i function in lib/idna

nodejs-23, nodejs18, nodejs18

use of `module

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame

libidn

idn in GNU libidn before 1

py3-unoconv

unoconv package before 0

nodejs-23, nodejs18, nodejs18

use of `Module

perl-net-netmask

Net::Netmask module before 2

mrxvt, rxvt-unicode

rxvt-unicode 9

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor

nodejs-23, nodejs-current, nodejs18, nodejs18

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code

rxvt-unicode

rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Using the Location API in a loop could have caused severe application hangs and crashes

nodejs-23, nodejs-current, nodejs18, nodejs18

When the Node

librewolf, librewolf, librewolf, librewolf, librewolf

When receiving a URL through a SEND intent, Firefox would have searched for the text, but subsequent usages of the address bar might have caused the URL to load unintentionally, which could lead to...

dcmtk

DCMTK v3

nodejs-23, nodejs-current, nodejs18, nodejs18

Undici is an HTTP/1

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content

ircii

ircII before 20210314 allows remote attackers to cause a denial of service (segmentation fault and client crash, disconnecting the victim from an IRC server) via a crafted CTCP UTC message

openvswitch, lldpd

flaw was found in multiple versions of OpenvSwitch

debezium-3.7-connector-jdbc, debezium-3.7-connector-jdbc

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols

debezium-3.7-connector-jdbc, debezium-3.7-connector-jdbc

debezium-3.7-connector-jdbc, debezium-3.7-connector-jdbc

debezium-3.7-connector-jdbc, debezium-3.7-connector-jdbc

lldpd

In lldpd before 1

debezium-3.7-connector-jdbc, debezium-3.7-connector-jdbc

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped

dbus

dbus before 1

librewolf, librewolf, librewolf, librewolf, librewolf

WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been uninstalled with the extension

dbus

issue was discovered in dbus >= 1

libinput

format string vulnerability was found in libinput

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers

libgit2

git_oid_nfmt function in commit

dbus

issue was discovered in D-Bus before 1

quickjs

QuickJS commit 2788d71 was discovered to contain a stack-overflow via the component js_proxy_isArray at quickjs

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used fo...