Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2970▼ 106 respecto a la semana anterior
Críticas / altas1447▲ 86 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)350▼ 160 respecto a la semana anterior
228 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Media (4.3) | 2.0% | — | Mozilla FirefoxMozilla ThunderbirdMozilla Thunderbird ESRMozilla Seamonkey | 30/10/2013 | 16/6/2026 | The SELECT element implementation in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 does not properly restrict the nature or placement of HTML within a dropdown menu, which allows remote attackers to spoof the address bar or conduct clickjacking attacks… | |
| Modificada | Alta (10) | 4.4% | — | Mozilla FirefoxMozilla ThunderbirdMozilla Thunderbird ESRMozilla Seamonkey | 30/10/2013 | 16/6/2026 | Unspecified vulnerability in the browser engine in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. | |
| Modificada | Alta (10) | 5.2% | — | Mozilla SeamonkeyMozilla FirefoxMozilla ThunderbirdMozilla Thunderbird ESR | 30/10/2013 | 16/6/2026 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allow remote attackers to cause a denial of service (memory corruption and application… | |
| Modificada | Media (5) | 2.9% | — | Mozilla Thunderbird ESRMozilla SeamonkeyMozilla FirefoxMozilla Thunderbird | 18/9/2013 | 16/6/2026 | Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not properly identify the "this" object during use of user-defined getter methods on DOM proxies, which might allow remote attackers to bypass intended access… | |
| Modificada | Alta (10) | 5.4% | — | Mozilla SeamonkeyMozilla FirefoxMozilla ThunderbirdMozilla Thunderbird ESR | 18/9/2013 | 16/6/2026 | The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to… | |
| Modificada | Alta (9.3) | 4.7% | — | Mozilla FirefoxMozilla Thunderbird ESRMozilla SeamonkeyMozilla Thunderbird | 18/9/2013 | 16/6/2026 | Use-after-free vulnerability in the mozilla::layout::ScrollbarActivity function in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code via vectors related to image-document… | |
| Modificada | Alta (9.3) | 8.9% | — | Mozilla FirefoxMozilla SeamonkeyMozilla Thunderbird ESRMozilla Thunderbird | 18/9/2013 | 16/6/2026 | Buffer overflow in the nsFloatManager::GetFlowArea function in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code via crafted use of lists and floats within a multi-column… | |
| Modificada | Media (6.8) | 2.3% | — | Mozilla ThunderbirdMozilla SeamonkeyMozilla FirefoxMozilla Thunderbird ESR | 18/9/2013 | 16/6/2026 | Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not properly handle movement of XBL-backed nodes between documents, which allows remote attackers to execute arbitrary code or cause a denial of service (JavaScript… | |
| Modificada | Media (6.2) | 0.34% | — | Mozilla Thunderbird ESRMozilla ThunderbirdMozilla FirefoxMozilla Seamonkey | 18/9/2013 | 16/6/2026 | Mozilla Updater in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 does not ensure exclusive access to a MAR file, which allows local users to gain privileges by creating a Trojan horse file after MAR signature… | |
| Modificada | Media (6.8) | 4.0% | — | Mozilla FirefoxMozilla Thunderbird ESRMozilla SeamonkeyMozilla Thunderbird | 18/9/2013 | 16/6/2026 | Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not ensure that initialization occurs for JavaScript objects with compartments, which allows remote attackers to execute arbitrary code by leveraging incorrect scope… | |
| Modificada | Alta (9.3) | 5.7% | — | Mozilla ThunderbirdMozilla FirefoxMozilla Thunderbird ESRMozilla Seamonkey | 18/9/2013 | 16/6/2026 | Use-after-free vulnerability in the nsAnimationManager::BuildAnimations function in the Animation Manager in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code or cause a… | |
| Modificada | Alta (10) | 5.4% | — | Mozilla Thunderbird ESRMozilla ThunderbirdMozilla SeamonkeyMozilla Firefox | 18/9/2013 | 16/6/2026 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly… | |
| Modificada | Media (5.4) | 2.4% | — | Mozilla Thunderbird ESRMozilla FirefoxMozilla SeamonkeyMozilla Thunderbird | 7/8/2013 | 16/6/2026 | Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly restrict local-filesystem access by Java applets, which allows user-assisted remote attackers to read arbitrary files by leveraging a download to a fixed… | |
| Modificada | Media (4.3) | 2.1% | — | Mozilla SeamonkeyMozilla FirefoxMozilla ThunderbirdMozilla Thunderbird ESR | 7/8/2013 | 16/6/2026 | The Web Workers implementation in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 does not properly restrict XMLHttpRequest calls, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site… | |
| Modificada | Media (4.3) | 1.6% | — | Mozilla FirefoxMozilla SeamonkeyMozilla ThunderbirdMozilla Thunderbird ESR | 7/8/2013 | 16/6/2026 | Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 use an incorrect URI within unspecified comparisons during enforcement of the Same Origin Policy, which allows remote attackers to conduct cross-site scripting (XSS)… | |
| Modificada | Media (6.9) | 0.39% | — | Mozilla FirefoxMozilla ThunderbirdMozilla Thunderbird ESR | 7/8/2013 | 16/6/2026 | Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Updater in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8 on Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012 allow local users to gain… | |
| Modificada | Alta (10) | 40% | 💥 Exploit | Mozilla SeamonkeyMozilla Thunderbird ESRMozilla FirefoxMozilla Thunderbird | 7/8/2013 | 16/6/2026 | The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows remote attackers to execute arbitrary JavaScript code or conduct cross-site scripting (XSS) attacks via vectors related… | |
| Modificada | Media (4.3) | 1.3% | — | Mozilla FirefoxMozilla ThunderbirdMozilla Thunderbird ESRMozilla Seamonkey | 7/8/2013 | 16/6/2026 | Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly handle the interaction between FRAME elements and history, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors… | |
| Modificada | Alta (7.2) | 0.33% | — | Mozilla ThunderbirdMozilla Thunderbird ESRMozilla Firefox | 7/8/2013 | 16/6/2026 | Stack-based buffer overflow in Mozilla Updater in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8 allows local users to gain privileges via a long pathname on the command line to the Mozilla Maintenance Service. | |
| Modificada | Alta (7.2) | 0.33% | — | Mozilla FirefoxMozilla ThunderbirdMozilla Thunderbird ESR | 7/8/2013 | 16/6/2026 | Stack-based buffer overflow in maintenanceservice.exe in the Mozilla Maintenance Service in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8 allows local users to gain privileges via a long pathname on the command line. | |
| Modificada | Alta (10) | 4.6% | — | Mozilla SeamonkeyMozilla ThunderbirdMozilla FirefoxMozilla Thunderbird ESR | 7/8/2013 | 16/6/2026 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly… | |
| Modificada | Alta (9.3) | 3.2% | — | Mozilla FirefoxMozilla ThunderbirdMozilla Thunderbird ESR | 26/6/2013 | 16/6/2026 | The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via… | |
| Modificada | Alta (7.5) | 4.6% | — | Mozilla FirefoxMozilla ThunderbirdMozilla Thunderbird ESR | 26/6/2013 | 16/6/2026 | The PreserveWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly handle the lack of a wrapper, which allows remote attackers to cause a denial of service (application crash) or possibly execute… | |
| Modificada | Media (4.3) | 3.7% | — | Mozilla FirefoxMozilla ThunderbirdMozilla Thunderbird ESR | 26/6/2013 | 16/6/2026 | The SVG filter implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to read pixel values, and possibly bypass the Same Origin Policy and read text from a different domain, by observing timing differences… | |
| Modificada | Media (4.3) | 2.0% | — | Mozilla FirefoxMozilla ThunderbirdMozilla Thunderbird ESR | 26/6/2013 | 16/6/2026 | Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not prevent the inclusion of body data in an XMLHttpRequest HEAD request, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web… |