161 matches found
CVE-2025-4083 Process isolation bypass using "javascript:" URI links in cross-origin frames
A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability was fixed in Firefox 138, Firefox...
CVE-2025-4083
A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability was fixed in Firefox 138, Firefox...
CVE-2025-4083
CVE-2025-4083 is a process isolation vulnerability in Thunderbird/Firefox caused by improper handling of javascript: URIs, which can let content execute in the top-level process instead of the intended frame, potentially enabling a sandbox escape. Affected: Firefox < 138, Firefox ESR < 128....
CVE-2025-4083 Process isolation bypass using "javascript:" URI links in cross-origin frames
A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability was fixed in Firefox 138, Firefox...
Mozilla Firefox < 138.0
The version of Firefox installed on the remote macOS or Mac OS X host is prior to 138.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-28 advisory. - Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some o...
Mozilla -- javascript content execution
[email protected] reports: A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape...
Security Vulnerabilities fixed in Firefox ESR 115.23 — Mozilla
Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file...
Mozilla Thunderbird < 138.0
The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 138.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-31 advisory. - Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. So...
Mozilla Firefox < 138.0
The version of Firefox installed on the remote Windows host is prior to 138.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-28 advisory. - Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bu...
Security Vulnerabilities fixed in Firefox ESR 128.10 — Mozilla
Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file...
PT-2025-18152
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 138 Firefox ESR versions prior to 128.10 Firefox ESR versions prior to 115.23 Thunderbird versions prior to 138 Thunderbird ESR versions prior to 128.10 Description A process isolation issue stems from improper handli...
[SECURITY] Fedora 40 Update: libkrun-1.10.1-2.fc40
Dynamic library providing Virtualization-based process isolation capabilities...
[SECURITY] Fedora 41 Update: libkrun-1.10.1-2.fc41
Dynamic library providing Virtualization-based process isolation capabilities...
CVE-2023-51518 Apache James server: Privilege escalation via JMX pre-authentication deserialisation
Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note that by default JM...
[SECURITY] Fedora 38 Update: libkrun-1.7.2-4.fc38
Dynamic library providing Virtualization-based process isolation capabilities...
Fedora: Security Advisory for libkrun (FEDORA-2024-f2305d485f)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora: Security Advisory for libkrun (FEDORA-2024-04877592b7)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
GHSA-WJ7F-468M-6MV8 Environment variables still accessible through /proc
Impact Environment variables can be read from procfs unless a new process is started. PoC use birdcage::Birdcage, Sandbox; use std::env, fs; fn main Birdcage::new.lock.unwrap; asserteq!env::varos"SECRET", None; let environ = fs::readtostring"/proc/self/environ".unwrap;...
Fedora: Security Advisory for libkrun (FEDORA-2023-c19aaa2283)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...