Misconfiguration and Insecure Design

Every one of the 143 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by changing certain properties of the window navigator object (wind…CVE-2006-3677Mozilla · 80% likely

   CWE-16

2. Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting…CVE-2009-1312Mozilla · 5.6% likely

   CWE-16

3. Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a downlo…CVE-2009-3376Mozilla · 3.2% likely

   CWE-16

4. Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allow remote attackers to execute arbitrary Javascript with user privileges by using the Script object to modify XPCNativ…CVE-2007-5338Mozilla · 3.2% likely

   CWE-16

5. Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 can hide the window's titlebar when displaying XUL markup language documents, which makes it easier for remote attackers…CVE-2007-5334Mozilla · 3.0% likely

   CWE-16

6. The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers…CVE-2014-1480Mozilla · 2.7% likely

   CWE-1021

7. Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information by using an IFRAME element in conjun…CVE-2014-1483Mozilla · 2.4% likely

   CWE-1021

8. Mozilla Firefox before 26.0 and SeaMonkey before 2.23 do not properly consider the sandbox attribute of an IFRAME element during processing of a contained OBJECT element, which al…CVE-2013-5614Mozilla · 2.4% likely

   CWE-1021

9. The event-management implementation in Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly select the contex…CVE-2011-2981Mozilla · 2.3% likely

   CWE-16

10. The browser engine in Mozilla Firefox before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application cras…CVE-2009-1303Mozilla · 1.8% likely

    CWE-16

11. Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top an uncontrolled webpa…CVE-2021-38509Mozilla · 1.8% likely

    CWE-1021

12. By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could have obscured the promp…CVE-2021-38508Mozilla · 1.6% likely

    CWE-1021

13. Mozilla Firefox 2.0.0.1 and earlier does not prompt users before saving bookmarklets, which allows remote attackers to bypass the same-domain policy by tricking a user into saving…CVE-2007-1084Mozilla · 1.5% likely

    CWE-16

14. Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI incl…CVE-2021-38506Mozilla · 1.5% likely

    CWE-1021

15. It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and…CVE-2021-43546Mozilla · 1.5% likely

    CWE-1021

16. Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey do not properly implement the Same Origin Policy for (1) XMLHttpRequest, involving a mismatch for a document's principal,…CVE-2009-1309Mozilla · 1.4% likely

    CWE-16

17. The jar: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not follow the Content-Disposition header of the inner URI, which allows remote attack…CVE-2009-1306Mozilla · 1.3% likely

    CWE-16

18. It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the use…CVE-2020-26953Mozilla · 1.3% likely

    CWE-1021

19. When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downlo…CVE-2018-18496Mozilla · 1.2% likely

    CWE-1021

20. Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird < 78…CVE-2020-15648Mozilla · 1.1% likely

    CWE-1021

21. A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefo…CVE-2022-31736Mozilla · CVSS 9.8 · 1.1% likely

    CWE-942

22. When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other orig…CVE-2021-23976Mozilla · 1.1% likely

    CWE-1021

23. If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a link that, when click…CVE-2022-26384Mozilla · CVSS 9.6 · 1.0% likely

    CWE-693

24. It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay. This vulnerability affect…CVE-2023-5721Mozilla · 0.8% likely

    CWE-1021

25. Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Se…CVE-2022-22761Mozilla · CVSS 8.8 · 0.8% likely

    CWE-693

26. If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler…CVE-2022-22759Mozilla · CVSS 9.6 · 0.8% likely

    CWE-693

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.