Information Disclosure

Every one of the 263 is a mark on the map. Named now: 1 to 26, most at risk first.

1. The FTP protocol implementation in Mozilla Firefox before 1.5.0.11 and 2.x before 2.0.0.3 allows remote attackers to force the client to connect to other servers, perform a proxie…CVE-2007-1562Mozilla · 14% likely

   CWE-2001 bounty report

2. Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-source: URIs.CVE-2015-7214Mozilla · 6.1% likely

   CWE-200

3. The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain se…CVE-2014-1505Mozilla · 4.0% likely

   CWE-200

4. The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.…CVE-2012-3972Mozilla · 4.0% likely

   CWE-200

5. Other issue in the Storage: IndexedDB componentCVE-2026-6770Mozilla · CVSS 6.5 · 3.9% likelycovered by CyberSIXT

   CWE-200

6. The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processin…CVE-2013-1620Mozilla · 3.7% likely

   CWE-203

7. Mozilla Firefox before 26.0 and SeaMonkey before 2.23 on Linux allow user-assisted remote attackers to read clipboard data by leveraging certain middle-click paste operations.CVE-2013-6672Mozilla · 3.3% likely

   CWE-200

8. Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered through hash codes, and also allows for da…CVE-2017-5378Mozilla · 3.3% likely

   CWE-200

9. The page cache feature in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 can generate hash collisions that cause page data to be appended to th…CVE-2007-0778Mozilla · 3.2% likely

   CWE-200

10. A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. This could result in e…CVE-2018-12365Mozilla · 3.2% likely

    CWE-200

11. When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Pri…CVE-2017-7843Mozilla · 2.9% likely

    CWE-200

12. Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 do not impose certain ECMAScript 6 requirements on JavaScript object properties, which allows remote attackers to bypa…CVE-2015-4478Mozilla · 2.8% likely

    CWE-200

13. Mozilla Firefox before 43.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obt…CVE-2015-7207Mozilla · 2.8% likely

    CWE-200

14. Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extrac…CVE-2017-5407Mozilla · 2.7% likely

    CWE-200

15. An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak informat…CVE-2016-9904Mozilla · 2.7% likely

    CWE-200

16. The SVG Filters implementation in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird E…CVE-2012-0456Mozilla · 2.6% likely

    CWE-200

17. Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for…CVE-2017-5408Mozilla · 2.5% likely

    CWE-200

18. The importScripts function in the Web Workers API implementation in Mozilla Firefox before 43.0 allows remote attackers to bypass the Same Origin Policy by triggering use of the n…CVE-2015-7215Mozilla · 2.5% likely

    CWE-200

19. Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 52.9.CVE-2018-12372Mozilla · 2.5% likely

    CWE-200

20. Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5, when running on Linux systems with gnome-vfs support, might allow remote attackers to read arbitrary files on SSH/sftp s…CVE-2007-5337Mozilla · 2.4% likely

    CWE-200

21. A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of rela…CVE-2017-5454Mozilla · 2.4% likely

    CWE-200

22. If an HTTP authentication prompt is triggered by a background network request from a page or extension, it is displayed over the currently loaded foreground page. Although the pro…CVE-2018-5115Mozilla · 2.4% likely

    CWE-200

23. dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. This vulnerability affects Thunderbird < 52.9.CVE-2018-12373Mozilla · 2.4% likely

    CWE-200

24. The Old Charts implementation in Bugzilla 2.12 through 3.2.8, 3.4.8, 3.6.2, 3.7.3, and 4.1 creates graph files with predictable names in graphs/, which allows remote attackers to…CVE-2010-3764Mozilla · 2.4% likely

    CWE-200

25. Mozilla Firefox before 43.0 stores cookies containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers.CVE-2015-7208Mozilla · 2.4% likely

    CWE-200

26. If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process the tab will open a local file corresponding to the droppe…CVE-2018-5181Mozilla · 2.4% likely

    CWE-200

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.