File and Path Handling

Every one of the 51 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Directory traversal vulnerability in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8, when using "flat" addons, allows remote attackers to…CVE-2008-0418Mozilla · 8.6% likely

   CWE-22

2. Directory traversal vulnerability in importxml.pl in Bugzilla before 2.22.5, and 3.x before 3.0.5, when --attach_path is enabled, allows remote attackers to read arbitrary files v…CVE-2008-4437Mozilla · 5.6% likely

   CWE-22

3. Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 on Linux allows remote attacker…CVE-2008-4067Mozilla · 4.4% likely

   CWE-22

4. Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypa…CVE-2008-4068Mozilla · 4.2% likely

   CWE-22

5. Mozilla Firefox before 3.0.6 and SeaMonkey do not block links to the (1) about:plugins and (2) about:config URIs from .desktop files, which allows user-assisted remote attackers t…CVE-2009-0356Mozilla · 3.2% likely

   CWE-59

6. Directory traversal vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14 on Windows allows remote attacke…CVE-2011-0071Mozilla · 2.9% likely

   CWE-22

7. If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozi…CVE-2020-15663Mozilla · 2.7% likely

   CWE-427

8. Directory traversal vulnerability in Android Crash Reporter in Mozilla Firefox before 28.0 on Android allows attackers to trigger the transmission of local files to arbitrary serv…CVE-2014-1506Mozilla · 2.3% likely

   CWE-22

9. Development Tools panels of an extension are required to load URLs for the panels as relative URLs from the extension manifest file but this requirement was not enforced in all in…CVE-2018-5112Mozilla · 1.9% likely

   CWE-552

10. GUI overlay vulnerability in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 allows remote attackers to spoof form elements and redirect user inputs via a borderless XU…CVE-2008-1241Mozilla · 1.8% likely

    CWE-59

11. The printing process can bypass local access protections to read files available through symlinks, bypassing local file restrictions. The printing process requires files in a spec…CVE-2018-5107Mozilla · 1.7% likely

    CWE-59

12. Directory traversal vulnerability in Mozilla Firefox before 2.0.0.4 on Windows allows remote attackers to read arbitrary files via ..%5C (dot dot encoded backslash) sequences in a…CVE-2007-3072Mozilla · 1.6% likely

    CWE-22

13. A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the user's profile direct…CVE-2020-6828Mozilla · 1.5% likely

    CWE-22

14. Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that in…CVE-2007-5960Mozilla · 1.5% likely

    CWE-22

15. Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host. This could contribute…CVE-2023-6209Mozilla · 1.4% likely

    CWE-22

16. Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which…CVE-2005-0587Mozilla · 1.4% likely

    CWE-59

17. The Firefox installer on Windows can be made to load malicious DLL files stored in the same directory as the installer when it is run. This allows privileged execution if the inst…CVE-2017-7755Mozilla · 1.4% likely

    CWE-426

18. The "export" function in the Certificate Viewer can force local filesystem navigation when the "common name" in a certificate contains slashes, allowing certificate content to be…CVE-2017-5381Mozilla · 1.2% likely

    CWE-22

19. If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunde…CVE-2021-29969Mozilla · 1.2% likely

    CWE-552

20. Directory traversal vulnerability in the DeviceStorage API in Mozilla FirefoxOS before 1.2.2 allows attackers to bypass the media sandbox protection mechanism, and read or modify…CVE-2014-1507Mozilla · 1.1% likely

    CWE-22

21. On Android systems, Firefox can load a library from APITRACE_LIB, which is writable by all users and applications. This could allow malicious third party applications to execute a…CVE-2019-9798Mozilla · 0.9% likely

    CWE-426

22. When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a string containing unitialized memory in…CVE-2022-45412Mozilla · CVSS 8.8 · 0.8% likely

    CWE-59

23. The executable file warning was not presented when downloading .xrm-ms files. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* T…CVE-2024-3863Mozilla · CVSS 9.8 · 0.8% likely

    CWE-434

24. When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of th…CVE-2023-28163Mozilla · CVSS 6.5 · 0.8% likely

    CWE-22

25. Full screen notification obscured by external programCVE-2023-4053Mozilla · 0.8% likely

    CWE-59

26. An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by exte…CVE-2022-34483Mozilla · CVSS 8.8 · 0.7% likely

    CWE-434

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.