Mozilla

Mozilla 的公开漏洞报告、类别分布与常见资产。

攻击面

弱点类别分布

• 错误配置17
• 信息泄露15
• 访问控制6
• 身份认证4
• 注入与走私4
• 跨站脚本3
• 业务逻辑3
• 代码执行3
• 跨站请求伪造2
• 不安全的直接对象引用2
• 其他弱点2
• 路径遍历2
• 密码学缺陷2
• 拒绝服务1
• SQL 注入1
• 服务端请求伪造1

主要弱点

• 错误配置17
• 信息泄露10
• 访问控制缺陷（通用）4
• 代码注入3
• 敏感信息明文存储3
• 敏感信息明文传输2
• 输入校验不当2
• 缓存投毒2
• Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')2
• 跨站请求伪造2

常见资产

• · 30
• accounts.firefox.comURL · 8
• monitor.mozilla.orgURL · 5
• Mozilla VPN ClientsOTHER · 5
• pontoon.allizom.orgURL · 4
• bugzilla.mozilla.orgURL · 3
• addons.allizom.orgURL · 3
• firefox-ci-tc.services.mozilla.comURL · 2
• community-tc.services.mozilla.comURL · 2
• relay.firefox.comURL · 1

高票报告

当前状态 68 份 · 全部 68

1. 58
   Remote code execution and exfiltration of secret tokens by poisoning the mozilla/fxa CI build cache代码执行 · 2024-01-20 · 严重
   $8,000代码注入
2. 56
   Insecure S3 Bucket Exposing Git Directory in Mozilla Foundation Infographics Project访问控制 · 2024-03-13 · 低危
   $0访问控制缺陷（通用）
3. 56
   RCE on worker host due to unsanitized "env" variable name in task definition on community-tc.services.mozilla.com代码执行 · 2024-12-08 · 低危
   $500代码注入
4. 55
   DOS via cache poisoning on [developer.mozilla.org]注入与走私 · 2023-06-06 · 低危
   $0缓存投毒
5. 53
   Account deletion using the /v1/account/destroy API endpoint using account password without 2FA verification身份认证 · 2024-06-17 · 中危
   $1,000认证缺陷（通用）
6. 53
   Internal Blind Server-Side Request Forgery (SSRF) allows scanning internal ports服务端请求伪造 · 2024-01-13 · 低危
   $0SSRF
7. 52
   Private Emails of Moz Workers Leaked in Public file信息泄露 · 2024-09-04 · 低危
   $0Unlabeled
8. 52
   Subdomain takeover on one of the subdomains under mozaws.net错误配置 · 2024-07-25 · 中危
   $0错误配置
9. 51
   sentry Auth Token exposed publicly in docker hub image信息泄露 · 2024-10-18 · 低危
   $0信息泄露
10. 50
    Race condition leads to add more than 5 email at Data breaches monitor system at https://stage.firefoxmonitor.nonprod.cloudops.mozgcp.net业务逻辑 · 2024-10-18 · 低危
    $0Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
11. 49
    Subdomain takeover on one of the subdomain under mozaws.net错误配置 · 2024-02-11 · 中危
    $0错误配置
12. 49
    Mozilla FuzzManager API Token Exposed in Git Commit信息泄露 · 2023-11-29 · 严重
    $0敏感信息明文存储
13. 49
    Leaking VPN traffic through non-RFC1918 local IP addresses密码学缺陷 · 2024-11-08 · 中危
    $0敏感信息明文传输
14. 47
    User API Key leakage in Github commit leads to unauthorized access to sql.telemetry.mozilla.org信息泄露 · 2024-10-08 · 高危
    $0信息泄露
15. 46
    [Vertical Privilege Escalation] User can Unapproved any Approved Translation at [/translations/unapprove/]访问控制 · 2026-04-10 · 中危
    $0权限提升
16. 46
    Information disclosure on password cancel endpoint信息泄露 · 2024-10-29 · 低危
    $0信息泄露
17. 44
    Subdomain takeover on one of the subdomain under mozaws.net错误配置 · 2024-01-04 · 中危
    $0错误配置
18. 43
    Taskcluster web-server OAuth2 authorization codes are reusable and the exchange handler checks the wrong expiry column身份认证 · 2026-06-23 · 中危
    $2,000Authentication Bypass by Capture-replay
19. 43
    Potential Spoofing Risk through Firefox Private Relay Service注入与走私 · 2023-10-13 · 中危
    $1,000Content Spoofing
20. 42
    paypal client_id And stripe api key indexed on web archive信息泄露 · 2024-10-18 · 低危
    $0信息泄露
21. 42
    Mozilla Employee's Token for sql.telemetry.mozilla.org Exposed in Git Commit信息泄露 · 2023-12-18 · 严重
    $0敏感信息明文存储
22. 42
    HTML Injection at https://stage.firefoxmonitor.nonprod.cloudops.mozgcp.net/user/unsubscribe跨站脚本 · 2023-10-20 · 低危
    $500Cross-Site Scripting (XSS)
23. 41
    MozillaVPN: Elevation of Privilege via a Race Condition Vulnerability业务逻辑 · 2025-07-03 · 中危
    $0Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
24. 41
    Subdomain takeover on one of the subdomain under mozaws.net错误配置 · 2024-02-03 · 中危
    $0错误配置
25. 40
    Subdomain takeover on one of the subdomain under mozaws.net错误配置 · 2024-01-04 · 中危
    $0错误配置