Mozilla

Mozilla 的公开漏洞报告、类别分布与常见资产。

攻击面

弱点类别分布

• 错误配置17
• 信息泄露15
• 访问控制6
• 身份认证4
• 注入与走私4
• 跨站脚本3
• 业务逻辑3
• 代码执行3
• 跨站请求伪造2
• 不安全的直接对象引用2
• 其他弱点2
• 路径遍历2
• 密码学缺陷2
• 拒绝服务1
• SQL 注入1
• 服务端请求伪造1

主要弱点

• 错误配置17
• 信息泄露10
• 访问控制缺陷（通用）4
• 代码注入3
• 敏感信息明文存储3
• 敏感信息明文传输2
• 输入校验不当2
• 缓存投毒2
• Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')2
• 跨站请求伪造2

常见资产

• · 30
• accounts.firefox.comURL · 8
• monitor.mozilla.orgURL · 5
• Mozilla VPN ClientsOTHER · 5
• pontoon.allizom.orgURL · 4
• bugzilla.mozilla.orgURL · 3
• addons.allizom.orgURL · 3
• firefox-ci-tc.services.mozilla.comURL · 2
• community-tc.services.mozilla.comURL · 2
• relay.firefox.comURL · 1

高票报告

当前状态 66 份 · 全部 68

1. 361
   Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)代码执行 · 2026-08-05 · 严重
   $12,000代码注入
2. 244
   IDOR: Account Deletion via Session Misbinding – Attacker Can Delete Victim Account不安全的直接对象引用 · 2025-06-03 · 高危
   $0IDOR
3. 173
   Mozilla VPN Clients: RCE via file write and path traversal路径遍历 · 2025-07-29 · 高危
   $6,000路径遍历
4. 123
   Netlify Authentication Token Exposed in Public Mozilla CI Logs信息泄露 · 2025-05-13 · 严重
   $0信息泄露
5. 99
   [Hubs] - Broken access control in placing objects in hubs room访问控制 · 2023-07-20 · 中危
   $0访问控制缺陷（通用）
6. 98
   Bypass "No Links" Restriction in Biography via Protocol-Relative URL (//)其他弱点 · 2025-07-29 · 低危
   $0输入校验不当
7. 93
   Bypass of Restricted Keyword "Mozilla" in Display Name Field via Unicode Homoglyphs on addons.allizom.org其他弱点 · 2026-04-27 · 低危
   $500输入校验不当
8. 93
   Bypass Email Verification on Add Email Monitoring信息泄露 · 2025-01-08 · 中危
   $0信息泄露
9. 93
   SQL Injection on prod.oidc-proxy.prod.webservices.mozgcp.net via invite_code parameter - Mozilla social inscriptionSQL 注入 · 2024-01-30 · 严重
   $0SQL 注入
10. 85
    Bypass Email verification for monitoring at `monitor.mozilla.org`业务逻辑 · 2025-01-22 · 中危
    $0业务逻辑错误
11. 84
    Microsoft `x-apikey` Exposed in Mozilla CI Public Logs信息泄露 · 2025-11-03 · 中危
    $200敏感信息明文存储
12. 84
    IDOR on Delete Email address features不安全的直接对象引用 · 2024-03-07 · 高危
    $0IDOR
13. 79
    Subdomain takeover on one of the subdomain under mozaws.net错误配置 · 2024-01-04 · 中危
    $0错误配置
14. 75
    Subdomain takeover on a subdomain under firefox.com错误配置 · 2025-07-03 · 中危
    $500错误配置
15. 71
    two aws access key and secret key and database username and password exposed信息泄露 · 2024-10-18 · 严重
    $0信息泄露
16. 67
    Leakage of traffic in plaintext towards the IP address of VPN server密码学缺陷 · 2024-11-08 · 低危
    $0敏感信息明文传输
17. 66
    [ addons-preview-cdn.mozilla.net ] A subdomain takeover is available via unregistered domain in Fastly错误配置 · 2024-12-06 · 中危
    $500错误配置
18. 65
    Jira Credential Disclosure within Mozilla Slack信息泄露 · 2024-04-23 · 严重
    $1,000信息泄露
19. 64
    Exposure of account recovery hint by querying by user email信息泄露 · 2024-01-11 · 低危
    $250Exposure of Sensitive Information Due to Incompatible Policies
20. 64
    After the upload of an private file, using transformations, the file becomes public without the possibility of changing it.访问控制 · 2023-10-20 · 中危
    $1,000访问控制缺陷（通用）
21. 63
    csrftoken not unique to session or specific user and csrfmiddlewaretoken can be altered跨站请求伪造 · 2024-11-20 · 低危
    $500跨站请求伪造
22. 61
    Stored XSS on the public Pontoon dashboards: the latest-activity tooltip re-parses a contributor's account address as HTML跨站脚本 · 2026-10-14 · 高危
    $3,000存储型 XSS
23. 61
    Security bug https://bugzilla.mozilla.org/oauth/authorize - CRLF Header injection via "redirect_uri" parameter注入与走私 · 2023-10-28 · 低危
    $200CRLF 注入
24. 60
    MozillaVPN: Elevation of Privilege via a Logic Vulnerability路径遍历 · 2025-07-03 · 中危
    $0Improper Link Resolution Before File Access ('Link Following')
25. 59
    [Privilege Escalation] User can Pin|Unpin Any Comment on Any Project or Locale访问控制 · 2026-03-20 · 低危
    $0权限提升