Tor Browser
Approved changes feed: RSS · Atom
cpe:2.3:a:torproject:tor_browser:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Torproject (afa7dfd2-d927-5903-8be5-17975f0a6575) |
|---|---|
| Product | Tor Browser (c68b5da2-5e8d-5511-9e4a-6c89ab082486) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/thetorproject/gettorbrowser |
purl2cpe | 2026-06-01 10:12:23.465490 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-39246 |
vulnerable | 2026-06-08 05:33:49.285963 |
Details available
Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion addresses. Exact timestamps of these onion-service visits are logged locally, and an attacker might be able to compare them to timestamp data collected by the destination server (or collected by a rogue site within the Tor network).
Published: 2021-09-24T18:08:05.000Z
Updated: 2024-08-04T02:06:42.498Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-13075 |
vulnerable | 2026-06-08 05:12:40.868195 |
Details available
Tor Browser through 8.5.3 has an information exposure vulnerability. It allows remote attackers to detect the browser's language via vectors involving an IFRAME element, because text in that language is included in the title attribute of a LINK element for a non-HTML page. This is related to a behavior of Firefox before 68.
Published: 2019-06-30T13:47:08.000Z
Updated: 2024-08-04T23:41:10.039Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-12383 |
vulnerable | 2026-06-08 05:12:38.980806 |
Details available
Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to detect the browser's UI locale by measuring a button width, even if the user has a "Don't send my language" setting.
Published: 2019-05-28T02:21:05.000Z
Updated: 2024-08-04T23:17:39.997Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-16983 |
vulnerable | 2026-06-08 05:11:05.811052 |
Details available
NoScript Classic before 5.1.8.7, as used in Tor Browser 7.x and other products, allows attackers to bypass script blocking via the text/html;/json Content-Type value.
Published: 2018-09-13T04:00:00.000Z
Updated: 2024-08-05T10:39:59.154Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-16639 |
vulnerable | 2026-06-08 05:09:00.678263 |
Details available
Tor Browser on Windows before 8.0 allows remote attackers to bypass the intended anonymity feature and discover a client IP address, a different vulnerability than CVE-2017-16541. User interaction is required to trigger this vulnerability.
Published: 2018-09-14T21:00:00.000Z
Updated: 2024-08-05T20:27:04.308Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.