CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12389
https://notcve.org/view.php?id=CVE-2020-12389
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76. Los procesos de contenido de Firefox no bloquearon suficientemente el control de acceso, lo que podría resultar en un escape del sandbox. *Nota: este problema solo afecta a Firefox en los sistemas operativos Windows.*. • https://bugzilla.mozilla.org/show_bug.cgi?id=1554110 https://www.mozilla.org/security/advisories/mfsa2020-16 https://www.mozilla.org/security/advisories/mfsa2020-17 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12390
https://notcve.org/view.php?id=CVE-2020-12390
Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. This vulnerability affects Firefox < 76. Una serialización incorrecta del origen de las URL con direcciones IPv6 podría conllevar a comprobaciones de seguridad incorrectas. Esta vulnerabilidad afecta a Firefox versiones anteriores a 76. • https://bugzilla.mozilla.org/show_bug.cgi?id=1141959 https://www.mozilla.org/security/advisories/mfsa2020-16 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12391
https://notcve.org/view.php?id=CVE-2020-12391
Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. This vulnerability affects Firefox < 76. Documentos formados usando datos: las URL en un elemento OBJECT presentaron un fallo al heredar el CSP del contexto de creación. Esto permitió la ejecución de scripts que debieron haber sido bloqueados, aunque con un origen opaco único. • https://bugzilla.mozilla.org/show_bug.cgi?id=1457100 https://www.mozilla.org/security/advisories/mfsa2020-16 • CWE-863: Incorrect Authorization •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2020-12393
https://notcve.org/view.php?id=CVE-2020-12393
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. La funcionalidad "Copy as cURL" de la pestaña de red de Devtools no escapa correctamente al método HTTP de una petición, que puede ser controlada por el sitio web. • https://bugzilla.mozilla.org/show_bug.cgi?id=1615471 https://www.mozilla.org/security/advisories/mfsa2020-16 https://www.mozilla.org/security/advisories/mfsa2020-17 https://www.mozilla.org/security/advisories/mfsa2020-18 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12396
https://notcve.org/view.php?id=CVE-2020-12396
Mozilla developers and community members reported memory safety bugs present in Firefox 75. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 76. Los desarrolladores de Mozilla y los miembros de la comunidad informaron bugs de seguridad de la memoria presentes en Firefox versión 75. Algunos de estos errores mostraron evidencia de corrupción de memoria y suponemos que con suficiente esfuerzo algunos de estos podrían haber sido explotados para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1339601%2C1611938%2C1620488%2C1622291%2C1627644 https://security.gentoo.org/glsa/202005-04 https://www.mozilla.org/security/advisories/mfsa2020-16 • CWE-787: Out-of-bounds Write •