Page 118 of 1263 results (0.023 seconds)

CVSS: 6.1EPSS: 1%CPEs: 3EXPL: 0

If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed. A site that relied on the browser behaving correctly could suffer a cross-site scripting vulnerability as a result. In general, this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but is potentially a risk in browser or browser-like contexts. This vulnerability affects Thunderbird < 68.5, Firefox < 73, and Firefox < ESR68.5. Si se usó una etiqueta template en una etiqueta select, el analizador podría ser confundido y permitir el análisis y la ejecución de JavaScript cuando no debería ser permitido. • https://bugzilla.mozilla.org/show_bug.cgi?id=1602944 https://security.gentoo.org/glsa/202003-02 https://security.gentoo.org/glsa/202003-10 https://usn.ubuntu.com/4278-2 https://usn.ubuntu.com/4328-1 https://usn.ubuntu.com/4335-1 https://www.mozilla.org/security/advisories/mfsa2020-05 https://www.mozilla.org/security/advisories/mfsa2020-06 https://www.mozilla.org/security/advisories/mfsa2020-07 https://access.redhat.com/security/cve/CVE-2020-6798 https://bugzilla. • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 47%CPEs: 4EXPL: 4

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1. Una información de alias incorrecta en compilador IonMonkey JIT para establecer los elementos de la matriz podría conllevar a una confusión de tipo. Estamos conscientes de los ataques dirigidos "in the wild" abusando de este fallo. • https://www.exploit-db.com/exploits/49864 https://github.com/maxpl0it/CVE-2019-17026-Exploit https://github.com/lsw29475/CVE-2019-17026 http://packetstormsecurity.com/files/162568/Firefox-72-IonMonkey-JIT-Type-Confusion.html https://bugzilla.mozilla.org/show_bug.cgi?id=1607443 https://security.gentoo.org/glsa/202003-02 https://usn.ubuntu.com/4335-1 https://www.mozilla.org/security/advisories/mfsa2020-03 https://www.mozilla.org/security/advisories/mfsa2020-04 https://access.redhat& • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •

CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0

Mozilla developers reported memory safety bugs present in Firefox 71. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 72. Los desarrolladores de Mozilla reportaron bugs de seguridad de memoria presentes en Firefox versión 71. Algunos de estos errores mostraron evidencia de corrupción de memoria y suponemos que con un esfuerzo suficiente algunos de estos podrían haber sido explotados para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1328295%2C1328300%2C1590447%2C1590965%2C1595692%2C1597321%2C1597481 https://usn.ubuntu.com/4234-1 https://www.mozilla.org/security/advisories/mfsa2020-01 • CWE-787: Out-of-bounds Write •

CVSS: 8.8EPSS: 0%CPEs: 27EXPL: 1

Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. Los desarrolladores de Mozilla reportaron bugs de seguridad de memoria presentes en Firefox versión 71 y Firefox ESR versión 68.3. Algunos de estos errores mostraron evidencia de corrupción de memoria y suponemos que con un esfuerzo suficiente algunos de estos podrían haber sido explotados para ejecutar código arbitrario. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html https://access.redhat.com/errata/RHSA-2020:0085 https://access.redhat.com/errata/RHSA-2020:0086 https://access.redhat.com/errata/RHSA-2020:0111 https://access.redhat.com/errata/RHSA-2020:0120 https://access.redhat.com/errata/RHSA-2020:0123 https: • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •

CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72. Después de que HelloRetryRequest haya sido enviado, el cliente puede negociar un protocolo inferior que TLS versión 1.3, resultando en una transición de estado no válida en TLS State Machine. Si el cliente entra en este estado, los registros de Datos de Aplicación entrantes serian ignorados. • https://bugzilla.mozilla.org/show_bug.cgi?id=1590001 https://usn.ubuntu.com/4234-1 https://usn.ubuntu.com/4397-1 https://www.debian.org/security/2020/dsa-4726 https://www.mozilla.org/security/advisories/mfsa2020-01 https://access.redhat.com/security/cve/CVE-2019-17023 https://bugzilla.redhat.com/show_bug.cgi?id=1791225 • CWE-287: Improper Authentication •