CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11727 – nss: PKCS#1 v1.5 signatures can be used for TLS 1.3
https://notcve.org/view.php?id=CVE-2019-11727
A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68. Se presenta una vulnerabilidad donde es posible forzar a Network Security Services (NSS) para firmar CertificateVerify con firmas de PKCS#1 versión v1.5 cuando esas son las únicas anunciadas por el servidor en CertificateRequest en TLS versión 1.3. Las firmas de PKCS#1 versión v1.5 no deben ser usadas para mensajes de TLS versión 1.3. • http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html https://access.redhat.com/errata/RHSA-2019:1951 https://bugzilla.mozilla.org/show_bug.cgi?id=1552208 https://security.gentoo.or • CWE-295: Improper Certificate Validation CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 1CVE-2019-11721
https://notcve.org/view.php?id=CVE-2019-11721
The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar. This allows for domain spoofing attacks as do not display as punycode text, allowing for user confusion. This vulnerability affects Firefox < 68. El carácter latino 'kra' de Unicode puede ser usado para falsificar un carácter 'k' estándar en la barra de direcciones. Esto permite que los ataques de suplantación de dominio no se muestren como texto de código púny, lo que permite la confusión del usuario. • http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html https://bugzilla.mozilla.org/show_bug.cgi?id=1256009 https://security.gentoo.org/glsa/201908-12 https://www.mozilla.org/security/advisories/mfsa2019-21 •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11716
https://notcve.org/view.php?id=CVE-2019-11716
Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropertyNames(window). Sites that deploy a sandboxing that depends on enumerating and freezing access to the window object may miss this, allowing their sandboxes to be bypassed. This vulnerability affects Firefox < 68. Hasta que se acceda de forma explícita mediante un script, window.globalThis no es enumerable y, como resultado, no es visible para código tal y como Object.getOwnPropertyNames(window). Los sitios que implementan un sandbox que depende de la enumeración y la congelación del acceso al objeto de la ventana pueden pasarlo por alto, lo que permite que se eludan sus sandbox. • http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html https://bugzilla.mozilla.org/show_bug.cgi?id=1552632 https://security.gentoo.org/glsa/201908-12 https://www.mozilla.org/security/advisories/mfsa2019-21 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-11711 – Mozilla: Script injection within domain through inner window reuse
https://notcve.org/view.php?id=CVE-2019-11711
When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did not use document.domain to relax their origin security. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. Cuando se reutiliza una ventana interior, no se considera el uso de document.domain para las protecciones de origen cruzado. Si las páginas en diferentes subdominios alguna vez usan cooperativamente document.domain, entonces cualquiera de las páginas puede abusar de esto para inyectar el script en páginas arbitrarias en el otro subdominio, incluso aquellas que no usaron document.domain para mitigar la seguridad de su origen. • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html https://bugzilla.mozilla.org/show_bug.cgi?id=1552541 https://lists.debian.org/debian-lts-announce/2019/08/msg00001.html https:/ • CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-11712 – Mozilla: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects
https://notcve.org/view.php?id=CVE-2019-11712
POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery (CSRF) attacks. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. Las peticiones POST realizadas por complementos de NPAPI, tal y como Flash, que reciben una respuesta de redireccionamiento del estado 308 pueden pasar por alto los requerimientos de CORS. Esto puede permitir a un atacante realizar ataques de tipo Cross-Site Request Forgery (CSRF). • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html https://bugzilla.mozilla.org/show_bug.cgi?id=1543804 https://lists.debian.org/debian-lts-announce/2019/08/msg00001.html https:/ • CWE-352: Cross-Site Request Forgery (CSRF) CWE-829: Inclusion of Functionality from Untrusted Control Sphere •