CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-5136
https://notcve.org/view.php?id=CVE-2018-5136
A shared worker created from a "data:" URL in one tab can be shared by another tab with a different origin, bypassing the same-origin policy. This vulnerability affects Firefox < 59. Un worker compartido creado a partir de una URL "data:" en una pestaña puede ser compartido por otra pestaña con un origen diferente, evitando la política de mismo origen. Esta vulnerabilidad afecta a las versiones anteriores a la 59 de Firefox. • http://www.securityfocus.com/bid/103386 http://www.securitytracker.com/id/1040514 https://bugzilla.mozilla.org/show_bug.cgi?id=1419166 https://usn.ubuntu.com/3596-1 https://www.mozilla.org/security/advisories/mfsa2018-06 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 17EXPL: 0CVE-2018-5131 – Mozilla: Fetch API improperly returns cached copies of no-store/no-cache resources (MFSA 2018-07)
https://notcve.org/view.php?id=CVE-2018-5131
Under certain circumstances the "fetch()" API can return transient local copies of resources that were sent with a "no-store" or "no-cache" cache header instead of downloading a copy from the network as it should. This can result in previously stored, locally cached data of a website being accessible to users if they share a common profile while browsing. This vulnerability affects Firefox ESR < 52.7 and Firefox < 59. Bajo ciertas circunstancias, la API "fetch()" puede devolver copias locales transitorias de recursos que se enviaron con una cabecera de caché "no-store" o "no-cache" en lugar de descargar una copia de la red, que es lo recomendado. Esto puede dar lugar a que los usuarios puedan acceder a los datos almacenados previamente y almacenados en la caché local de un sitio web si comparten un perfil común durante la navegación. • http://www.securityfocus.com/bid/103388 http://www.securitytracker.com/id/1040514 https://access.redhat.com/errata/RHSA-2018:0526 https://access.redhat.com/errata/RHSA-2018:0527 https://bugzilla.mozilla.org/show_bug.cgi?id=1440775 https://lists.debian.org/debian-lts-announce/2018/03/msg00010.html https://security.gentoo.org/glsa/201810-01 https://usn.ubuntu.com/3596-1 https://www.debian.org/security/2018/dsa-4139 https://www.mozilla.org/security/advisories/mfsa2018-06&# • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-5134
https://notcve.org/view.php?id=CVE-2018-5134
WebExtensions may use "view-source:" URLs to view local "file:" URL content, as well as content stored in "about:cache", bypassing restrictions that only allow WebExtensions to view specific content. This vulnerability affects Firefox < 59. WebExtensions puede usar URL "view-source:" para visualizar contenido de URL"file:" local, así como el contenido almacenado en "about:cache", omitiendo las restricciones que solo permiten a WebExtensions visualizar contenido específico. Esta vulnerabilidad afecta a las versiones anteriores a la 59 de Firefox. • http://www.securityfocus.com/bid/103386 http://www.securitytracker.com/id/1040514 https://bugzilla.mozilla.org/show_bug.cgi?id=1429379 https://usn.ubuntu.com/3596-1 https://www.mozilla.org/security/advisories/mfsa2018-06 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2018-5143
https://notcve.org/view.php?id=CVE-2018-5143
URLs using "javascript:" have the protocol removed when pasted into the addressbar to protect users from cross-site scripting (XSS) attacks, but if a tab character is embedded in the "javascript:" URL the protocol is not removed and the script will execute. This could allow users to be socially engineered to run an XSS attack against themselves. This vulnerability affects Firefox < 59. Las URL que utilizan "javascript:" eliminan el protocolo cuando se pega en la barra de direcciones para proteger a los usuarios de ataques Cross-Site Scripting (XSS), pero si hay un carácter de tabulación incrustado en la URL "javascript:", el protocolo no se elimina y el script se ejecutará. Esto podría permitir que se realice ingeniería social sobre los usuarios para ejecutar un ataque Cross-Site Scripting (XSS) contra ellos mismos. • http://www.securityfocus.com/bid/103386 http://www.securitytracker.com/id/1040514 https://bugzilla.mozilla.org/show_bug.cgi?id=1422643 https://usn.ubuntu.com/3596-1 https://www.mozilla.org/security/advisories/mfsa2018-06 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2018-5142
https://notcve.org/view.php?id=CVE-2018-5142
If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown protocol" as the requestee, leading to user confusion about which site is asking for this permission. This vulnerability affects Firefox < 59. Si se solicita permiso de la API Media Capture and Streams desde documentos con URL "data:" o "blob:", las notificaciones de permiso no muestran correctamente el dominio de origen. La notificación indica "Unknown protocol" (protocolo desconocido) como el solicitante, lo que lleva a la confusión del usuario sobre qué sitio está solicitando este permiso. • http://www.securityfocus.com/bid/103386 http://www.securitytracker.com/id/1040514 https://bugzilla.mozilla.org/show_bug.cgi?id=1366357 https://usn.ubuntu.com/3596-1 https://www.mozilla.org/security/advisories/mfsa2018-06 •