CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2018-5140
https://notcve.org/view.php?id=CVE-2018-5140
Image for moz-icons can be accessed through the "moz-icon:" protocol through script in web content even when otherwise prohibited. This could allow for information leakage of which applications are associated with specific MIME types by a malicious page. This vulnerability affects Firefox < 59. Se puede acceder a la imagen de los moz-icons a través del protocolo "moz-icon:" mediante un script en el contenido de la web, incluso cuando esté prohibido. Esto podría permitir la fuga de información de qué aplicaciones están asociadas a tipos MIME específicos por una página maliciosa. • http://www.securityfocus.com/bid/103386 http://www.securitytracker.com/id/1040514 https://bugzilla.mozilla.org/show_bug.cgi?id=1424261 https://usn.ubuntu.com/3596-1 https://www.mozilla.org/security/advisories/mfsa2018-06 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-5133
https://notcve.org/view.php?id=CVE-2018-5133
If the "app.support.baseURL" preference is changed by a malicious local program to contain HTML and script content, this content is not sanitized. It will be executed if a user loads "chrome://browser/content/preferences/in-content/preferences.xul" directly in a tab and executes a search. This stored preference is also executed whenever an EME video player plugin displays a CDM-disabled message as a notification message. This vulnerability affects Firefox < 59. Si un programa local malicioso cambia la preferencia "app.support.baseURL" para que contenga contenido HTML y script, este contenido no se sanea. • http://www.securityfocus.com/bid/103386 http://www.securitytracker.com/id/1040514 https://bugzilla.mozilla.org/show_bug.cgi?id=1430511 https://bugzilla.mozilla.org/show_bug.cgi?id=1430974 https://usn.ubuntu.com/3596-1 https://www.mozilla.org/security/advisories/mfsa2018-06 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-5136
https://notcve.org/view.php?id=CVE-2018-5136
A shared worker created from a "data:" URL in one tab can be shared by another tab with a different origin, bypassing the same-origin policy. This vulnerability affects Firefox < 59. Un worker compartido creado a partir de una URL "data:" en una pestaña puede ser compartido por otra pestaña con un origen diferente, evitando la política de mismo origen. Esta vulnerabilidad afecta a las versiones anteriores a la 59 de Firefox. • http://www.securityfocus.com/bid/103386 http://www.securitytracker.com/id/1040514 https://bugzilla.mozilla.org/show_bug.cgi?id=1419166 https://usn.ubuntu.com/3596-1 https://www.mozilla.org/security/advisories/mfsa2018-06 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2018-5143
https://notcve.org/view.php?id=CVE-2018-5143
URLs using "javascript:" have the protocol removed when pasted into the addressbar to protect users from cross-site scripting (XSS) attacks, but if a tab character is embedded in the "javascript:" URL the protocol is not removed and the script will execute. This could allow users to be socially engineered to run an XSS attack against themselves. This vulnerability affects Firefox < 59. Las URL que utilizan "javascript:" eliminan el protocolo cuando se pega en la barra de direcciones para proteger a los usuarios de ataques Cross-Site Scripting (XSS), pero si hay un carácter de tabulación incrustado en la URL "javascript:", el protocolo no se elimina y el script se ejecutará. Esto podría permitir que se realice ingeniería social sobre los usuarios para ejecutar un ataque Cross-Site Scripting (XSS) contra ellos mismos. • http://www.securityfocus.com/bid/103386 http://www.securitytracker.com/id/1040514 https://bugzilla.mozilla.org/show_bug.cgi?id=1422643 https://usn.ubuntu.com/3596-1 https://www.mozilla.org/security/advisories/mfsa2018-06 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-5135
https://notcve.org/view.php?id=CVE-2018-5135
WebExtensions can bypass normal restrictions in some circumstances and use "browser.tabs.executeScript" to inject scripts into contexts where this should not be allowed, such as pages from other WebExtensions or unprivileged "about:" pages. This vulnerability affects Firefox < 59. WebExtensions puede omitir las restricciones normales en algunas circunstancias y utilizar "browser.tabs.executeScript" para inyectar secuencias de comandos en contextos en los que esto no debería permitirse, como páginas de otros WebExtensions o páginas "about:" no privilegiadas. Esta vulnerabilidad afecta a las versiones anteriores a la 59 de Firefox. • http://www.securityfocus.com/bid/103386 http://www.securitytracker.com/id/1040514 https://bugzilla.mozilla.org/show_bug.cgi?id=1431371 https://usn.ubuntu.com/3596-1 https://www.mozilla.org/security/advisories/mfsa2018-06 • CWE-862: Missing Authorization •