Page 187 of 2175 results (0.018 seconds)

CVSS: 7.8EPSS: 0%CPEs: 15EXPL: 0

CVE-2017-7814 – Mozilla: Blob and data URLs bypass phishing and malware protection warnings (MFSA 2017-22)

https://notcve.org/view.php?id=CVE-2017-7814

File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. This would allow malicious sites to lure users into downloading executables that would otherwise be detected as suspicious. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4. Las descargas de archivos codificados con elementos URL "blob:" y "data:" omitían las comprobaciones de descarga de archivos normales a pesar de la característica Phishing and Malware Protection y sus listas de bloqueo de páginas y archivos sospechosos. Esto permitiria a los sitios maliciosos engañar a los usuarios para que descarguen ejecutables que, de otra manera, se habrían detectado como sospechosos. • http://www.securityfocus.com/bid/101059 http://www.securitytracker.com/id/1039465 https://access.redhat.com/errata/RHSA-2017:2831 https://access.redhat.com/errata/RHSA-2017:2885 https://bugzilla.mozilla.org/show_bug.cgi?id=1376036 https://lists.debian.org/debian-lts-announce/2017/11/msg00000.html https://security.gentoo.org/glsa/201803-14 https://www.debian.org/security/2017/dsa-3987 https://www.debian.org/security/2017/dsa-4014 https://www.mozilla.org/security/advisor • CWE-20: Improper Input Validation CWE-494: Download of Code Without Integrity Check •

CVSS: 9.8EPSS: 0%CPEs: 23EXPL: 0

CVE-2017-7793 – Mozilla: Use-after-free with Fetch API (MFSA 2017-22)

https://notcve.org/view.php?id=CVE-2017-7793

A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are freed when still in use, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4. Puede ocurrir una vulnerabilidad de uso de memoria previamente liberada en la API Fetch cuando el trabajador o la ventana asociada se liberan mientras siguen en uso, lo que resulta en un cierre inesperado potencialmente explotable. La vulnerabilidad afecta a Firefox en versiones anteriores a la 56, Firefox ESR en versiones anteriores a la 52.4 y Thunderbird en versiones anteriores a la 52.4. • http://www.securityfocus.com/bid/101055 http://www.securitytracker.com/id/1039465 https://access.redhat.com/errata/RHSA-2017:2831 https://access.redhat.com/errata/RHSA-2017:2885 https://bugzilla.mozilla.org/show_bug.cgi?id=1371889 https://lists.debian.org/debian-lts-announce/2017/11/msg00000.html https://security.gentoo.org/glsa/201803-14 https://www.debian.org/security/2017/dsa-3987 https://www.debian.org/security/2017/dsa-4014 https://www.mozilla.org/security/advisor • CWE-416: Use After Free •

CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0

CVE-2007-5341

https://notcve.org/view.php?id=CVE-2007-5341

Remote code execution in the Venkman script debugger in Mozilla Firefox before 2.0.0.8. Existe una vulnerabilidad de ejecución remota de código en el script debugger Venkman en Mozilla Firefox en versiones anteriores a la 2.0.0.8. • https://bugzilla.mozilla.org/show_bug.cgi?id=325761 https://bugzilla.mozilla.org/show_bug.cgi?id=345305 https://bugzilla.suse.com/show_bug.cgi?id=332512 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1

CVE-2017-7799

https://notcve.org/view.php?id=CVE-2017-7799

JavaScript in the "about:webrtc" page is not sanitized properly being assigned to "innerHTML". Data on this page is supplied by WebRTC usage and is not under third-party control, making this difficult to exploit, but the vulnerability could possibly be used for a cross-site scripting (XSS) attack. This vulnerability affects Firefox < 55. No se sanea correctamente el JavaScript en la página "about:webrtc" antes de asignarse a "innerHTML". Los datos en esta página son proporcionados por el uso de WebRTC y no está bajo control de terceros, lo que dificulta su explotación, pero la vulnerabilidad podría emplearse para realizar ataques de Cross-Site Scripting (XSS). • http://www.securityfocus.com/bid/100377 http://www.securitytracker.com/id/1039124 https://bugzilla.mozilla.org/show_bug.cgi?id=1372509 https://www.mozilla.org/security/advisories/mfsa2017-18 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1

CVE-2017-7789

https://notcve.org/view.php?id=CVE-2017-7789

If a server sends two Strict-Transport-Security (STS) headers for a single connection, they will be rejected as invalid and HTTP Strict Transport Security (HSTS) will not be enabled for the connection. This vulnerability affects Firefox < 55. Si un servidor envía dos cabeceras Strict-Transport-Security (STS) para una única conexión, serán rechazadas com inválidas y no se habilitará HTTP Strict Transport Security (HSTS) para la conexión. La vulnerabilidad afecta a Firefox en versiones anteriores a la 55. • http://www.securityfocus.com/bid/100374 http://www.securitytracker.com/id/1039124 https://bugzilla.mozilla.org/show_bug.cgi?id=1074642 https://www.mozilla.org/security/advisories/mfsa2017-18 •