CVSS: 9.4EPSS: 0%CPEs: 2EXPL: 0CVE-2022-34469 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-34469
10 Aug 2022 — When a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should not allow the user to bypass the certificate error. On Firefox for Android, the user was presented with the option to bypass the error; this could only have been done by the user explicitly. <br>*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 102. • https://bugzilla.mozilla.org/show_bug.cgi?id=1721220 • CWE-295: Improper Certificate Validation •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34471 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-34471
10 Aug 2022 — When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a prior version. This vulnerability affects Firefox < 102. Al descargar una actualización para un complemento, no se verificó que la versión de la actualización del complemento descargada coincidiera con la versión seleccionada en el manifiesto. S... • https://bugzilla.mozilla.org/show_bug.cgi?id=1766047 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34473 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-34473
10 Aug 2022 — The HTML Sanitizer should have sanitized the href attribute of SVG <use> tags; however it incorrectly did not sanitize xlink:href attributes. This vulnerability affects Firefox < 102. El HTML Sanitizer debería haber sanitizado el atributo href de las etiquetas SVG ; sin embargo, no sanitizó incorrectamente los atributos xlink:href. Esta vulnerabilidad afecta a Firefox < 102. Multiple vulnerabilities have been found in Moz... • https://bugzilla.mozilla.org/show_bug.cgi?id=1770888 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34474 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-34474
10 Aug 2022 — Even when an iframe was sandboxed with allow-top-navigation-by-user-activation, if it received a redirect header to an external protocol the browser would process the redirect and prompt the user as appropriate. This vulnerability affects Firefox < 102. Incluso cuando un iframe estaba protegido con allow-top-navigation-by-user-activation, si recibía un encabezado de redireccionamiento a un protocolo externo, el navegador procesaría el redireccionamiento y avisaría al usuario según ... • https://bugzilla.mozilla.org/show_bug.cgi?id=1677138 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34475 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-34475
10 Aug 2022 — SVG <use> tags that referenced a same-origin document could have resulted in script execution if attacker input was sanitized via the HTML Sanitizer API. This would have required the attacker to reference a same-origin JavaScript file containing the script to be executed. This vulnerability affects Firefox < 102. Las etiquetas SVG que hacían referencia a un documento del mismo origen podrían haber dado lugar a la ejecución de un script si la entrada del atacante se hubiera s... • https://bugzilla.mozilla.org/show_bug.cgi?id=1757210 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34476 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-34476
10 Aug 2022 — ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed ASN.1. This vulnerability affects Firefox < 102. El análisis ASN.1 de una SECUENCIA indefinida dentro de un GRUPO indefinido podría haber dado como resultado que el analizador aceptara ASN.1 con formato incorrecto. Esta vulnerabilidad afecta a Firefox < 102. Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. • https://bugzilla.mozilla.org/show_bug.cgi?id=1387919 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34477 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-34477
10 Aug 2022 — The MediaError message property should be consistent to avoid leaking information about cross-origin resources; however for a same-site cross-origin resource, the message could have leaked information enabling XS-Leaks attacks. This vulnerability affects Firefox < 102. La propiedad del mensaje MediaError debe ser coherente para evitar la filtración de información sobre recursos de origen cruzado; sin embargo, para un recurso de origen cruzado del mismo sitio, el mensaje podría haber filtrado información que... • https://bugzilla.mozilla.org/show_bug.cgi?id=1731614 • CWE-203: Observable Discrepancy •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34482 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-34482
10 Aug 2022 — An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34483. This vulnerability affects Firefox < 102. Un atacante que podría haber convencido a un usuario de arrastrar y soltar una imagen en un sistema de archivos podría haber manipulado el nombre del archivo r... • https://bugzilla.mozilla.org/show_bug.cgi?id=845880 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34483 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-34483
10 Aug 2022 — An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34482. This vulnerability affects Firefox < 102. Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. Versions less than 91.12.0:esr... • https://bugzilla.mozilla.org/show_bug.cgi?id=1335845 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36315 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-36315
10 Aug 2022 — When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata. This vulnerability affects Firefox < 103. Al cargar un script con Subresource Integrity, los atacantes con capacidad de inyección podrían desencadenar la reutilización de entradas previamente almacenadas en caché con metadatos de integridad incorrectos y diferentes. Esta vulnerabilidad afecta a Firefox < 103. Multiple v... • https://bugzilla.mozilla.org/show_bug.cgi?id=1762520 • CWE-345: Insufficient Verification of Data Authenticity •