CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-38472 – Mozilla: Address bar spoofing via XSLT error handling
https://notcve.org/view.php?id=CVE-2022-38472
25 Aug 2022 — An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. Un atacante podría haber abusado del manejo de errores XSLT para asociar contenido controlado por el atacante con otro origen que se m... • https://bugzilla.mozilla.org/show_bug.cgi?id=1769155 • CWE-346: Origin Validation Error CWE-356: Product UI does not Warn User of Unsafe Actions •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 0CVE-2022-38473 – Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions
https://notcve.org/view.php?id=CVE-2022-38473
25 Aug 2022 — A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access). This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. Un iframe de origen cruzado que haga referencia a un documento XSLT heredaría los permisos del dominio principal (como el acceso al micrófono o la cámara). Esta vulnerabilidad afecta a Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR &... • https://bugzilla.mozilla.org/show_bug.cgi?id=1771685 • CWE-281: Improper Preservation of Permissions CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36320 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-36320
10 Aug 2022 — Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 103. Los desarrolladores de Mozilla y el equipo Mozilla Fuzzing informaron errores de seguridad de la memoria presentes en Firefox 102. Algunos de estos errores mostraron evidencia de corrupción de la memoria y supone... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1759794%2C1760998 • CWE-787: Out-of-bounds Write •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36315 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-36315
10 Aug 2022 — When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata. This vulnerability affects Firefox < 103. Al cargar un script con Subresource Integrity, los atacantes con capacidad de inyección podrían desencadenar la reutilización de entradas previamente almacenadas en caché con metadatos de integridad incorrectos y diferentes. Esta vulnerabilidad afecta a Firefox < 103. Multiple v... • https://bugzilla.mozilla.org/show_bug.cgi?id=1762520 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2022-29910 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-29910
10 Aug 2022 — When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.<br>*Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 100. Cuando se cerraba o se enviaba a segundo plano, Firefox para Android no registraba ni conservaba correctamente la configuración HSTS. • https://bugzilla.mozilla.org/show_bug.cgi?id=1757138 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-31743 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-31743
10 Aug 2022 — Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. This could have been used to escape HTML comments on pages that put user-controlled data in them. This vulnerability affects Firefox < 101. El analizador HTML de Firefox no interpretó correctamente las etiquetas de comentarios HTML, lo que provocó una incongruencia con otros navegadores. Esto podría haberse utilizado para escapar de los comentarios HTML en páginas que contienen datos control... • https://bugzilla.mozilla.org/show_bug.cgi?id=1747388 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-31748 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-31748
10 Aug 2022 — Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 101. Los desarrolladores de Mozilla Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard y el equipo Mozilla Fuzzing informaron errores de segurida... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1713773%2C1762201%2C1762469%2C1762770%2C1764878%2C1765226%2C1765782%2C1765973%2C1767177%2C1767181%2C1768232%2C1768251%2C1769869 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.4EPSS: 0%CPEs: 2EXPL: 0CVE-2022-34469 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-34469
10 Aug 2022 — When a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should not allow the user to bypass the certificate error. On Firefox for Android, the user was presented with the option to bypass the error; this could only have been done by the user explicitly. <br>*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 102. • https://bugzilla.mozilla.org/show_bug.cgi?id=1721220 • CWE-295: Improper Certificate Validation •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34471 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-34471
10 Aug 2022 — When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a prior version. This vulnerability affects Firefox < 102. Al descargar una actualización para un complemento, no se verificó que la versión de la actualización del complemento descargada coincidiera con la versión seleccionada en el manifiesto. S... • https://bugzilla.mozilla.org/show_bug.cgi?id=1766047 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34476 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-34476
10 Aug 2022 — ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed ASN.1. This vulnerability affects Firefox < 102. El análisis ASN.1 de una SECUENCIA indefinida dentro de un GRUPO indefinido podría haber dado como resultado que el analizador aceptara ASN.1 con formato incorrecto. Esta vulnerabilidad afecta a Firefox < 102. Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. • https://bugzilla.mozilla.org/show_bug.cgi?id=1387919 • CWE-20: Improper Input Validation •