CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29973
https://notcve.org/view.php?id=CVE-2021-29973
05 Aug 2021 — Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This was corrected to require user interaction with the page before a user's password would be entered by the browser's autofill functionality *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 90. El autocompletado de contraseñas se activaba sin la interacción del usuario en sitios web no seguros en Firefox para Android. • https://bugzilla.mozilla.org/show_bug.cgi?id=1701932 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29974
https://notcve.org/view.php?id=CVE-2021-29974
05 Aug 2021 — When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would allow the user to override an error on a domain which had specified HTTP Strict Transport Security (which implies that the error should not be override-able.) This issue did not affect the network connections, and they were correctly upgraded to HTTPS automatically. This vulnerability affects Firefox < 90. Cuando se habilitaba la partición de la red, por ejemplo, como resultado de la conf... • https://bugzilla.mozilla.org/show_bug.cgi?id=1704843 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-29975
https://notcve.org/view.php?id=CVE-2021-29975
05 Aug 2021 — Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or formatting, could be overlaid on top of another domain (with the new domain correctly shown in the address bar) resulting in possible user confusion. This vulnerability affects Firefox < 90. Mediante una serie de manipulaciones del DOM, un mensaje, sobre el que el atacante tenía control del texto pero no del HTML o del formato, podía superponerse sobre otro dominio (con el nuevo dominio mostrado... • https://bugzilla.mozilla.org/show_bug.cgi?id=1713259 •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29977
https://notcve.org/view.php?id=CVE-2021-29977
05 Aug 2021 — Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 90. Los desarrolladores de Mozilla informaron de fallos de seguridad de memoria presentes en Firefox 89. Algunos de estos fallos mostraban evidencias de corrupción de memoria y suponemos que con suficiente esfuerzo algunos de ellos podrían haber s... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1665836%2C1686138%2C1704316%2C1706314%2C1709931%2C1712084%2C1712357%2C1714066 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-29976 – Mozilla: Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12
https://notcve.org/view.php?id=CVE-2021-29976
15 Jul 2021 — Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90. Los desarrolladores de Mozilla informaron de fallos de seguridad de memoria presentes en el código compartido entre Firefox y Thunderbird. Algunos de estos fallos m... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1700895%2C1703334%2C1706910%2C1711576%2C1714391 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 1CVE-2021-29970 – Mozilla: Use-after-free in accessibility features of a document
https://notcve.org/view.php?id=CVE-2021-29970
15 Jul 2021 — A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. *This bug could only be triggered when accessibility was enabled.*. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90. Una página web maliciosa podría desencadenar un uso de memoria previamente liberada, una corrupción de memoria y un bloqueo potencialmente explotable. *Este bug sólo podía ser desencadenado cuando la accesibilidad estaba activada. • https://bugzilla.mozilla.org/show_bug.cgi?id=1709976 • CWE-416: Use After Free CWE-787: Out-of-bounds Write •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29944
https://notcve.org/view.php?id=CVE-2021-29944
24 Jun 2021 — Lack of escaping allowed HTML injection when a webpage was viewed in Reader View. While a Content Security Policy prevents direct code execution, HTML injection is still possible. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 88. • https://bugzilla.mozilla.org/show_bug.cgi?id=1697604 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-29953
https://notcve.org/view.php?id=CVE-2021-29953
24 Jun 2021 — A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in a Universal Cross-Site Scripting vulnerability. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected. Further details are being temporarily withheld to allow users an opportunity to update.*. This vulnerability affects Firefox < 88.0.1 and Firefox for Android < 88.1.3. • https://bugzilla.mozilla.org/show_bug.cgi?id=1701684 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-29955
https://notcve.org/view.php?id=CVE-2021-29955
24 Jun 2021 — A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.). This vulnerability affects Firefox ESR < 78.9 and Firefox < 87. Una vulnerabilidad de ejecución transitoria, denominada Floating Point Value Injection (FPVI) permitía a un atacante filtrar direcciones de memoria arbitrarias y tambié... • https://bugzilla.mozilla.org/show_bug.cgi?id=1692972 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29958
https://notcve.org/view.php?id=CVE-2021-29958
24 Jun 2021 — When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to private mode cookies being shared in normal browsing mode. This vulnerability affects Firefox for iOS < 34. Cuando se iniciaba una descarga, el cliente no comprobaba si estaba en modo de navegación normal o privado, lo que conllevaba a que las cookies del modo privado se compartieran en el modo de navegación normal. Esta vulnerabilidad afecta a Firefox para iOS versiones anteriores a 34 • https://bugzilla.mozilla.org/show_bug.cgi?id=1670127 • CWE-862: Missing Authorization •