CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23972 – Gentoo Linux Security Advisory 202104-10
https://notcve.org/view.php?id=CVE-2021-23972
26 Feb 2021 — One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://www.phishingtarget.com@evil.com'. To mitigate this type of attack, Firefox will display a warning dialog; however, this warning dialog would not have been displayed if evil.com used a redirect that was cached by the browser. This vulnerability affects Firefox < 86. Una táctica de phishing en la web es proporcionar un enlace con Autenticación HTTP . • https://bugzilla.mozilla.org/show_bug.cgi?id=1683536 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23974 – Gentoo Linux Security Advisory 202104-10
https://notcve.org/view.php?id=CVE-2021-23974
26 Feb 2021 — The DOMParser API did not properly process '<noscript>' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox < 86. La API DOMParser no procesó apropiadamente los elementos "(noscript)" para escapar. Esto podría ser usado como un vector mXSS para omitir un Sanitizador HTML. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1528997%2C1683627 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23975 – Gentoo Linux Security Advisory 202104-10
https://notcve.org/view.php?id=CVE-2021-23975
26 Feb 2021 — The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes. When this function was invoked we incorrectly called the sizeof function, instead of using the API method that checks for invalid pointers. This vulnerability affects Firefox < 86. La página del desarrollador about:memory presenta una función Measure para explorar qué tipos de objetos ha asignado el navegador y sus tamaños. Cuando esta función era invocada, llamamos incorrec... • https://bugzilla.mozilla.org/show_bug.cgi?id=1685145 • CWE-862: Missing Authorization •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23976 – Gentoo Linux Security Advisory 202104-10
https://notcve.org/view.php?id=CVE-2021-23976
26 Feb 2021 — When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note: This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86. • https://bugzilla.mozilla.org/show_bug.cgi?id=1684627 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2021-23968 – Mozilla: Content Security Policy violation report could have contained the destination of a redirect
https://notcve.org/view.php?id=CVE-2021-23968
25 Feb 2021 — If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. Si la Política de Seguridad de Contenido bloqueaba la navegación de tramas, el destino completo de un redireccionamiento servido en la trama se reportaba en el informe de... • https://bugzilla.mozilla.org/show_bug.cgi?id=1687342 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2021-23969 – Mozilla: Content Security Policy violation report could have contained the destination of a redirect
https://notcve.org/view.php?id=CVE-2021-23969
25 Feb 2021 — As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thund... • https://bugzilla.mozilla.org/show_bug.cgi?id=1542194 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2021-23973 – Mozilla: MediaError message property could have leaked information about cross-origin resources
https://notcve.org/view.php?id=CVE-2021-23973
25 Feb 2021 — When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed information about the resource. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. Cuando se intenta cargar un recurso de origen cruzado en un contexto de audio y video, puede haber resultado un error de decodificación, y el contenido de ese error puede haber divulgado información sobre el recurso. Esta vulnerabilidad... • https://bugzilla.mozilla.org/show_bug.cgi?id=1690976 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2021-23978 – Mozilla: Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
https://notcve.org/view.php?id=CVE-2021-23978
25 Feb 2021 — Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. Los desarrolladores de Mozilla reportaron bugs de seguridad de la memoria presentes en Firefox versión 85 y Firefox ESR versión 78.7. Algunos de estos bugs mostraron evidenc... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=786797%2C1682928%2C1687391%2C1687597 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23955 – Gentoo Linux Security Advisory 202102-01
https://notcve.org/view.php?id=CVE-2021-23955
01 Feb 2021 — The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to clickjacking attacks. This vulnerability affects Firefox < 85. El navegador podría haber sido confundido al transferir un estado de bloqueo del puntero a otra pestaña, lo que podría haber conllevado a ataques de secuestro de clics. Esta vulnerabilidad afecta a Firefox versiones anteriores a 85 Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result ... • https://bugzilla.mozilla.org/show_bug.cgi?id=1684837 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-23956 – Gentoo Linux Security Advisory 202102-01
https://notcve.org/view.php?id=CVE-2021-23956
01 Feb 2021 — An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory. This was addressed by adding a new prompt. This vulnerability affects Firefox < 85. Un diseño de selector de archivos ambiguos podría haber confundido a usuarios que pretendían seleccionar y cargar un solo archivo para cargar un directorio completo. Esto se solucionó al agregar un nuevo aviso. • https://bugzilla.mozilla.org/show_bug.cgi?id=1338637 •