CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26977
https://notcve.org/view.php?id=CVE-2020-26977
07 Jan 2021 — By attempting to connect a website using an unresponsive port, an attacker could have controlled the content of a tab while the URL bar displayed the original domain. *Note: This issue only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 84. Al intentar conectar un sitio web usando un puerto que no responde, un atacante podría haber controlado el contenido de una pestaña mientras la barra de URL mostraba el dominio original. • https://bugzilla.mozilla.org/show_bug.cgi?id=1676311 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-26979
https://notcve.org/view.php?id=CVE-2020-26979
07 Jan 2021 — When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the user before navigation occurred to the desired, entered address. To construct a convincing spoof the attacker would have had to guess what the user was typing, perhaps by suggesting it. This vulnerability affects Firefox < 84. Cuando un usuario escribió una URL en la barra de direcciones o en la barra de búsqueda y presionó rápidamente la tecla Intro,... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1641287%2C1673299 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2020-35112
https://notcve.org/view.php?id=CVE-2020-35112
07 Jan 2021 — If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension (such as .bat or .exe) that executable would have been launched instead. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. Si un usuario descargó un archivo... • https://bugzilla.mozilla.org/show_bug.cgi?id=1661365 •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26974 – Mozilla: Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
https://notcve.org/view.php?id=CVE-2020-26974
16 Dec 2020 — When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. Cuando flex-basis fue usada en un contenedor de tabla, un objeto StyleGenericFlexBasis podría haberse convertido incorrectamente en el tipo equivocado. Esto resultó en uso de la memoria previamente... • https://bugzilla.mozilla.org/show_bug.cgi?id=1681022 • CWE-416: Use After Free CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26971 – Mozilla: Heap buffer overflow in WebGL
https://notcve.org/view.php?id=CVE-2020-26971
16 Dec 2020 — Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. Determinados valores de blit proporcionados por el usuario no se restringieron apropiadamente, conllevando a un desbordamiento del búfer de pila en algunos controladores de video. Esta vulnerabilidad afecta a Firefox versiones anteriores a 84, Thunderbird versiones anteriores a 78,6 y Firefox ... • https://bugzilla.mozilla.org/show_bug.cgi?id=1663466 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26972 – Ubuntu Security Notice USN-4671-1
https://notcve.org/view.php?id=CVE-2020-26972
16 Dec 2020 — The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting to use a dead actor they have a reference to. Such a check was omitted in WebGL, resulting in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 84. El ciclo de vida de IPC Actors, permite a actores administrados sobrevivir a sus actores administradores; y los primeros deben asegurarse de que no están intentando usar a un acto... • https://bugzilla.mozilla.org/show_bug.cgi?id=1671382 • CWE-416: Use After Free •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26978 – Mozilla: Internal network hosts could have been probed by a malicious webpage
https://notcve.org/view.php?id=CVE-2020-26978
16 Dec 2020 — Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. Usando técnicas que se basaron en la investigación de slipstream, una página web maliciosa podría haber expuesto tanto los hosts de una red interna como los servicios que se ejecutan en la máquina local del usuario. Esta vulnerabilidad a... • https://bugzilla.mozilla.org/show_bug.cgi?id=1677047 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26976 – Mozilla: HTTPS pages could have been intercepted by a registered service worker when they should not have been
https://notcve.org/view.php?id=CVE-2020-26976
16 Dec 2020 — When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the (insecure) framing. This vulnerability affects Firefox < 84. Cuando una página HTTPS estaba insertada en una página HTTP, y había un trabajador de servicio registrado para la primera, el trabajador de servicio podría haber interceptado la petición de la página segura a pesar... • https://bugzilla.mozilla.org/show_bug.cgi?id=1674343 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26973 – Mozilla: CSS Sanitizer performed incorrect sanitization
https://notcve.org/view.php?id=CVE-2020-26973
16 Dec 2020 — Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. Determinadas entradas hacia el CSS Sanitizer lo confundieron, resultando en una eliminación de componentes incorrectos. Esto podría haber sido usado como una omisión de saneo. • https://bugzilla.mozilla.org/show_bug.cgi?id=1680084 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-35111 – Mozilla: The proxy.onRequest API did not catch view-source URLs
https://notcve.org/view.php?id=CVE-2020-35111
16 Dec 2020 — When an extension with the proxy permission registered to receive