CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26957
https://notcve.org/view.php?id=CVE-2020-26957
09 Dec 2020 — OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83. • https://bugzilla.mozilla.org/show_bug.cgi?id=1667179 • CWE-665: Improper Initialization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26955
https://notcve.org/view.php?id=CVE-2020-26955
09 Dec 2020 — When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of whether the original and subsequent request were in private and non-private browsing modes. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83. Cuando un usuario descargaba un archivo en Firefox para Android, si una cookie es ajustada, ésta habría s... • https://bugzilla.mozilla.org/show_bug.cgi?id=1663261 • CWE-565: Reliance on Cookies without Validation and Integrity Checking •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26954
https://notcve.org/view.php?id=CVE-2020-26954
09 Dec 2020 — When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83. • https://bugzilla.mozilla.org/show_bug.cgi?id=1657026 •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26952
https://notcve.org/view.php?id=CVE-2020-26952
09 Dec 2020 — Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially exploitable crash when handling out-of-memory errors. This vulnerability affects Firefox < 83. Una contabilización incorrecta de las funciones en línea durante la compilación de JIT podría haber conllevado a una corrupción de la memoria y a un bloqueo potencialmente explotable cuando se manejan errores fuera de la memoria. Esta vulnerabilidad afecta a Firefox versiones anteriores a 83 • https://bugzilla.mozilla.org/show_bug.cgi?id=1667685 • CWE-787: Out-of-bounds Write •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26958 – Mozilla: Requests intercepted through ServiceWorkers lacked MIME type restrictions
https://notcve.org/view.php?id=CVE-2020-26958
28 Nov 2020 — Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Firefox no bloqueó una ejecución de scripts con tipos MIME incorrectos cuando la respuesta fue interceptada y almacenada en caché por medio de un ServiceWorker. Esto podría conllevar a un... • https://bugzilla.mozilla.org/show_bug.cgi?id=1669355 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26965 – Mozilla: Software keyboards may have remembered typed passwords
https://notcve.org/view.php?id=CVE-2020-26965
28 Nov 2020 — Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remembers user input, a user typed their password and used that feature, the type of the password field was changed, resulting in a keyboard layout change and the possibility for the software keyboard to remember the typed password. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Alg... • https://bugzilla.mozilla.org/show_bug.cgi?id=1661617 • CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •
CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26960 – Mozilla: Potential use-after-free in uses of nsTArray
https://notcve.org/view.php?id=CVE-2020-26960
28 Nov 2020 — If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Si el método Compact() fue llamado en un nsTArray, el array podría haber sido reasignado sin actualizar otros punteros, conllevando a un potencial uso de la memoria previamente liberada y un bloqueo explotable. Esta vulnerabilidad afecta a Fire... • https://bugzilla.mozilla.org/show_bug.cgi?id=1670358 • CWE-416: Use After Free •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26953 – Mozilla: Fullscreen could be enabled without displaying the security UI
https://notcve.org/view.php?id=CVE-2020-26953
28 Nov 2020 — It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the user. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Fue posible causar que el navegador entre en modo de pantalla completa sin mostrar la interfaz de seguridad, lo que permite intentar un ataque de phishing o confundir de alguna manera al usuario. Esta vulnerabilidad afecta a Firefox versiones an... • https://bugzilla.mozilla.org/show_bug.cgi?id=1656741 • CWE-451: User Interface (UI) Misrepresentation of Critical Information CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26951 – Mozilla: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
https://notcve.org/view.php?id=CVE-2020-26951
26 Nov 2020 — A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Un desajuste en el análisis y la carga de eventos en el código SVG de Firefox podría haber permitido a unos eventos de carga dispararse, incluso desp... • https://bugzilla.mozilla.org/show_bug.cgi?id=1667113 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-354: Improper Validation of Integrity Check Value •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26959 – Mozilla: Use-after-free in WebRequestService
https://notcve.org/view.php?id=CVE-2020-26959
26 Nov 2020 — During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Durante el cierre del navegador, la disminución de la referencia podría haber ocurrido en un objeto previamente liberado, resultando en un uso de la memoria previamente liberada, una corrupción de la memoria y un bloqueo potencialmente explota... • https://bugzilla.mozilla.org/show_bug.cgi?id=1669466 • CWE-416: Use After Free •