CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2013-5594
https://notcve.org/view.php?id=CVE-2013-5594
18 Feb 2020 — Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml binding Mozilla Firefox versiones anteriores a 25, permite una modificación del contenido anónimo del enlace del archivo pluginProblem.xml • https://bugzilla.mozilla.org/show_bug.cgi?id=914618 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-6799 – Slackware Security Advisory - mozilla-firefox Updates
https://notcve.org/view.php?id=CVE-2020-6799
14 Feb 2020 — Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types. This required Firefox to be configured as the default handler for a given file type and for a file downloaded to be opened in a third party application that insufficiently sanitized URL data. In that situation, clicking a link in the third party application could have been used to retrieve and execute files whose location was supplied through command line arguments. Note: This iss... • https://bugzilla.mozilla.org/show_bug.cgi?id=1606596 • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2020-6800 – Mozilla: Memory safety bugs fixed in Firefox 73 and Firefox ESR 68.5
https://notcve.org/view.php?id=CVE-2020-6800
14 Feb 2020 — Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts. This vulnerability affects Thunderbird < 68.... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1595786%2C1596706%2C1598543%2C1604851%2C1608580%2C1608785%2C1605777 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2020-6797 – Slackware Security Advisory - mozilla-firefox Updates
https://notcve.org/view.php?id=CVE-2020-6797
14 Feb 2020 — By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer. The attacker is restricted as they are unable to download non-quarantined files or supply command line arguments to the application, limiting the impact. Note: this issue only occurs on Mac OSX. Other operating systems are unaffected. This vulnerability affects Thunderbird < 68.5, Firefox < 73, and Firefox < ESR68.5. • https://bugzilla.mozilla.org/show_bug.cgi?id=1596668 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2020-6798 – Mozilla: Incorrect parsing of template tag could result in JavaScript injection
https://notcve.org/view.php?id=CVE-2020-6798
14 Feb 2020 — If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed. A site that relied on the browser behaving correctly could suffer a cross-site scripting vulnerability as a result. In general, this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but is potentially a risk in browser or browser-like contexts. This vulnerability affects Thunderbird < 68.5, Firefox... • https://bugzilla.mozilla.org/show_bug.cgi?id=1602944 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6796 – Mozilla: Missing bounds check on shared memory read in the parent process
https://notcve.org/view.php?id=CVE-2020-6796
14 Feb 2020 — A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 73 and Firefox < ESR68.5. Un procesamiento de contenido podría haber modificado una memoria compartida relacionada con la información de los reportes de bloqueos de aplicación, el bloqueo en sí mismo, y causar una escritura fuera de límites. Esto podría hab... • https://bugzilla.mozilla.org/show_bug.cgi?id=1610426 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2011-2669
https://notcve.org/view.php?id=CVE-2011-2669
21 Jan 2020 — Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates. Mozilla Firefox versiones anteriores a 3.6, presenta una vulnerabilidad de DoS debido a un problema en la comprobación de certificados. • http://jvn.jp/en/jp/JVN70984231/index.html • CWE-295: Improper Certificate Validation •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2011-2668
https://notcve.org/view.php?id=CVE-2011-2668
21 Jan 2020 — Mozilla Firefox through 1.5.0.3 has a vulnerability in processing the content-length header Mozilla Firefox versiones hasta 1.5.0.3, presenta una vulnerabilidad en el procesamiento del encabezado content-length. • http://jvn.jp/en/jp/JVN36721438/index.html •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2011-2670
https://notcve.org/view.php?id=CVE-2011-2670
13 Jan 2020 — Mozilla Firefox before 3.6 is vulnerable to XSS via the rendering of Cascading Style Sheets Mozilla Firefox versiones anteriores a la versión 3.6, es vulnerable a un ataque de tipo XSS por medio de la renderización de Cascading Style Sheets. • http://jvn.jp/en/jp/JVN74649877/index.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 63%CPEs: 4EXPL: 5CVE-2019-17026 – Mozilla Firefox And Thunderbird Type Confusion Vulnerability
https://notcve.org/view.php?id=CVE-2019-17026
09 Jan 2020 — Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1. Una información de alias incorrecta en compilador IonMonkey JIT para establecer los elementos de la matriz podría conllevar a una confusión de tipo. Estamos conscientes de los ataques dirigidos "in the wild" abusando de este fallo. • https://packetstorm.news/files/id/162568 • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •