CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2017-5394
https://notcve.org/view.php?id=CVE-2017-5394
11 Jun 2018 — A location bar spoofing attack where the location bar of loaded page will be shown over the content of another tab due to a series of JavaScript events combined with fullscreen mode. Note: This issue only affects Firefox for Android. Other operating systems are not affected. This vulnerability affects Firefox < 51. Ataque de suplantación de barra de direcciones donde la barra de direcciones de la página cargada se mostrará sobre el contenido de otra pestaña debido a la combinación de una serie de eventos Ja... • http://www.securityfocus.com/bid/95763 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 1%CPEs: 2EXPL: 0CVE-2018-5121
https://notcve.org/view.php?id=CVE-2018-5121
11 Jun 2018 — Low descenders on some Tibetan characters in several fonts on OS X are clipped when rendered in the addressbar. When used as part of an Internationalized Domain Name (IDN) this can be used for domain name spoofing attacks. Note: This attack only affects OS X operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 58. • http://www.securityfocus.com/bid/102786 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5176 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5176
12 May 2018 — The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file contains malicious JavaScript script embedded as "javascript:" links, users may be tricked into clicking and running this code in the context of the JSON Viewer. This can allow for the theft of cookies and authorization tokens which are accessible to that context. This vulnerability affects Firefox < 60. JSON Viewer muestra hipervínculos que se pueden hacer clic en ellos para c... • http://www.securityfocus.com/bid/104139 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5175 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5175
12 May 2018 — A mechanism to bypass Content Security Policy (CSP) protections on sites that have a "script-src" policy of "'strict-dynamic'". If a target website contains an HTML injection flaw an attacker could inject a reference to a copy of the "require.js" library that is part of Firefox's Developer Tools, and then use a known technique using that library to bypass the CSP restrictions on executing injected scripts. This vulnerability affects Firefox < 60. Un mecanismo para omitir las protecciones de la Política de S... • http://www.securityfocus.com/bid/104139 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-5182 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5182
12 May 2018 — If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specified local file will be opened. This is contrary to policy and is what would happen if the string were the equivalent "file:" URL. This vulnerability affects Firefox < 60. Si se arrastra una cadena de texto que resulta ser un nombre de archivo en el formato nativo del sistema operativo y se suelta en la barra de direcciones, se abrirá el archivo local especificado. Esto ... • http://www.securityfocus.com/bid/104139 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 4%CPEs: 5EXPL: 0CVE-2018-5160 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5160
12 May 2018 — WebRTC can use a "WrappedI420Buffer" pixel buffer but the owning image object can be freed while it is still in use. This can result in the WebRTC encoder using uninitialized memory, leading to a potentially exploitable crash. This vulnerability affects Firefox < 60. WebRTC puede utilizar un búfer de píxeles "WrappedI420Buffer", pero el objeto owning image puede liberarse mientras está en uso. Esto puede provocar que el codificador WebRTC utilice memoria no inicializada, lo que puede provocar un cierre ines... • http://www.securityfocus.com/bid/104139 • CWE-416: Use After Free CWE-908: Use of Uninitialized Resource •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-5153 – Ubuntu Security Notice USN-3645-1
https://notcve.org/view.php?id=CVE-2018-5153
12 May 2018 — If websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted. This can result in an out-of-bounds read with the read memory sent to the originating server in response. This vulnerability affects Firefox < 60. Si se envían datos de sockets web con texto mixto y binario en un solo mensaje, los datos binarios pueden corromperse. Esto puede resultar en una lectura fuera de límites con la memoria de lectura enviada al servidor de origen en respuesta. • http://www.securityfocus.com/bid/104139 • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-5166 – Ubuntu Security Notice USN-3645-1
https://notcve.org/view.php?id=CVE-2018-5166
12 May 2018 — WebExtensions can use request redirection and a "filterReponseData" filter to bypass host permission settings to redirect network traffic and access content from a host for which they do not have explicit user permission. This vulnerability affects Firefox < 60. WebExtensions puede utilizar la redirección de peticiones y un filtro "filterReponseData" para eludir la configuración de permisos del host para redirigir el tráfico de red y acceder al contenido de un host para el que no tienen permiso explícito de... • http://www.securityfocus.com/bid/104139 • CWE-269: Improper Privilege Management •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5164 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5164
12 May 2018 — Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the "multipart/x-mixed-replace" MIME type. This could allow for script to run where CSP should block it, allowing for cross-site scripting (XSS) and other attacks. This vulnerability affects Firefox < 60. La política de seguridad de contenidos (CSP) no se aplica correctamente a todas las partes del contenido multiparte enviado con el tipo MIME "multipart/x-mixed-replace". Esto podría permitir que el script se ... • http://www.securityfocus.com/bid/104139 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 4%CPEs: 5EXPL: 0CVE-2018-5180 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5180
12 May 2018 — A use-after-free vulnerability can occur during WebGL operations. While this results in a potentially exploitable crash, the vulnerability is limited because the memory is freed and reused in a brief window of time during the freeing of the same callstack. This vulnerability affects Firefox < 60. Puede ocurrir una vulnerabilidad de uso de memoria previamente liberada durante las operaciones WebGL. Aunque esto resulta en una caída potencialmente explotable, la vulnerabilidad es limitada porque la memoria se ... • http://www.securityfocus.com/bid/104139 • CWE-416: Use After Free •