CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-29952
https://notcve.org/view.php?id=CVE-2021-29952
When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code. This vulnerability affects Firefox < 88.0.1 and Firefox for Android < 88.1.3. Cuando se destruían los componentes de Web Render, una condición de carrera podría haber causado un comportamiento indefinido, y presumimos que con suficiente esfuerzo podría haber sido explotable para ejecutar código arbitrario. Esta vulnerabilidad afecta a Firefox versiones anteriores a 88.0.1 y a Firefox para Android versiones anteriores a 88.1.3 • https://bugzilla.mozilla.org/show_bug.cgi?id=1704227 https://www.mozilla.org/security/advisories/mfsa2021-20 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-29951 – Mozilla Windows Maintenance Service Weak DACL
https://notcve.org/view.php?id=CVE-2021-29951
The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also exposed attack surface in the maintenance service. *Note: This issue only affected Windows operating systems older than Win 10 build 1709. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.10.1, Firefox < 87, and Firefox ESR < 78.10.1. • https://bugzilla.mozilla.org/show_bug.cgi?id=1690062 https://www.mozilla.org/security/advisories/mfsa2021-10 https://www.mozilla.org/security/advisories/mfsa2021-18 https://www.mozilla.org/security/advisories/mfsa2021-19 • CWE-269: Improper Privilege Management •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23996
https://notcve.org/view.php?id=CVE-2021-23996
By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing attack that could have been used for phishing or other attacks on a user. This vulnerability affects Firefox < 88. Al utilizar CSS 3D en conjunción con Javascript, el contenido podría haber sido renderizado fuera de la ventana gráfica de la página web, dando lugar a un ataque de suplantación de identidad que podría haber sido utilizado para el phishing u otros ataques a un usuario. Esta vulnerabilidad afecta a Firefox versiones anteriores a 88 • https://bugzilla.mozilla.org/show_bug.cgi?id=1701834 https://www.mozilla.org/security/advisories/mfsa2021-16 •
CVSS: 3.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24000
https://notcve.org/view.php?id=CVE-2021-24000
A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they were on a separate tab. In conjunction with certain elements (such as <input type="file">) this could have led to an attack where a user was confused about the origin of the webpage and potentially disclosed information they did not intend to. This vulnerability affects Firefox < 88. Una condición de carrera con las funciones requestPointerLock() y setTimeout() podría haber resultado en un usuario interactuando con una pestaña cuando creía que estaba en una pestaña separada. En conjunción con determinados elementos (como <input type="file">) esto podría haber conllevado a un ataque donde un usuario se confundiera sobre el origen de la página web y potencialmente revelara información que no pretendía. • https://bugzilla.mozilla.org/show_bug.cgi?id=1694698 https://www.mozilla.org/security/advisories/mfsa2021-16 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24001
https://notcve.org/view.php?id=CVE-2021-24001
A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructure that was not restricted to testing-only configurations. This vulnerability affects Firefox < 88. Un proceso de contenido comprometido podría haber llevado a cabo manipulaciones del historial de sesiones que no debería haber podido debido a la infraestructura de pruebas que no estaba restringida a las configuraciones de solo prueba. Esta vulnerabilidad afecta a Firefox versiones anteriores a 88 • https://bugzilla.mozilla.org/show_bug.cgi?id=1694727 https://www.mozilla.org/security/advisories/mfsa2021-16 • CWE-668: Exposure of Resource to Wrong Sphere •