CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23971
https://notcve.org/view.php?id=CVE-2021-23971
When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's Referrer-Policy. This would have potentially resulted in more information than intended by the original origin being provided to the destination of the redirect. This vulnerability affects Firefox < 86. Cuando se procesa un redireccionamiento con una Política de Referencia en conflicto, Firefox habría adoptado la Política de Referencia de redireccionamiento. Esto podría haber conllevado a que se proporcionara más información de la que pretendía mediante la fuente original hacia el destino del redireccionamiento. • https://bugzilla.mozilla.org/show_bug.cgi?id=1678545 https://security.gentoo.org/glsa/202104-10 https://www.mozilla.org/security/advisories/mfsa2021-07 •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23972
https://notcve.org/view.php?id=CVE-2021-23972
One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://www.phishingtarget.com@evil.com'. To mitigate this type of attack, Firefox will display a warning dialog; however, this warning dialog would not have been displayed if evil.com used a redirect that was cached by the browser. This vulnerability affects Firefox < 86. Una táctica de phishing en la web es proporcionar un enlace con Autenticación HTTP . • https://bugzilla.mozilla.org/show_bug.cgi?id=1683536 https://security.gentoo.org/glsa/202104-10 https://www.mozilla.org/security/advisories/mfsa2021-07 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23974
https://notcve.org/view.php?id=CVE-2021-23974
The DOMParser API did not properly process '<noscript>' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox < 86. La API DOMParser no procesó apropiadamente los elementos "(noscript)" para escapar. Esto podría ser usado como un vector mXSS para omitir un Sanitizador HTML. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1528997%2C1683627 https://security.gentoo.org/glsa/202104-10 https://www.mozilla.org/security/advisories/mfsa2021-07 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23975
https://notcve.org/view.php?id=CVE-2021-23975
The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes. When this function was invoked we incorrectly called the sizeof function, instead of using the API method that checks for invalid pointers. This vulnerability affects Firefox < 86. La página del desarrollador about:memory presenta una función Measure para explorar qué tipos de objetos ha asignado el navegador y sus tamaños. Cuando esta función era invocada, llamamos incorrectamente a la función sizeof, en lugar de usar el método API que comprueba punteros no válidos. • https://bugzilla.mozilla.org/show_bug.cgi?id=1685145 https://security.gentoo.org/glsa/202104-10 https://www.mozilla.org/security/advisories/mfsa2021-07 • CWE-862: Missing Authorization •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23976
https://notcve.org/view.php?id=CVE-2021-23976
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note: This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86. • https://bugzilla.mozilla.org/show_bug.cgi?id=1684627 https://security.gentoo.org/glsa/202104-10 https://www.mozilla.org/security/advisories/mfsa2021-07 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •