CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26957
https://notcve.org/view.php?id=CVE-2020-26957
OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83. • https://bugzilla.mozilla.org/show_bug.cgi?id=1667179 https://www.mozilla.org/security/advisories/mfsa2020-50 • CWE-665: Improper Initialization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26955
https://notcve.org/view.php?id=CVE-2020-26955
When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of whether the original and subsequent request were in private and non-private browsing modes. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83. Cuando un usuario descargaba un archivo en Firefox para Android, si una cookie es ajustada, ésta habría sido reenviada durante una operación posterior de descarga de archivos en el mismo dominio, independientemente de si la petición original y posterior se encontraban en modos de navegación privados y no privados. • https://bugzilla.mozilla.org/show_bug.cgi?id=1663261 https://www.mozilla.org/security/advisories/mfsa2020-50 • CWE-565: Reliance on Cookies without Validation and Integrity Checking •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26954
https://notcve.org/view.php?id=CVE-2020-26954
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83. • https://bugzilla.mozilla.org/show_bug.cgi?id=1657026 https://www.mozilla.org/security/advisories/mfsa2020-50 •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26952
https://notcve.org/view.php?id=CVE-2020-26952
Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially exploitable crash when handling out-of-memory errors. This vulnerability affects Firefox < 83. Una contabilización incorrecta de las funciones en línea durante la compilación de JIT podría haber conllevado a una corrupción de la memoria y a un bloqueo potencialmente explotable cuando se manejan errores fuera de la memoria. Esta vulnerabilidad afecta a Firefox versiones anteriores a 83 • https://bugzilla.mozilla.org/show_bug.cgi?id=1667685 https://www.mozilla.org/security/advisories/mfsa2020-50 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26965 – Mozilla: Software keyboards may have remembered typed passwords
https://notcve.org/view.php?id=CVE-2020-26965
Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remembers user input, a user typed their password and used that feature, the type of the password field was changed, resulting in a keyboard layout change and the possibility for the software keyboard to remember the typed password. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Algunos sitios web presentan una funcionalidad "Show Password" donde al hacer clic en un botón se cambiará un campo de contraseña en un campo textbook, divulgando la contraseña escrita. Si, al usar un teclado de software que recuerda la entrada del usuario, un usuario escribió su contraseña y usó esa funcionalidad, se cambió el tipo de campo de contraseña, resultando en un cambio de distribución del teclado y la posibilidad de que el teclado de software recuerde la contraseña escrita. • https://bugzilla.mozilla.org/show_bug.cgi?id=1661617 https://www.mozilla.org/security/advisories/mfsa2020-50 https://www.mozilla.org/security/advisories/mfsa2020-51 https://www.mozilla.org/security/advisories/mfsa2020-52 https://access.redhat.com/security/cve/CVE-2020-26965 https://bugzilla.redhat.com/show_bug.cgi?id=1898739 • CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •