CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 0CVE-2025-6430
https://notcve.org/view.php?id=CVE-2025-6430
24 Jun 2025 — When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `<embed>` or `<object>` tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability affects Firefox < 140 and Firefox ESR < 128.12. • https://bugzilla.mozilla.org/show_bug.cgi?id=1971140 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 15EXPL: 0CVE-2025-6429
https://notcve.org/view.php?id=CVE-2025-6429
24 Jun 2025 — Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability affects Firefox < 140 and Firefox ESR < 128.12. • https://bugzilla.mozilla.org/show_bug.cgi?id=1970658 • CWE-116: Improper Encoding or Escaping of Output •
CVSS: 10.0EPSS: 0%CPEs: 14EXPL: 0CVE-2025-6426
https://notcve.org/view.php?id=CVE-2025-6426
24 Jun 2025 — The executable file warning did not warn users before opening files with the `terminal` extension. *This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 140 and Firefox ESR < 128.12. • https://bugzilla.mozilla.org/show_bug.cgi?id=1964385 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 6.4EPSS: 0%CPEs: 15EXPL: 0CVE-2025-6425
https://notcve.org/view.php?id=CVE-2025-6425
24 Jun 2025 — An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability affects Firefox < 140, Firefox ESR < 115.25, and Firefox ESR < 128.12. • https://bugzilla.mozilla.org/show_bug.cgi?id=1717672 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 0%CPEs: 15EXPL: 0CVE-2025-6424
https://notcve.org/view.php?id=CVE-2025-6424
24 Jun 2025 — A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability affects Firefox < 140, Firefox ESR < 115.25, and Firefox ESR < 128.12. • https://bugzilla.mozilla.org/show_bug.cgi?id=1966423 • CWE-416: Use After Free •
CVSS: 5.3EPSS: 0%CPEs: 7EXPL: 0CVE-2025-27587
https://notcve.org/view.php?id=CVE-2025-27587
16 Jun 2025 — OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extracti... • https://github.com/openssl/openssl/issues/24253 • CWE-385: Covert Timing Channel •
CVSS: 5.9EPSS: 0%CPEs: 8EXPL: 0CVE-2024-33861
https://notcve.org/view.php?id=CVE-2024-33861
12 Jun 2025 — Please review the referenced CVE identifiers for details. •
CVSS: 4.8EPSS: 0%CPEs: 15EXPL: 0CVE-2025-5265
https://notcve.org/view.php?id=CVE-2025-5265
27 May 2025 — Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. *This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 139, Firefox ESR < 115.24, and Firefox ESR < 128.11. Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into usi... • https://bugzilla.mozilla.org/show_bug.cgi?id=1962301 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.4EPSS: 0%CPEs: 25EXPL: 0CVE-2025-5263 – firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content
https://notcve.org/view.php?id=CVE-2025-5263
27 May 2025 — Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability affects Firefox < 139, Firefox ESR < 115.24, and Firefox ESR < 128.11. Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability affects Firefox < 139, Firefox ESR < 115.24, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11. A flaw was found in Firefox. • https://bugzilla.mozilla.org/show_bug.cgi?id=1960745 • CWE-346: Origin Validation Error CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-23393 – Reflected XSS in spacewalk-java
https://notcve.org/view.php?id=CVE-2025-23393
27 May 2025 — A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in spacewalk-java allows execution of arbitrary Javascript code on users machines.This issue affects Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; SUSE Manager Server Module 4.3: from ? before 4.3.85-150400.3.105.3. Una vulnerabilidad de neutralización incorrecta de etiquetas HTML relacionadas con scripts en una página web (XSS básico) en spacewalk-java permite la ejecuc... • https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23393 • CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •