The default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS) attacks. This default was left in place as a legacy feature and has now been removed. *Note: this issue only affects users with an account on the vulnerable service. Other users are unaffected.*. This vulnerability affects Firefox < 67.
El controlador de protocolo webcal: predeterminado cargará un sitio web vulnerable a ataques de cross-site scripting (XSS). Este valor predeterminado se dejó en su lugar como una característica heredada y ahora se ha eliminado. * Nota: este problema solo afecta a los usuarios con una cuenta en el servicio vulnerable. Otros usuarios no se ven afectados. *. Esta vulnerabilidad afecta a Firefox anterior a la versión 67.
Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, trick the user in to launching local executable binaries, obtain sensitive information, conduct cross-site scripting attacks, or execute arbitrary code. Various other issues were also addressed.
