Vulnerabilities > Debian > Medium

DATE CVE VULNERABILITY TITLE RISK
2021-12-08 CVE-2021-43528 Improper Privilege Management vulnerability in multiple products
Thunderbird unexpectedly enabled JavaScript in the composition area.
network
low complexity
mozilla debian CWE-269
6.5
2021-12-08 CVE-2021-43534 Out-of-bounds Write vulnerability in multiple products
Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2.
6.8
2021-12-08 CVE-2021-43535 Use After Free vulnerability in multiple products
A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash.
6.8
2021-12-08 CVE-2021-43536 Information Exposure vulnerability in multiple products
Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL.
network
low complexity
mozilla debian CWE-200
6.5
2021-12-08 CVE-2021-43538 Race Condition vulnerability in multiple products
By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks.
network
low complexity
mozilla debian CWE-362
4.3
2021-12-08 CVE-2021-43541 When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped.
network
low complexity
mozilla debian
6.5
2021-12-08 CVE-2021-43542 Information Exposure Through an Error Message vulnerability in multiple products
Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols.
network
low complexity
mozilla debian CWE-209
6.5
2021-12-08 CVE-2021-43543 Cross-site Scripting vulnerability in multiple products
Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content.
network
low complexity
mozilla debian CWE-79
6.1
2021-12-08 CVE-2021-43545 Excessive Iteration vulnerability in multiple products
Using the Location API in a loop could have caused severe application hangs and crashes.
network
low complexity
mozilla debian CWE-834
6.5
2021-12-08 CVE-2021-43546 Improper Restriction of Rendered UI Layers or Frames vulnerability in multiple products
It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor.
network
low complexity
mozilla debian CWE-1021
4.3