Vulnerabilities > Mozilla > Firefox ESR > Medium

DATE CVE VULNERABILITY TITLE RISK
2020-12-09 CVE-2020-26958 Cross-site Scripting vulnerability in Mozilla Firefox
Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker.
network
low complexity
mozilla CWE-79
6.1
2020-12-09 CVE-2020-26956 Cross-site Scripting vulnerability in Mozilla Firefox
In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS.
network
low complexity
mozilla CWE-79
6.1
2020-12-09 CVE-2020-26953 Improper Restriction of Rendered UI Layers or Frames vulnerability in Mozilla Firefox
It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the user.
network
low complexity
mozilla CWE-1021
4.3
2020-12-09 CVE-2020-26951 Cross-site Scripting vulnerability in Mozilla Firefox
A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization.
network
low complexity
mozilla CWE-79
6.1
2020-10-01 CVE-2020-15664 Incorrect Authorization vulnerability in Mozilla Firefox and Firefox ESR
By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension.
network
low complexity
mozilla CWE-863
6.5
2020-10-01 CVE-2020-15677 Open Redirect vulnerability in multiple products
By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from.
network
low complexity
mozilla debian opensuse CWE-601
6.1
2020-10-01 CVE-2020-15676 Cross-site Scripting vulnerability in multiple products
Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element.
network
low complexity
mozilla debian opensuse CWE-79
6.1
2020-08-10 CVE-2020-15658 Improper Check for Unusual or Exceptional Conditions vulnerability in multiple products
The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog.
network
low complexity
mozilla canonical CWE-754
6.5
2020-08-10 CVE-2020-15655 A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-origin information.
network
low complexity
mozilla opensuse canonical
6.5
2020-08-10 CVE-2020-15654 Infinite Loop vulnerability in multiple products
When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not.
network
low complexity
mozilla canonical CWE-835
6.5