Vulnerabilities > Mozilla > Firefox > 2.0.0.5

DATE CVE VULNERABILITY TITLE RISK
2018-06-11 CVE-2018-5116 Origin Validation Error vulnerability in multiple products
WebExtensions with the "ActiveTab" permission are able to access frames hosted within the active tab even if the frames are cross-origin.
network
low complexity
mozilla canonical CWE-346
7.5
2018-06-11 CVE-2018-5115 Information Exposure vulnerability in multiple products
If an HTTP authentication prompt is triggered by a background network request from a page or extension, it is displayed over the currently loaded foreground page.
network
low complexity
mozilla canonical CWE-200
5.0
2018-06-11 CVE-2018-5114 Information Exposure vulnerability in multiple products
If an existing cookie is changed to be "HttpOnly" while a document is open, the original value remains accessible through script until that document is closed.
network
low complexity
mozilla canonical CWE-200
5.0
2018-06-11 CVE-2018-5113 Missing Authorization vulnerability in multiple products
The "browser.identity.launchWebAuthFlow" function of WebExtensions is only allowed to load content over "https:" but this requirement was not properly enforced.
network
low complexity
mozilla canonical CWE-862
5.0
2018-06-11 CVE-2018-5112 Files or Directories Accessible to External Parties vulnerability in multiple products
Development Tools panels of an extension are required to load URLs for the panels as relative URLs from the extension manifest file but this requirement was not enforced in all instances.
network
low complexity
mozilla canonical CWE-552
5.0
2018-06-11 CVE-2018-5111 Improper Input Validation vulnerability in multiple products
When the text of a specially formatted URL is dragged to the addressbar from page content, the displayed URL can be spoofed to show a different site than the one loaded.
4.3
2018-06-11 CVE-2018-5110 Improper Input Validation vulnerability in Mozilla Firefox
If cursor visibility is toggled by script using from 'none' to an image and back through script, the cursor will be rendered temporarily invisible within Firefox.
network
low complexity
mozilla apple CWE-20
5.0
2018-06-11 CVE-2018-5109 Origin Validation Error vulnerability in multiple products
An audio capture session can started under an incorrect origin from the site making the capture request.
network
low complexity
mozilla canonical CWE-346
5.0
2018-06-11 CVE-2018-5108 Information Exposure vulnerability in multiple products
A Blob URL can violate origin attribute segregation, allowing it to be accessed from a private browsing tab and for data to be passed between the private browsing tab and a normal tab.
4.3
2018-06-11 CVE-2018-5107 Link Following vulnerability in multiple products
The printing process can bypass local access protections to read files available through symlinks, bypassing local file restrictions.
network
low complexity
mozilla canonical CWE-59
5.0