Vulnerabilities > Mozilla > Firefox > 20.0.1
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2015-11-05 | CVE-2015-7186 | Information Exposure vulnerability in Mozilla Firefox Mozilla Firefox before 42.0 on Android allows user-assisted remote attackers to bypass the Same Origin Policy and trigger (1) a download or (2) cached profile-data reading via a file: URL in a saved HTML document. | 4.3 |
| 2015-11-05 | CVE-2015-7185 | 7PK - Security Features vulnerability in Mozilla Firefox Mozilla Firefox before 42.0 on Android does not ensure that the address bar is restored upon fullscreen-mode exit, which allows remote attackers to spoof the address bar via crafted JavaScript code. | 4.3 |
| 2015-11-05 | CVE-2015-7182 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data. | 9.8 |
| 2015-11-05 | CVE-2015-4518 | Cross-site Scripting vulnerability in Mozilla Firefox The Reader View implementation in Mozilla Firefox before 42.0 has an improper whitelist, which makes it easier for remote attackers to bypass the Content Security Policy (CSP) protection mechanism and conduct cross-site scripting (XSS) attacks via vectors involving SVG animations and the about:reader URL. | 4.3 |
| 2015-11-05 | CVE-2015-4515 | Information Exposure vulnerability in Mozilla Firefox Mozilla Firefox before 42.0, when NTLM v1 is enabled for HTTP authentication, allows remote attackers to obtain sensitive hostname information by constructing a crafted web site that sends an NTLM request and reads the Workstation field of an NTLM type 3 message. | 4.3 |
| 2015-10-18 | CVE-2015-7184 | Improper Access Control vulnerability in Mozilla Firefox The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. | 6.8 |
| 2015-09-24 | CVE-2015-7327 | Information Exposure vulnerability in Mozilla Firefox Mozilla Firefox before 41.0 does not properly restrict the availability of High Resolution Time API times, which allows remote attackers to track last-level cache access, and consequently obtain sensitive information, via crafted JavaScript code that makes performance.now calls. | 4.3 |
| 2015-09-24 | CVE-2015-4516 | 7PK - Security Features vulnerability in Mozilla Firefox Mozilla Firefox before 41.0 allows remote attackers to bypass certain ECMAScript 5 (aka ES5) API protection mechanisms and modify immutable properties, and consequently execute arbitrary JavaScript code with chrome privileges, via a crafted web page that does not use ES5 APIs. | 9.3 |
| 2015-09-24 | CVE-2015-4512 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Mozilla Firefox gfx/2d/DataSurfaceHelpers.cpp in Mozilla Firefox before 41.0 on Linux improperly attempts to use the Cairo library with 32-bit color-depth surface creation followed by 16-bit color-depth surface display, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) by using a CANVAS element to trigger 2D rendering. | 6.4 |
| 2015-09-24 | CVE-2015-4510 | Multiple Security vulnerability in Mozilla Firefox Race condition in the WorkerPrivate::NotifyFeatures function in Mozilla Firefox before 41.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) by leveraging improper interaction between shared workers and the IndexedDB implementation. network mozilla | 6.8 |