Vulnerabilities > Mozilla > Firefox > 21.0

DATE CVE VULNERABILITY TITLE RISK
2019-09-27 CVE-2019-11738 If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed.
network
mozilla opensuse
6.8
2019-09-27 CVE-2019-11737 Insufficient Verification of Data Authenticity vulnerability in Mozilla Firefox
If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly applied to content.
network
low complexity
mozilla CWE-345
5.0
2019-09-27 CVE-2019-11736 Race Condition vulnerability in Mozilla Firefox
The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access.
4.4
2019-09-27 CVE-2019-11735 Out-of-bounds Write vulnerability in multiple products
Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68.
6.8
2019-09-27 CVE-2019-11734 Classic Buffer Overflow vulnerability in Mozilla Firefox
Mozilla developers and community members reported memory safety bugs present in Firefox 68.
network
low complexity
mozilla CWE-120
7.5
2019-09-27 CVE-2019-11733 Improper Authentication vulnerability in Mozilla Firefox and Firefox ESR
When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog.
network
low complexity
mozilla CWE-287
5.0
2019-07-23 CVE-2019-9821 Use After Free vulnerability in Mozilla Firefox
A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers.
network
mozilla CWE-416
6.8
2019-07-23 CVE-2019-9820 Use After Free vulnerability in Mozilla Firefox and Firefox ESR
A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use.
network
low complexity
mozilla CWE-416
7.5
2019-07-23 CVE-2019-9819 Improper Input Validation vulnerability in Mozilla Thunderbird
A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash.
network
low complexity
mozilla CWE-20
7.5
2019-07-23 CVE-2019-9818 Race Condition vulnerability in Mozilla Firefox
A race condition is present in the crash generation server used to generate data for the crash reporter.
network
high complexity
mozilla CWE-362
5.1