Vulnerabilities > Mozilla > Firefox > 3.0.12

DATE CVE VULNERABILITY TITLE RISK
2019-07-23 CVE-2019-11724 Incorrect Authorization vulnerability in multiple products
Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been retired and now redirects to another site.
network
low complexity
mozilla opensuse CWE-863
6.1
2019-07-23 CVE-2019-11723 Origin Validation Error vulnerability in multiple products
A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context.
network
low complexity
mozilla opensuse CWE-346
7.5
2019-07-23 CVE-2019-11721 The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar.
network
low complexity
mozilla opensuse
6.5
2019-07-23 CVE-2019-11720 Cross-site Scripting vulnerability in multiple products
Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors.
network
low complexity
mozilla opensuse CWE-79
6.1
2019-07-23 CVE-2019-11719 Out-of-bounds Read vulnerability in Mozilla Firefox and Firefox ESR
When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library.
network
low complexity
mozilla CWE-125
5.0
2019-07-23 CVE-2019-11718 Injection vulnerability in multiple products
Activity Stream can display content from sent from the Snippet Service website.
network
low complexity
mozilla opensuse CWE-74
5.3
2019-07-23 CVE-2019-11717 Improper Encoding or Escaping of Output vulnerability in multiple products
A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes.
network
low complexity
mozilla debian novell opensuse CWE-116
5.3
2019-07-23 CVE-2019-11716 Improper Input Validation vulnerability in Mozilla Firefox
Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropertyNames(window).
network
low complexity
mozilla CWE-20
7.5
2019-07-23 CVE-2019-11715 Cross-site Scripting vulnerability in Mozilla Firefox and Firefox ESR
Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on web sites in certain circumstances.
network
mozilla CWE-79
4.3
2019-07-23 CVE-2019-11714 Improper Input Validation vulnerability in Mozilla Firefox
Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in some instances.
network
low complexity
mozilla CWE-20
7.5