Vulnerabilities > Mozilla > Firefox > 66.0.2
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-09-27 | CVE-2019-11738 | If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed. | 6.8 |
| 2019-09-27 | CVE-2019-11737 | Insufficient Verification of Data Authenticity vulnerability in Mozilla Firefox If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly applied to content. | 5.0 |
| 2019-09-27 | CVE-2019-11736 | Race Condition vulnerability in Mozilla Firefox The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. | 4.4 |
| 2019-09-27 | CVE-2019-11735 | Out-of-bounds Write vulnerability in multiple products Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68. | 6.8 |
| 2019-09-27 | CVE-2019-11734 | Classic Buffer Overflow vulnerability in Mozilla Firefox Mozilla developers and community members reported memory safety bugs present in Firefox 68. | 7.5 |
| 2019-09-27 | CVE-2019-11733 | Improper Authentication vulnerability in Mozilla Firefox and Firefox ESR When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. | 5.0 |
| 2019-07-23 | CVE-2019-9821 | Use After Free vulnerability in Mozilla Firefox A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers. | 6.8 |
| 2019-07-23 | CVE-2019-9820 | Use After Free vulnerability in Mozilla Firefox and Firefox ESR A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. | 7.5 |
| 2019-07-23 | CVE-2019-9819 | Improper Input Validation vulnerability in Mozilla Thunderbird A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. | 7.5 |
| 2019-07-23 | CVE-2019-9818 | Race Condition vulnerability in Mozilla Firefox A race condition is present in the crash generation server used to generate data for the crash reporter. | 5.1 |