Vulnerabilities > Mozilla > Firefox > Medium

DATE CVE VULNERABILITY TITLE RISK
2021-12-08 CVE-2021-38509 Improper Restriction of Rendered UI Layers or Frames vulnerability in multiple products
Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top an uncontrolled webpage of the attacker's choosing.
network
low complexity
mozilla debian CWE-1021
4.3
2021-12-08 CVE-2021-43530 Cross-site Scripting vulnerability in Mozilla Firefox
A Universal XSS vulnerability was present in Firefox for Android resulting from improper sanitization when processing a URL scanned from a QR code.
network
low complexity
mozilla CWE-79
6.1
2021-12-08 CVE-2021-43531 Origin Validation Error vulnerability in Mozilla Firefox
When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element clicked.
network
low complexity
mozilla CWE-346
4.3
2021-12-08 CVE-2021-43532 Open Redirect vulnerability in Mozilla Firefox
The 'Copy Image Link' context menu action would copy the final image URL after redirects.
network
low complexity
mozilla CWE-601
6.1
2021-12-08 CVE-2021-43533 Unspecified vulnerability in Mozilla Firefox
When parsing internationalized domain names, high bits of the characters in the URLs were sometimes stripped, resulting in inconsistencies that could lead to user confusion or attacks such as phishing.
network
low complexity
mozilla
4.3
2021-12-08 CVE-2021-43536 Information Exposure vulnerability in multiple products
Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL.
network
low complexity
mozilla debian CWE-200
6.5
2021-12-08 CVE-2021-43538 Race Condition vulnerability in multiple products
By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks.
network
low complexity
mozilla debian CWE-362
4.3
2021-12-08 CVE-2021-43540 Unspecified vulnerability in Mozilla Firefox
WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been uninstalled with the extension.
network
low complexity
mozilla
6.5
2021-12-08 CVE-2021-43541 When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped.
network
low complexity
mozilla debian
6.5
2021-12-08 CVE-2021-43542 Information Exposure Through an Error Message vulnerability in multiple products
Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols.
network
low complexity
mozilla debian CWE-209
6.5