Vulnerabilities > Mozilla > Firefox > Medium

DATE CVE VULNERABILITY TITLE RISK
2020-08-10 CVE-2020-15662 Unspecified vulnerability in Mozilla Firefox
A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file.
network
low complexity
mozilla
6.5
2020-08-10 CVE-2020-15661 Insufficiently Protected Credentials vulnerability in Mozilla Firefox
A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain.
network
low complexity
mozilla CWE-522
6.5
2020-08-10 CVE-2020-15658 Improper Check for Unusual or Exceptional Conditions vulnerability in multiple products
The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog.
network
low complexity
mozilla canonical CWE-754
6.5
2020-08-10 CVE-2020-15655 A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-origin information.
network
low complexity
mozilla opensuse canonical
6.5
2020-08-10 CVE-2020-15654 Infinite Loop vulnerability in multiple products
When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not.
network
low complexity
mozilla canonical CWE-835
6.5
2020-08-10 CVE-2020-15653 An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links.
network
low complexity
mozilla canonical
6.5
2020-08-10 CVE-2020-15652 Origin Validation Error vulnerability in multiple products
By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect.
network
low complexity
mozilla canonical CWE-346
6.5
2020-08-10 CVE-2020-15651 Unspecified vulnerability in Mozilla Firefox
A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the file extension.
network
low complexity
mozilla
4.3
2020-08-10 CVE-2020-15648 Improper Restriction of Rendered UI Layers or Frames vulnerability in Mozilla Firefox
Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header.
network
low complexity
mozilla CWE-1021
6.5
2020-07-09 CVE-2020-12425 Out-of-bounds Read vulnerability in Mozilla Firefox
Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, leading to potential information disclosure.
network
low complexity
mozilla CWE-125
6.5