Vulnerabilities > Mozilla > Firefox > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-09-27 | CVE-2019-11742 | Inclusion of Functionality from Untrusted Control Sphere vulnerability in Mozilla Firefox A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> element due to an error in how same-origin policy is applied to cached image content. | 6.5 |
| 2019-09-27 | CVE-2019-11741 | Cross-site Scripting vulnerability in Mozilla Firefox A compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS) attack on content from any site it can cause to be loaded in the same process. | 6.1 |
| 2019-09-27 | CVE-2019-11738 | If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed. | 6.3 |
| 2019-09-27 | CVE-2019-11737 | Insufficient Verification of Data Authenticity vulnerability in Mozilla Firefox If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly applied to content. | 5.3 |
| 2019-07-23 | CVE-2019-9817 | Origin Validation Error vulnerability in Mozilla Thunderbird Images from a different domain can be read using a canvas object in some circumstances. | 5.3 |
| 2019-07-23 | CVE-2019-9816 | Type Confusion vulnerability in Mozilla Thunderbird A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. | 5.9 |
| 2019-07-23 | CVE-2019-11730 | A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. | 6.5 |
| 2019-07-23 | CVE-2019-11728 | Exposure of Resource to Wrong Sphere vulnerability in multiple products The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that the accessible to a user when web content is loaded. | 4.7 |
| 2019-07-23 | CVE-2019-11727 | Improper Certificate Validation vulnerability in Mozilla Firefox A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. | 5.3 |
| 2019-07-23 | CVE-2019-11725 | When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation is interrupted but resources from the same site loaded through websockets are not blocked, leading to the loading of unsafe resources and bypassing safebrowsing protections. | 6.5 |