Vulnerabilities > Mozilla > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-01-21 | CVE-2011-2669 | Improper Certificate Validation vulnerability in Mozilla Firefox Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates. | 6.5 |
| 2020-01-13 | CVE-2011-2670 | Cross-site Scripting vulnerability in Mozilla Firefox Mozilla Firefox before 3.6 is vulnerable to XSS via the rendering of Cascading Style Sheets | 6.1 |
| 2020-01-08 | CVE-2019-17023 | Improper Authentication vulnerability in multiple products After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. | 6.5 |
| 2020-01-08 | CVE-2019-17022 | Cross-site Scripting vulnerability in multiple products When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. | 6.1 |
| 2020-01-08 | CVE-2019-17021 | Race Condition vulnerability in multiple products During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. | 5.3 |
| 2020-01-08 | CVE-2019-17020 | XXE vulnerability in multiple products If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. | 6.5 |
| 2020-01-08 | CVE-2019-17018 | Information Exposure vulnerability in Mozilla Firefox When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve the accuracy of the keyboard. | 5.3 |
| 2020-01-08 | CVE-2019-17016 | Cross-site Scripting vulnerability in multiple products When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. | 6.1 |
| 2020-01-08 | CVE-2019-17002 | Unspecified vulnerability in Mozilla Firefox If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https. | 4.3 |
| 2020-01-08 | CVE-2019-17001 | Cross-site Scripting vulnerability in Mozilla Firefox 69.0 A Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the protected document (cross-site scripting). | 6.1 |