Frederik Braun

يوجد تسلق للامتيازات داخل مكون واجهة برمجة التطبيقات (API) للتنزيلات.

يوجد ثغرة تسمح بتجاوز إجراءات التخفيف داخل مكون أمان DOM.

Name of the Vulnerable Software and Affected Versions: Firefox ESR versions prior to 78.10 Thunderbird versions prior to 78.10 Firefox versions prior to 88 Description: The issue exists due to insufficient input validation, allowing a remote attacker to bypass security restrictions. This can be exploited when using the Alt-Svc header with ports written as an integer overflow above the bounds of a 16-bit integer, potentially bypassing port blocking restrictions. Recommendations: For Firefox ESR versions prior to 78.10, update to version 78.10 or later. For Thunderbird versions prior to 78.10, update to version 78.10 or later. For Firefox versions prior to 88, update to version 88 or later.

The issue allows framing of other websites using object or embed tags, despite those websites disallowing framing with the X-Frame-Options header.

Memory safety bugs were reported in Firefox, which showed evidence of memory corruption. It is presumed that with enough effort, some of these bugs could have been exploited to run arbitrary code.

A reflected Cross-Site Scripting issue was found in the svg generation of the affected software.

The issue exists when parsing JSON requests, allowing an attacker to execute arbitrary Python code due to an eval() vulnerability.

The issue is related to unnecessary application permissions that provide additional remote troubleshooting access to the retired site input.mozilla.org, now redirecting to another site. This could serve as a potential vector for malicious attacks. The vulnerability is associated with errors in Firefox's permission settings, which could allow a remote attacker to access and compromise confidential data.

The issue is caused by insufficient vetting of parameters passed with the `Prompt:Open` IPC message between child and parent processes. This can result in the non-sandboxed parent process opening web content chosen by a compromised child process, potentially allowing attackers to execute arbitrary code on the user's computer when combined with additional vulnerabilities.

The issue is related to the implementation of the WebRTC mechanism in Mozilla Firefox, which fails to protect the structure of web pages. This could potentially allow a remote attacker to conduct cross-site scripting (XSS) attacks. The vulnerability is difficult to exploit because the data is supplied by WebRTC usage and is not under third-party control.

The Developer Tools feature has a XUL injection issue due to improper sanitization of web page source code. This could allow arbitrary code execution when opening a malicious page with the style editor tool.

The lockscreen feature does not properly restrict failed authentication attempts, making it easier for physically proximate attackers to obtain access by entering many passcode guesses.

A cross-site scripting (XSS) issue exists in the Futon UI of Apache CouchDB, allowing remote attackers to inject arbitrary web script or HTML via unspecified parameters to the browser-based test suite.

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `Branch` field or the `caption` of an uploaded file.

The issue allows JavaScript workers to read the browser-profile directory name, which has unspecified impact and can be exploited through remote attack vectors.