James Lee

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: إصدارات Firefox لنظام iOS الأقدم من الإصدار 141 الوصف: مكون ماسح QR عرضة للاستغلال، مما قد يسمح بفتح مواقع ويب ضارة. ويحدث ذلك عندما يقوم المستخدم بمسح رابط تم إنشاؤه خصيصًا يستخدم نظام عناوين URL النصية المفتوحة في Firefox. التوصيات: قم بتحديث Firefox لنظام iOS إلى الإصدار 141 أو أحدث.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: Firefox لنظام iOS، الإصدارات الأقدم من 141 الوصف: قد يسمح نظام عناوين URL الذي يستخدمه Firefox لتسهيل البحث عن استعلامات نصية للمهاجمين بفتح عناوين URL لمواقع عشوائية أو صفحات داخلية بشكل غير مصرح به، في حال تم حث المستخدم على النقر على رابط ما. التوصيات: قم بتحديث Firefox لنظام iOS إلى الإصدار 141 أو أحدث.

تسمح هذه الثغرة للمهاجمين بتزوير عناوين المواقع الإلكترونية عند فتح عناوين URL مصممة بشكل خبيث في Firefox من تطبيقات أخرى، مثل Safari، في حال كانت عناوين URL هذه تستخدم أنظمة غير HTTP يستخدمها عميل Firefox لنظام iOS داخليًّا.

يمكن لمواقع الويب استغلال سلوك اقتطاع عناوين URL الطويلة في شريط العنوان لخداع المستخدمين وجعلهم يعتقدون أنهم في صفحة ويب مختلفة.

عند استخدام مخطط بروتوكول غير صالح، يمكن للمهاجم تزوير شريط العناوين. تؤثر هذه المشكلة على أنظمة التشغيل Android فقط، بينما لا تتأثر أنظمة التشغيل الأخرى.

Name of the Vulnerable Software and Affected Versions: Firefox for iOS versions prior to 133 Description: Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in the location URL bar to appear secure misleadingly. Recommendations: For Firefox for iOS versions prior to 133, update to a version 133 or later to resolve the issue. As a temporary workaround, consider avoiding access to non-secure HTTP sites that use non-existent ports until the update is applied.

The issue allows internal links to utilize the app scheme used for deeplinking, potentially circumventing some URL safety checks. This could result in link spoofing.

A permission leak could occur from a trusted site to an untrusted site via `embed` or `object` elements. This issue is related to incorrect permission preservation. Exploitation of this issue may allow a remote attacker to impact the confidentiality of protected information.

A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spoofing of other sites as the address bar is no longer visible.

The issue is related to the notification announcing the transition to fullscreen mode in Firefox on Android. Multiple prompts and panels from both Firefox and the Android OS could be used to obscure this notification, potentially leading to spoofing of the browser UI if the user is distracted by the sudden appearance of a prompt. The notifications now use the Android Toast feature. This issue only affects Firefox on Android, with other operating systems being unaffected.

Name of the Vulnerable Software and Affected Versions: Focus for iOS versions prior to 130 Description: Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar. Recommendations: For Focus for iOS versions prior to 130, update to version 130 or later to resolve the issue.

A potential issue exists where long pressing on a download link could provide a means for cross-site scripting.

The contextual menu for links in Firefox for iOS could provide an opportunity for cross-site scripting attacks.

A potential issue exists where long pressing on a download link could allow Javascript commands to be executed within the browser.

Name of the Vulnerable Software and Affected Versions: Focus for iOS versions prior to 126 Description: The issue is related to the file scheme of URLs being hidden, potentially allowing spoofing of a website's address in the location bar. This could enable a remote attacker to conduct spoofing attacks by exploiting errors in the representation of information in the user interface. Recommendations: For Focus for iOS versions prior to 126, update to version 126 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Microsoft Bing Search (affected versions not specified) Description: The issue is related to a data protection mechanism flaw in the Microsoft Bing Search system for the iOS operating system. This can be exploited by a remote attacker to conduct spoofing attacks. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to inappropriate implementation in iOS, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This is due to insufficient access control, which can be exploited by a remote attacker to gain unauthorized access to protected information. The estimated number of potentially affected devices worldwide is not specified.

The issue was addressed with improved UI handling. A malicious website may exfiltrate audio data cross-origin.

This issue allows an attacker to conduct a Universal Cross-Site Scripting (UXSS) attack on a victim website using a 302 redirect, provided the victim has a link to the attacker's website.

An issue allows an attacker to execute unauthorized scripts on the current top origin sites in the URL bar when a JavaScript URI is scanned with the QR code scanner.