Masato Kinugawa

A cross-site scripting issue exists in the E-mail function. This could allow an attacker to reset passwords for any user.

A mitigation bypass exists in the Privacy: Anti-Tracking component. This issue allows bypassing of implemented protections.

A mitigation bypass exists in the DOM: Core & HTML component. This issue could allow for bypassing security mitigations.

A malicious webpage could exploit the `type` attribute of an OBJECT tag to bypass standard browser security measures when handling web resources lacking a content-type header. This could lead to a cross-site scripting (XSS) attack on websites that do not securely serve files without specifying a content-type.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Firefox ESR versions prior to 128.12 Description: The issue arises from incorrect URL parsing when handling an `embed` tag, potentially rewriting the URL to a specific domain, such as youtube.com, and bypassing security checks that restrict embedding from certain domains. Recommendations: For Firefox versions prior to 140, update to version 140 or later. For Firefox ESR versions prior to 128.12, update to version 128.12 or later.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 133 Firefox ESR versions prior to 128.5 Firefox ESR versions prior to 115.18 Thunderbird versions prior to 133 Thunderbird versions prior to 128.5 Thunderbird versions prior to 115.18 Description: The issue is related to Enhanced Tracking Protection's Strict mode, which may have allowed a Content Security Policy (CSP) `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This could have exposed users to malicious frames masquerading as legitimate content, potentially allowing an attacker to perform a DOM-based XSS attack by exploiting the lack of protection for the web page structure. Recommendations: For Firefox versions prior to 133, update to version 133 or later. For Firefox ESR versions prior to 128.5, update to version 128.5 or later. For Firefox ESR versions prior to 115.18, update to version 115.18 or later. For Thunderbird versions prior to 133, update to version 133 or later. For Thunderbird versions prior to 128.5, update to version 128.5 or later. For Thunderbird versions prior to 115.18, update to version 115.18 or later.

The issue is related to the lack of protection for the structure of web pages, which could allow a remote attacker to gain unauthorized access to protected information. In multipart/x-mixed-replace responses, the `Content-Disposition: attachment` in the response header was not respected, potentially allowing XSS attacks.

The issue is related to a CORS mechanism error in Mozilla Firefox, Firefox ESR, and the Thunderbird email client, specifically with the `resource://pdf.js` path. An attacker could exploit this by sending a specially crafted multipart response, allowing them to execute arbitrary JavaScript under the `resource://pdf.js` origin. This could enable access to cross-origin PDF content, with the level of access varying between desktop and Android versions due to the Site Isolation feature.

An attacker could execute arbitrary JavaScript under the `resource://devtools` origin via a specially crafted multipart response. This could allow them to access cross-origin JSON content, with access limited to "same site" documents on desktop clients due to the Site Isolation feature, but full cross-origin access is possible on Android versions.

The issue is related to the Content Security Policy component in Firefox browsers, specifically in "strict-dynamic" mode. An attacker who can inject an HTML element could use a DOM Clobbering attack on some web-compatibility shims and achieve cross-site scripting (XSS), bypassing the CSP strict-dynamic protection. This could allow a remote attacker to perform cross-site scripting attacks.

The issue is related to a cross-site scripting vulnerability in the PDF preview feature. If exploited, this could allow an arbitrary script to be executed on a logged-in user's web browser.

The issue is related to incorrect code generation management, which can be exploited by a remote attacker to execute arbitrary code. This can be achieved via a crafted extension description or changelog.

The issue is related to incorrect code generation management in Docker Desktop, allowing a remote attacker to execute arbitrary code via query parameters in the message-box route. This can lead to remote code execution (RCE).

The issue is related to insufficient data validation in DevTools, allowing a remote attacker to bypass content security policy via a crafted HTML page. This could potentially impact a significant number of devices worldwide, given the popularity of Google Chrome. However, specific numbers of potentially affected devices are not provided.

The issue allows remote attackers to inject an arbitrary script via unspecified vectors, exploiting a cross-site scripting vulnerability in specific parameters.

The issue allows a remote attacker to inject an arbitrary script via unspecified vectors, exploiting a cross-site scripting vulnerability in specific parameters.

The issue allows a remote attacker to obtain and/or alter the data of the product via unspecified vectors. This is due to an HTTP header injection vulnerability.

A cross-site scripting issue allows a remote attacker to execute an arbitrary script on the logged-in user's web browser.

The issue is related to insufficient data validation in Trusted Types, allowing a remote attacker to bypass trusted types policy via a crafted HTML page. This could potentially lead to the disclosure of protected information.

Name of the Vulnerable Software and Affected Versions: Cybozu Garoon versions 4.0.0 through 5.0.2 Description: A cross-site scripting issue in the Scheduler component allows a remote authenticated attacker to inject an arbitrary script. Recommendations: For Cybozu Garoon versions 4.0.0 through 5.0.2, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.