Mozilla: Leaking browser history with CSS variables

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Firefox behaving slightly differently for already known resources when loading CSS resources involving CSS variables. This flaw could probe the browser history...

Mozilla: Leaking browser history with CSS variables

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Firefox behaving slightly differently for already known resources when loading CSS resources involving CSS variables. This flaw could probe the browser history...

Mozilla: Leaking browser history with CSS variables

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Firefox behaving slightly differently for already known resources when loading CSS resources involving CSS variables. This flaw could probe the browser history...

UBUNTU-CVE-2022-29916

Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been used to probe the browser history. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100...

RHEL 8 : firefox (RHSA-2022:1705)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:1705 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

CVE-2022-29916

Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been used to probe the browser history. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100...

CVE-2022-29916

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Firefox behaving slightly differently for already known resources when loading CSS resources involving CSS variables. This flaw could probe the browser history...

materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...

5x5_uploader (>=1.0.0, <=1.2.2), @3t-transform/threeteeui (>=0.0.1, <=0.0.6) +136 more potentially affected by CVE-2022-25349 via materialize-css (>=1.0.0-rc.1, <=1.0.0)

materialize-css NPM version =1.0.0-rc.1, =1.0.0, =0.0.1, =1.0.1, =1.0.3, =1.0.0, =0.0.3, =1.0.2, =0.0.4, =0.0.6, =1.0.0, =1.0.0, =1.0.19, =1.0.8, =1.2.12 - @mariaav/tutorial 1.0.0 - @mariaav/tutorial2 1.0.0 and more Source cves: CVE-2022-25349 Source advisory: GHSA-7JVX-F994-RFW2...

GHSA-7JVX-F994-RFW2 materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...

5x5_uploader (>=1.0.0, <=1.2.2), @3t-transform/threeteeui (>=0.0.1, <=0.0.6) +136 more potentially affected by CVE-2022-25349 via materialize-css (>=1.0.0-rc.1, <=1.0.0)

materialize-css NPM version =1.0.0-rc.1, =1.0.0, =0.0.1, =1.0.1, =1.0.3, =1.0.0, =0.0.3, =1.0.2, =0.0.4, =0.0.6, =1.0.0, =1.0.0, =1.0.19, =1.0.8, =1.2.12 - @mariaav/tutorial 1.0.0 - @mariaav/tutorial2 1.0.0 and more Source cves: CVE-2022-25349 Source advisory: OSV:GHSA-7JVX-F994-RFW2...

PT-2022-2618

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 100 Firefox ESR versions prior to 91.9 Thunderbird versions prior to 91.9 Description The issue is related to insufficient protection of internal data when handling CSS variables, which could allow a remote attacker t...

Security Vulnerabilities fixed in Thunderbird 91.9 — Mozilla

When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A...

Mozilla Firefox ESR < 91.9

The version of Firefox ESR installed on the remote Windows host is prior to 91.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-17 advisory. - Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safet...

Security Vulnerabilities fixed in Firefox 100 — Mozilla

When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existin...

Mozilla Firefox information leakage vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from an information disclosure vulnerability that stems from the browser behaving differently when loading CSS variables from known resources, which can be exploited by an...

Mozilla Firefox < 100.0

The version of Firefox installed on the remote Windows host is prior to 100.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-16 advisory. - Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in...

Security Vulnerabilities fixed in Firefox ESR 91.9 — Mozilla

When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existin...

CVE-2022-25349

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...

CVE-2022-25349

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...