Mozilla: Stored XSS on the public Pontoon dashboards: the latest-activity tooltip re-parses a contributor's account address as HTML

A stored cross-site scripting vulnerability was discovered in public dashboards where contributor-supplied data values were concatenated into markup without proper encoding. An attacker could register an account with a malicious script in the email address field, which would then execute in the...

Mozilla: User Can Delete Other Users' Personal Access Tokens at /delete-token/{token_id}/ on Mozilla Pontoon

A vulnerability was discovered in the Mozilla Pontoon application that allowed users to delete other users' personal access tokens at the /delete-token/tokenid/ endpoint without proper permission checks. The vulnerability was caused by the absence of user permission verification in the deletetoke...

Mozilla: [Privilege Escalation] User can Pin|Unpin Any Comment on Any Project or Locale

A vulnerability was discovered in the Pontoon application where any user could pin or unpin comments on any project or locale, despite lacking the necessary privileges. This was possible due to the lack of proper access controls in the backend code handling the pin and unpin functionality...

Mozilla: [Vertical Privilege Escalation] User can Unapproved any Approved Translation at [/translations/unapprove/]

A vulnerability was discovered in the Pontoon web application where any logged-in user could unapprove any approved translation, regardless of their privileges. This was due to a logical error in the validation logic, which allowed bypassing the authorization check. The vulnerability could be...