Mozilla: Stored XSS on the public Pontoon dashboards: the latest-activity tooltip re-parses a contributor's account address as HTML

A stored cross-site scripting vulnerability was discovered in public dashboards where contributor-supplied data values were concatenated into markup without proper encoding. An attacker could register an account with a malicious script in the email address field, which would then execute in the...