firefox: stored passwords in 'Saved Logins' can be copied without master password entry

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password ...

FreeBSD : Mozilla -- Stored passwords in 'Saved Logins' can be copied without master password entry (0f31b4e9-c827-11e9-9626-589cfc01894a)

Mozilla Foundation reports : CVE-2019-11733: Stored passwords in 'Saved Logins' can be copied without master password entry When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored...

USN-4101-1 firefox vulnerability

It was discovered that passwords could be copied to the clipboard from the "Saved Logins" dialog without entering the master password, even when a master password has been set. A local attacker could potentially exploit this to obtain saved passwords...

UBUNTU-CVE-2019-11733

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password ...

[ASA-201908-11] firefox: information disclosure

Arch Linux Security Advisory ASA-201908-11 ========================================== Severity: Medium Date : 2019-08-16 CVE-ID : CVE-2019-11733 Package : firefox Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1025 Summary ======= The package firefox before...

Mozilla -- Stored passwords in 'Saved Logins' can be copied without master password entry

Mozilla Foundation reports: CVE-2019-11733: Stored passwords in 'Saved Logins' can be copied without master password entry When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored...

PT-2019-12486

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 68.0.2 Firefox ESR versions prior to 68.0.2 Description A security issue was found where locally stored passwords can be copied to the clipboard through the 'copy password' context menu item without re-entering the...

Stored passwords in 'Saved Logins' can be copied without master password entry — Mozilla

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password ...

VeryPDF PCL Converter 2.7 Denial Of Service

-- coding: utf-8 -- Exploit Title: VeryPDF PCL Converter v2.7 - Denial of Service PoC Date: 19/05/2019 Author: Alejandra Sánchez Vendor Homepage: http://www.verypdf.com Software: http://www.verypdf.com/pcltools/pcl-converter.exe Version: 2.7 Tested on: Windows 10 Proof of Concept: 1.- Run the...

Encrypt PDF 2.3 - Denial of Service Exploit

-- coding: utf-8 -- Exploit Title: Encrypt PDF v2.3 - Denial of Service PoC Author: Alejandra Sánchez Vendor Homepage: http://www.verypdf.com Software: http://www.verypdf.com/encryptpdf/encryptpdf.exe Version: 2.3 Tested on: Windows 10 Proof of Concept: 1.- Run the python script "EncryptPDF.py", ...

openSUSE Security Update : MozillaThunderbird (openSUSE-2019-680)

This update for Mozilla Thunderbird to version 60.2.1 fixes multiple issues. Multiple security issues were fixed in the Mozilla platform as advised in MFSA 2018-25. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are...

On the Security of Password Managers

There's new research on the security of password managers, specifically 1Password, Dashlane, KeePass, and Lastpass. This work specifically looks at password leakage on the host computer. That is, does the password manager accidentally leave plaintext copies of the password lying around memory? Al...

Mozilla Thunderbird < 60.2.1

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 60.2.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-25 advisory. - A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by...

Information Disclosure

Mozilla Firefox is vulnerable to information disclosure. Setting a master password does not delete unencrypted passwords that were previously stored, allowing other users to retrieve the stored password data...

SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2018:3476-1)

This update for MozillaFirefox to 60.2.2ESR fixes the following issues : Security issues fixed : MFSA 2018-24 : CVE-2018-12386: A Type confusion in JavaScript allowed remote code execution bsc1110506 CVE-2018-12387: Array.prototype.push stack pointer vulnerability may have enabled exploits in the...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20181105)

This update upgrades Thunderbird to version 60.2.1. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 CVE-2018-12376 - Mozilla: Use-after-free in driver timers CVE-2018-12377 - Mozilla: Use-after-free in IndexedDB CVE-2018-12378 - Mozilla: Proxy bypass using...

EulerOS 2.0 SP3 : firefox (EulerOS-SA-2018-1367)

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Mozilla: Crash in TransportSecurityInfo due to cached data CVE-2018-12385 - Mozilla: Setting a master password post-Firefox 58 does not delete...

EulerOS 2.0 SP2 : firefox (EulerOS-SA-2018-1359)

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 CVE-2018-12376 - Mozilla: Use-after-free in driver timers CVE-2018-12377 -...

RHEL 7 : thunderbird (RHSA-2018:3458)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:3458 advisory. - Mozilla: Proxy bypass using automount and autofs CVE-2017-16541 - Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2...

Mozilla: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords

If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Firefox 58. The new master password is...