https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 20:12:52 +0000 https://vulnerability.circl.lu/vuln/cve-2018-5175 <p><strong>Affected:</strong> Mozilla Firefox</p> <p>A mechanism to bypass Content Security Policy (CSP) protections on sites that have a &#34;script-src&#34; policy of &#34;&#39;strict-dynamic&#39;&#34;. If a target website contains an HTML injection flaw an attacker could inject a reference to a copy of the &#34;require.js&#34; library that is part of Firefox&#39;s Developer Tools, and then use a known technique using that library to bypass the CSP restrictions on executing injected scripts. This vulnerability affects Firefox &lt; 60.</p> <p><strong>Affected:</strong> Mozilla Firefox</p> <p>A mechanism to bypass Content Security Policy (CSP) protections on sites that have a &#34;script-src&#34; policy of &#34;&#39;strict-dynamic&#39;&#34;. If a target website contains an HTML injection flaw an attacker could inject a reference to a copy of the &#34;require.js&#34; library that is part of Firefox&#39;s Developer Tools, and then use a known technique using that library to bypass the CSP restrictions on executing injected scripts. This vulnerability affects Firefox &lt; 60.</p> https://vulnerability.circl.lu/vuln/cve-2018-5175 https://vulnerability.circl.lu/vuln/usn-3645-1 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: firefox, Ubuntu:16.04:LTS: firefox, Ubuntu:18.04:LTS: firefox</p> <p>Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, bypass same-origin restrictions, conduct cross-site scripting (XSS) attacks, install lightweight themes without user interaction, spoof the filename in the downloads panel, or execute arbitrary code. (CVE-2018-5150, CVE-2018-5151, CVE-2018-5153, CVE-2018-5154, CVE-2018-5155, CVE-2018-5157, CVE-2018-5158, CVE-2018-5159, CVE-2018-5160, CVE-2018-5163, CVE-2018-5164, CVE-2018-5168, CVE-2018-5173, CVE-2018-5175, CVE-2018-5177, CVE-2018-5180)</p> <p>Multiple security issues were discovered with WebExtensions. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to obtain sensitive information, or bypass security restrictions. (CVE-2018-5152, CVE-2018-5166)</p> <p>It was discovered that the web console and JavaScript debugger incorrectly linkified chrome: and javascript URLs. If a user were tricked in to clicking a specially crafted link, an attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2018-5167)</p> <p>It was discovered that dragging and dropping link text on to the home button could set the home page to include chrome pages. If a user were tricked in to dragging and dropping a specially crafted link on to the home button, an attacker could potentially exploit this bypass security…</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: firefox, Ubuntu:16.04:LTS: firefox, Ubuntu:18.04:LTS: firefox</p> <p>Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, bypass same-origin restrictions, conduct cross-site scripting (XSS) attacks, install lightweight themes without user interaction, spoof the filename in the downloads panel, or execute arbitrary code. (CVE-2018-5150, CVE-2018-5151, CVE-2018-5153, CVE-2018-5154, CVE-2018-5155, CVE-2018-5157, CVE-2018-5158, CVE-2018-5159, CVE-2018-5160, CVE-2018-5163, CVE-2018-5164, CVE-2018-5168, CVE-2018-5173, CVE-2018-5175, CVE-2018-5177, CVE-2018-5180)</p> <p>Multiple security issues were discovered with WebExtensions. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to obtain sensitive information, or bypass security restrictions. (CVE-2018-5152, CVE-2018-5166)</p> <p>It was discovered that the web console and JavaScript debugger incorrectly linkified chrome: and javascript URLs. If a user were tricked in to clicking a specially crafted link, an attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2018-5167)</p> <p>It was discovered that dragging and dropping link text on to the home button could set the home page to include chrome pages. If a user were tricked in to dragging and dropping a specially crafted link on to the home button, an attacker could potentially exploit this bypass security…</p> https://vulnerability.circl.lu/vuln/usn-3645-1