Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-29524 State: PUBLISHED Published: 2023-04-18T23:04:48.087Z Last Updated: 2025-02-05T18:49:14.365Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-74 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute anything with the right of the Scheduler Application sheet page. A user without script or programming rights, edit your user profile with the object editor and add a new object of type XWiki.SchedulerJobClass, In "Job Script", groovy code can be added and will be executed in the server context on viewing.
Wiki.SchedulerJobClass, In "Job Script", groovy code can be added and will be executed in the server context on viewing. This has been patched in XWiki 14.10.3 and 15.0 RC1. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fc42-5w56-qw7h - https://jira.xwiki.org/browse/XWIKI-20295 - https://jira.xwiki.org/browse/XWIKI-20462
CVE ID: CVE-2023-29525 State: PUBLISHED Published: 2023-04-18T23:01:46.239Z Last Updated: 2025-02-05T19:04:44.805Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-74 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the `since` parameter of the `/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration` endpoint. This provides an XWiki syntax injection attack via the since-parameter, allowing privilege escalation from view to programming rights and subsequent code ex
ion attack via the since-parameter, allowing privilege escalation from view to programming rights and subsequent code execution privilege. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8 and 14.10.3. Users are advised to upgrade. Users unable to upgrade may modify the page `XWiki.Notifications.Code.LegacyNotificationAdministration` to add the missing escaping. For versions < 14.6-rc-1 a workaround is to modify the file `<xwikiwebapp>/templates/distribution/eventmigration.wiki` to add the missing escaping. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jgg7-w2rj-5
ner: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jgg7-w2rj-58cj - https://github.com/xwiki/xwiki-platform/commit/6d74e2e4aa03d19f0be385ab63ae9e0f0e90a766 - https://github.com/xwiki/xwiki-platform/commit/8e7c7f90f2ddaf067cb5b83b181af41513028754#diff-4e13f4ee4a42938bf1201b7ee71ca32edeacba22559daf0bcb89d534e0225949R70 - https://jira.xwiki.org/browse/XWIKI-20287
CVE ID: CVE-2023-29526 State: PUBLISHED Published: 2023-04-18T22:57:29.722Z Last Updated: 2025-02-05T20:45:15.815Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-74 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to display or interact with any page a user cannot access through the combination of the async and display macros. A comment with either macro will be executed when viewed providing a code injection vector in the context of the running server. This vulnerability has been patched in XWiki 15.0-rc
iding a code injection vector in the context of the running server. This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8, and 13.10.11. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gpq5-7p34-vqx5 - https://jira.xwiki.org/browse/XRENDERING-694 - https://jira.xwiki.org/browse/XWIKI-20394
CVE ID: CVE-2023-29527 State: PUBLISHED Published: 2023-04-18T22:53:41.740Z Last Updated: 2025-02-05T20:49:36.152Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-74 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions a user without script or programming right may edit a user profile (or any other document) with the wiki editor and add groovy script content. Viewing the document after saving it will execute the groovy script in the server context which provides code execution. This vulnerability has been patched in XWiki 1
te the groovy script in the server context which provides code execution. This vulnerability has been patched in XWiki 15.0-rc-1 and 14.10.3. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jgrg-qvpp-9vwr - https://jira.xwiki.org/browse/XWIKI-20423
CVE ID: CVE-2023-29528 State: PUBLISHED Published: 2023-04-20T17:08:50.083Z Last Updated: 2025-02-04T21:35:41.897Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-commons Problem Types: CWE-79 Description: XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection
omments. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. This problem has been patched in XWiki 14.10, HTML comments are now removed in restricted mode and a check has been introduced that ensures that comments don't start with `>`. There are no known workarounds apart from upgrading to a version includ
that ensures that comments don't start with `>`. There are no known workarounds apart from upgrading to a version including the fix. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-x37v-36wv-6v6h - https://github.com/xwiki/xwiki-commons/commit/8ff1a9d7e5d7b45b690134a537d53dc05cae04ab - https://jira.xwiki.org/browse/XCOMMONS-2568 - https://jira.xwiki.org/browse/XWIKI-20348
CVE ID: CVE-2023-29529 State: PUBLISHED Published: 2023-04-14T18:21:17.050Z Last Updated: 2025-02-06T18:45:34.043Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: matrix-org Products: matrix-js-sdk Problem Types: CWE-862 Description: matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call. This attack is possible because matrix-js-sdk's group call implementation accepts incomin
be participating in the call. This attack is possible because matrix-js-sdk's group call implementation accepts incoming direct calls from other users, even if they have not yet declared intent to participate in the group call, as a means of resolving a race condition in call setup. Affected versions do not restrict access to the user's outbound media in this case. Legacy 1:1 calls are unaffected. This is fixed in matrix-js-sdk 24.1.0. As a workaround, users may hold group calls in private rooms where only the exact users who are expected to participate in the call are present. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matri
sent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-6g67-q39g-r79q - https://github.com/matrix-org/matrix-spec-proposals/pull/3401 - https://github.com/matrix-org/matrix-js-sdk/releases/tag/v24.1.0
CVE ID: CVE-2023-29530 State: PUBLISHED Published: 2023-04-24T19:34:40.294Z Last Updated: 2025-02-13T16:49:22.272Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: laminas Products: laminas-diactoros Problem Types: CWE-20 Description: Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value, can cause an invalid message. This can lead to denial of service vectors or application errors. The problem has been patched in followi
valid message. This can lead to denial of service vectors or application errors. The problem has been patched in following versions 2.18.1, 2.19.1, 2.20.1, 2.21.1, 2.22.1, 2.23.1, 2.24.1, and 2.25.1. As a workaround, validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before calling `withHeader()`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/laminas/laminas-diactoros/security/advisories/GHSA-xv3h-4844-9h36 - https://github.com/advisories/GHSA-wxmh-65f7-jcvw - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.
com/advisories/GHSA-wxmh-65f7-jcvw - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPW54QK7ISDALPLP2CKODU4ZIVRYS336/
CVE ID: CVE-2023-29531 State: PUBLISHED Published: 2023-06-19T09:48:59.394Z Last Updated: 2024-12-11T15:35:54.769Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Out-of-bound memory access in WebGL on macOS Description: An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash. *This bug only affects Firefox and Thunderbird for macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.or
0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1794292 - https://www.mozilla.org/security/advisories/mfsa2023-13/ - https://www.mozilla.org/security/advisories/mfsa2023-14/ - https://www.mozilla.org/security/advisories/mfsa2023-15/
CVE ID: CVE-2023-29532 State: PUBLISHED Published: 2023-06-19T09:58:03.748Z Last Updated: 2024-12-11T15:44:37.402Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Mozilla Maintenance Service Write-lock bypass Description: A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. The update file can be replaced after the signature check, before the use, because the write-lock requested by the service does not work on a SMB server. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* This vulnerab
s attack requires local system access and only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1806394 - https://www.mozilla.org/security/advisories/mfsa2023-13/ - https://www.mozilla.org/security/advisories/mfsa2023-14/ - https://www.mozilla.org/security/advisories/mfsa2023-15/
CVE ID: CVE-2023-29533 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-09T15:57:51.065Z Vendors: Mozilla Products: Firefox, Focus for Android, Firefox ESR, Firefox for Android, Thunderbird Problem Types: Fullscreen notification obscured Description: A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. Additional A
< 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-15/ - https://www.mozilla.org/security/advisories/mfsa2023-14/ - https://www.mozilla.org/security/advisories/mfsa2023-13/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1814597 - https://bugzilla.mozilla.org/show_bug.cgi?id=1798219
CVE ID: CVE-2023-29534 State: PUBLISHED Published: 2023-06-19T10:11:00.470Z Last Updated: 2024-12-11T16:05:36.951Z Vendors: Mozilla Products: Firefox for Android, Focus for Android Problem Types: Fullscreen notification could have been obscured on Firefox for Android Description: Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have led to potential user confusion and spoofing attacks. *This bug only affects Firefox and Focus for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 112 and Focus for Android < 112. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
refox for Android < 112 and Focus for Android < 112. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1816007 - https://bugzilla.mozilla.org/show_bug.cgi?id=1816059 - https://bugzilla.mozilla.org/show_bug.cgi?id=1821155 - https://bugzilla.mozilla.org/show_bug.cgi?id=1821576 - https://bugzilla.mozilla.org/show_bug.cgi?id=1821906 - https://bugzilla.mozilla.org/show_bug.cgi?id=1822298 - https://bugzilla.mozilla.org/show_bug.cgi?id=1822305 - https://www.mozilla.org/security/advisories/mfsa2023-13/
CVE ID: CVE-2023-29535 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-09T15:55:55.277Z Vendors: Mozilla Products: Firefox, Focus for Android, Firefox ESR, Firefox for Android, Thunderbird Problem Types: Potential Memory Corruption following Garbage Collector compaction Description: Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
efox for Android < 112, and Thunderbird < 102.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-15/ - https://www.mozilla.org/security/advisories/mfsa2023-14/ - https://www.mozilla.org/security/advisories/mfsa2023-13/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1820543
CVE ID: CVE-2023-29536 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-09T15:50:32.771Z Vendors: Mozilla Products: Firefox, Focus for Android, Firefox ESR, Firefox for Android, Thunderbird Problem Types: Invalid free from JavaScript code Description: An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
< 112, and Thunderbird < 102.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-15/ - https://www.mozilla.org/security/advisories/mfsa2023-14/ - https://www.mozilla.org/security/advisories/mfsa2023-13/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1821959
CVE ID: CVE-2023-29537 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-09T16:01:18.843Z Vendors: Mozilla Products: Firefox for Android, Firefox, Focus for Android Problem Types: Data Races in font initialization code Description: Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-13/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1823365 - https://bugzill
ww.mozilla.org/security/advisories/mfsa2023-13/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1823365 - https://bugzilla.mozilla.org/show_bug.cgi?id=1824200 - https://bugzilla.mozilla.org/show_bug.cgi?id=1825569
CVE ID: CVE-2023-29538 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-09T16:00:31.904Z Vendors: Mozilla Products: Firefox for Android, Firefox, Focus for Android Problem Types: Directory information could have been leaked to WebExtensions Description: Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load request. This leaked directory paths on the user's machine. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.o
d < 112. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-13/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1685403
CVE ID: CVE-2023-29539 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-09T15:44:00.471Z Vendors: Mozilla Products: Firefox, Focus for Android, Firefox ESR, Firefox for Android, Thunderbird Problem Types: Content-Disposition filename truncation leads to Reflected File Download Description: When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.
affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-15/ - https://www.mozilla.org/security/advisories/mfsa2023-14/ - https://www.mozilla.org/security/advisories/mfsa2023-13/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1784348
CVE ID: CVE-2023-29540 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-09T15:42:25.288Z Vendors: Mozilla Products: Firefox for Android, Firefox, Focus for Android Problem Types: Iframe sandbox bypass using redirects and sourceMappingUrls Description: Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without <code>allow-top-navigation-to-custom-protocols</code>. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/adviso
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-13/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1790542
CVE ID: CVE-2023-29541 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-10T19:09:55.275Z Vendors: Mozilla Products: Firefox, Focus for Android, Firefox ESR, Firefox for Android, Thunderbird Problem Types: Files with malicious extensions could have been downloaded unsafely on Linux Description: Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands. <br>*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*. This vulnerability affects Firefox < 112, Focus for Andr
illa is unable to enumerate all affected Linux Distributions.*. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-15/ - https://www.mozilla.org/security/advisories/mfsa2023-14/ - https://www.mozilla.org/security/advisories/mfsa2023-13/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1810191
CVE ID: CVE-2023-29542 State: PUBLISHED Published: 2023-06-19T10:03:32.039Z Last Updated: 2024-12-11T15:47:00.715Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Bypass of file download extension restrictions Description: A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code. *This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10. Additional Analy
unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1810793 - https://bugzilla.mozilla.org/show_bug.cgi?id=1815062 - https://www.mozilla.org/security/advisories/mfsa2023-13/ - https://www.mozilla.org/security/advisories/mfsa2023-14/ - https://www.mozilla.org/security/advisories/mfsa2023-15/
CVE ID: CVE-2023-29543 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-10T19:11:43.797Z Vendors: Mozilla Products: Firefox for Android, Firefox, Focus for Android Problem Types: Use-after-free in debugging APIs Description: An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-13/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1816158