Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-23921 State: PUBLISHED Published: 2021-04-01T21:46:21 Last Updated: 2024-08-03T19:14:09.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Devolutions Server before 2020.3. There is broken access control on Password List entry elements. Additional Analyst Notes: - CVE Program Container: References: - https://devolutions.net/security/advisories/devo-2021-0002
CVE ID: CVE-2021-23922 State: PUBLISHED Published: 2021-04-01T21:53:28 Last Updated: 2024-08-03T19:14:09.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Devolutions Remote Desktop Manager before 2020.2.12. There is a cross-site scripting (XSS) vulnerability in webviews. Additional Analyst Notes: - CVE Program Container: References: - https://devolutions.net/security/advisories/devo-2021-0001
CVE ID: CVE-2021-23923 State: PUBLISHED Published: 2021-04-01T21:44:52 Last Updated: 2024-08-03T19:14:09.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Devolutions Server before 2020.3. There is Broken Authentication with Windows domain users. Additional Analyst Notes: - CVE Program Container: References: - https://devolutions.net/security/advisories/devo-2021-0002
CVE ID: CVE-2021-23924 State: PUBLISHED Published: 2021-04-01T21:48:52 Last Updated: 2024-08-03T19:14:09.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Devolutions Server before 2020.3. There is an exposure of sensitive information in diagnostic files. Additional Analyst Notes: - CVE Program Container: References: - https://devolutions.net/security/advisories/devo-2021-0002
CVE ID: CVE-2021-23925 State: PUBLISHED Published: 2021-04-01T21:50:10 Last Updated: 2024-08-03T19:14:09.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Devolutions Server before 2020.3. There is a cross-site scripting (XSS) vulnerability in entries of type Document. Additional Analyst Notes: - CVE Program Container: References: - https://devolutions.net/security/advisories/devo-2021-0002
CVE ID: CVE-2021-23926 State: PUBLISHED Published: 2021-01-14T14:45:18.000Z Last Updated: 2025-02-13T16:27:47.031Z Vendors: Apache Software Foundation Products: Apache XMLBeans Problem Types: Information Disclosure Description: The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0. Additional Analyst Notes: - CVE Program Container: References: - https://poi.apache.org/ - https://issues.apache.org/jira/browse/XMLBEANS-517 - https://lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3
ues.apache.org/jira/browse/XMLBEANS-517 - https://lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed%40%3Cjava-dev.axis.apache.org%3E - https://lists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1%40%3Cjava-dev.axis.apache.org%3E - https://lists.debian.org/debian-lts-announce/2021/06/msg00024.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://security.netapp.com/advisory/ntap-20210513-0004/ - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-23927 State: PUBLISHED Published: 2021-01-12T21:26:53 Last Updated: 2024-08-03T19:14:09.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE ID: CVE-2021-23928 State: PUBLISHED Published: 2021-01-12T21:26:40 Last Updated: 2024-08-03T19:14:09.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE ID: CVE-2021-23929 State: PUBLISHED Published: 2021-01-12T21:26:28 Last Updated: 2024-08-03T19:14:09.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/<share-token>?delivery=view URI. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE ID: CVE-2021-23930 State: PUBLISHED Published: 2021-01-12T21:26:16 Last Updated: 2024-08-03T19:14:09.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE ID: CVE-2021-23931 State: PUBLISHED Published: 2021-01-12T21:26:06 Last Updated: 2024-08-03T19:14:09.798Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.4 allows XSS via an inline binary file. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE ID: CVE-2021-23932 State: PUBLISHED Published: 2021-01-12T21:25:56 Last Updated: 2024-08-03T19:14:09.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE ID: CVE-2021-23933 State: PUBLISHED Published: 2021-01-12T21:25:44 Last Updated: 2024-08-03T19:14:09.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE ID: CVE-2021-23934 State: PUBLISHED Published: 2021-01-12T21:25:33 Last Updated: 2024-08-03T19:14:09.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE ID: CVE-2021-23935 State: PUBLISHED Published: 2021-01-12T21:25:23 Last Updated: 2024-08-03T19:14:09.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE ID: CVE-2021-23936 State: PUBLISHED Published: 2021-01-12T21:25:12 Last Updated: 2024-08-03T19:14:09.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.4 allows XSS via the subject of a task. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE ID: CVE-2021-23937 State: PUBLISHED Published: 2021-05-25T08:05:10 Last Updated: 2024-08-03T19:14:09.890Z Vendors: Apache Software Foundation Products: Apache Wicket Problem Types: DNS proxy and possible amplification attack Description: A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the server when the X-Forwarded-For header is not properly sanitized. This DNS lookup can be engineered to overload an internal DNS server or to slow down request processing of the Apache Wicket application causing a possible denial of service on either the internal infrastructure or the web application it
Wicket application causing a possible denial of service on either the internal infrastructure or the web application itself. This issue affects Apache Wicket Apache Wicket 9.x version 9.2.0 and prior versions; Apache Wicket 8.x version 8.11.0 and prior versions; Apache Wicket 7.x version 7.17.0 and prior versions and Apache Wicket 6.x version 6.2.0 and later versions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rc2ef22f90793e158cef65a7e370cdbca023c499d1403d65feeca870d%40%3Cusers.wicket.apache.org%3E - https://lists.apache.org/thread.html/r127c0c1f3cb71e5bc619ad1e4b898b97c49758d1f20a54042966473e%40%3Cannounce.wicket.apache.org%3E - ht
apache.org/thread.html/r127c0c1f3cb71e5bc619ad1e4b898b97c49758d1f20a54042966473e%40%3Cannounce.wicket.apache.org%3E - https://lists.apache.org/thread.html/r127c0c1f3cb71e5bc619ad1e4b898b97c49758d1f20a54042966473e%40%3Cusers.wicket.apache.org%3E - https://lists.apache.org/thread.html/r8ccbd91b56ebf045d151bd4282bfeea7842a0698a0b76118fca8fe78%40%3Cdev.wicket.apache.org%3E
CVE ID: CVE-2021-23938 State: REJECTED Published: N/A Last Updated: 2023-02-21T00:00:00 Description: No description available.
CVE ID: CVE-2021-23939 State: REJECTED Published: N/A Last Updated: 2023-02-21T00:00:00 Description: No description available.
CVE ID: CVE-2021-23940 State: REJECTED Published: N/A Last Updated: 2023-02-21T00:00:00 Description: No description available.
CVE ID: CVE-2021-23941 State: REJECTED Published: N/A Last Updated: 2023-02-21T00:00:00 Description: No description available.
CVE ID: CVE-2021-23942 State: REJECTED Published: N/A Last Updated: 2023-02-21T00:00:00 Description: No description available.
CVE ID: CVE-2021-23943 State: REJECTED Published: N/A Last Updated: 2023-02-21T00:00:00 Description: No description available.
CVE ID: CVE-2021-23944 State: REJECTED Published: N/A Last Updated: 2023-02-21T00:00:00 Description: No description available.
CVE ID: CVE-2021-23945 State: REJECTED Published: N/A Last Updated: 2023-02-21T00:00:00 Description: No description available.
CVE ID: CVE-2021-23946 State: REJECTED Published: N/A Last Updated: 2023-02-21T00:00:00 Description: No description available.
CVE ID: CVE-2021-23947 State: REJECTED Published: N/A Last Updated: 2023-02-21T00:00:00 Description: No description available.
CVE ID: CVE-2021-23948 State: REJECTED Published: N/A Last Updated: 2023-02-21T00:00:00 Description: No description available.
CVE ID: CVE-2021-23949 State: REJECTED Published: N/A Last Updated: 2023-02-21T00:00:00 Description: No description available.
CVE ID: CVE-2021-23950 State: REJECTED Published: N/A Last Updated: 2023-02-21T00:00:00 Description: No description available.
CVE ID: CVE-2021-23951 State: REJECTED Published: N/A Last Updated: 2023-02-21T00:00:00 Description: No description available.
CVE ID: CVE-2021-23952 State: REJECTED Published: N/A Last Updated: 2023-02-21T00:00:00 Description: No description available.
CVE ID: CVE-2021-23953 State: PUBLISHED Published: 2021-02-26T02:11:08 Last Updated: 2024-08-03T19:14:09.723Z Vendors: Mozilla Products: Firefox, Thunderbird, Firefox ESR Problem Types: Cross-origin information leakage via redirected PDF requests Description: If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-03/ - https://www.mozilla.org/security/advisories/mfsa2021-04/ -
- https://www.mozilla.org/security/advisories/mfsa2021-03/ - https://www.mozilla.org/security/advisories/mfsa2021-04/ - https://www.mozilla.org/security/advisories/mfsa2021-05/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1683940
CVE ID: CVE-2021-23954 State: PUBLISHED Published: 2021-02-26T02:10:45 Last Updated: 2024-08-03T19:14:09.879Z Vendors: Mozilla Products: Firefox, Thunderbird, Firefox ESR Problem Types: Type confusion when using logical assignment operators in JavaScript switch statements Description: Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-03/ - https://www.mozilla.org/s
VE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-03/ - https://www.mozilla.org/security/advisories/mfsa2021-04/ - https://www.mozilla.org/security/advisories/mfsa2021-05/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1684020
CVE ID: CVE-2021-23955 State: PUBLISHED Published: 2021-02-26T02:10:22 Last Updated: 2024-08-03T19:14:09.782Z Vendors: Mozilla Products: Firefox Problem Types: Clickjacking across tabs through misusing requestPointerLock Description: The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to clickjacking attacks. This vulnerability affects Firefox < 85. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1684837
CVE ID: CVE-2021-23956 State: PUBLISHED Published: 2021-02-26T02:09:46 Last Updated: 2024-08-03T19:14:09.861Z Vendors: Mozilla Products: Firefox Problem Types: File picker dialog could have been used to disclose a complete directory Description: An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory. This was addressed by adding a new prompt. This vulnerability affects Firefox < 85. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1338637
CVE ID: CVE-2021-23957 State: PUBLISHED Published: 2021-02-26T02:08:50 Last Updated: 2024-08-03T19:14:09.804Z Vendors: Mozilla Products: Firefox Problem Types: Iframe sandbox could have been bypassed on Android via the intent URL scheme Description: Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 85. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1584582
CVE ID: CVE-2021-23958 State: PUBLISHED Published: 2021-02-26T02:07:56 Last Updated: 2024-08-03T19:14:09.761Z Vendors: Mozilla Products: Firefox Problem Types: Screen sharing permission leaked across tabs Description: The browser could have been confused into transferring a screen sharing state into another tab, which would leak unintended information. This vulnerability affects Firefox < 85. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1642747
CVE ID: CVE-2021-23959 State: PUBLISHED Published: 2021-02-26T02:06:36 Last Updated: 2024-08-03T19:14:09.722Z Vendors: Mozilla Products: Firefox Problem Types: Cross-Site Scripting in error pages on Firefox for Android Description: An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 85. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1659035
CVE ID: CVE-2021-23960 State: PUBLISHED Published: 2021-02-26T02:05:50 Last Updated: 2024-08-03T19:14:09.953Z Vendors: Mozilla Products: Firefox, Thunderbird, Firefox ESR Problem Types: Use-after-poison for incorrectly redeclared JavaScript variables during GC Description: Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-03/ - https://www.mozilla.org/security/advisories/mfsa2021-04/ - https://www.mozilla.or
org/security/advisories/mfsa2021-03/ - https://www.mozilla.org/security/advisories/mfsa2021-04/ - https://www.mozilla.org/security/advisories/mfsa2021-05/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1675755
CVE ID: CVE-2021-23961 State: PUBLISHED Published: 2021-02-26T02:02:52 Last Updated: 2024-08-03T19:14:09.837Z Vendors: Mozilla Products: Firefox Problem Types: More internal network hosts could have been probed by a malicious webpage Description: Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox < 85. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1677940 - https://www.debian.org/security/2
urity/advisories/mfsa2021-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1677940 - https://www.debian.org/security/2021/dsa-4895 - https://lists.debian.org/debian-lts-announce/2021/04/msg00019.html - https://www.debian.org/security/2021/dsa-4897 - https://lists.debian.org/debian-lts-announce/2021/04/msg00020.html - https://security.gentoo.org/glsa/202104-10 - https://security.gentoo.org/glsa/202104-09
CVE ID: CVE-2021-23962 State: PUBLISHED Published: 2021-02-26T02:02:19 Last Updated: 2024-08-03T19:14:09.929Z Vendors: Mozilla Products: Firefox Problem Types: Use-after-poison in <code>nsTreeBodyFrame::RowCountChanged</code> Description: Incorrect use of the '<RowCountChanged>' method could have led to a user-after-poison and a potentially exploitable crash. This vulnerability affects Firefox < 85. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1677194
CVE ID: CVE-2021-23963 State: PUBLISHED Published: 2021-02-26T02:11:24 Last Updated: 2024-08-03T19:14:09.972Z Vendors: Mozilla Products: Firefox Problem Types: Permission prompt inaccessible after asking for additional permissions Description: When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control over the currently granted permission. This vulnerability affects Firefox < 85. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1680793
CVE ID: CVE-2021-23964 State: PUBLISHED Published: 2021-02-26T15:29:10 Last Updated: 2024-08-03T19:14:10.033Z Vendors: Mozilla Products: Firefox, Thunderbird, Firefox ESR Problem Types: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7 Description: Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisorie
ESR < 78.7. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-03/ - https://www.mozilla.org/security/advisories/mfsa2021-04/ - https://www.mozilla.org/security/advisories/mfsa2021-05/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662507%2C1666285%2C1673526%2C1674278%2C1674835%2C1675097%2C1675844%2C1675868%2C1677590%2C1677888%2C1680410%2C1681268%2C1682068%2C1682938%2C1683736%2C1685260%2C1685925
CVE ID: CVE-2021-23965 State: PUBLISHED Published: 2021-02-26T15:28:48 Last Updated: 2024-08-03T19:14:10.026Z Vendors: Mozilla Products: Firefox Problem Types: Memory safety bugs fixed in Firefox 85 Description: Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-03/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1670378%2C1673555%2C1676812%2C1678582%2C1684497
CVE ID: CVE-2021-23968 State: PUBLISHED Published: 2021-02-26T01:59:36 Last Updated: 2024-08-03T19:14:09.815Z Vendors: Mozilla Products: Firefox, Thunderbird, Firefox ESR Problem Types: Content Security Policy violation report could have contained the destination of a redirect Description: If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. Additional Analyst Notes: - CVE Program Container: References: - ht
ox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-07/ - https://www.mozilla.org/security/advisories/mfsa2021-09/ - https://www.mozilla.org/security/advisories/mfsa2021-08/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1687342 - https://lists.debian.org/debian-lts-announce/2021/03/msg00000.html - https://www.debian.org/security/2021/dsa-4866 - https://security.gentoo.org/glsa/202104-10 - https://security.gentoo.org/glsa/202104-09
CVE ID: CVE-2021-23969 State: PUBLISHED Published: 2021-02-26T01:57:45 Last Updated: 2024-08-03T19:14:09.977Z Vendors: Mozilla Products: Firefox, Thunderbird, Firefox ESR Problem Types: Content Security Policy violation report could have contained the destination of a redirect Description: As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Firefox incorrectly set the source file to be the destination of the redirects.
kage." Under certain types of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-07/ - https://www.mozilla.org/security/advisories/mfsa2021-09/ - https://www.mozilla.org/security/advisories/mfsa2021-08/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1542194 - https://lists.debian.org/debian-lts-announce/2021/03/msg00000.html - https://www.debian.org/security/2021/dsa-4866 - https://security.gentoo.
org/debian-lts-announce/2021/03/msg00000.html - https://www.debian.org/security/2021/dsa-4866 - https://security.gentoo.org/glsa/202104-10 - https://security.gentoo.org/glsa/202104-09