deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-26256
Published: 2020-12-08
Description: Fast-csv is an npm package for parsing and formatting CSVs or any other delimited value file in node. In fast-cvs before version 4.3.6 there is a possible ReDoS vulnerability (Regular Expression Denial of Service) when using ignoreEmpty option when parsing. This has been patched in `v4.3.6` You will only be affected by this if you use the `ignoreEmpty` parsing option. If you do use this option it is recommended that you upgrade to the latest version `v4.3.6` This vulnerability was found using a CodeQL query which identified `EMPTY_ROW_REGEXP` regular expression as vulnerable.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/C2FO/fast-csv/commit/4bbd39f26a8cd7382151ab4f5fb102234b2f829e; https://github.com/C2FO/fast-csv/issues/540; https://github.com/C2FO/fast-csv/security/advisories/GHSA-8cv5-p934-3hwp
CVE: CVE-2020-27750
Published: 2020-12-08
Description: A flaw was found in ImageMagick in MagickCore/colorspace-private.h and MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned char` and math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-68.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://bugzilla.redhat.com/show_bug.cgi?id=1891984; https://lists.debian.org/debian-lts-announce/2021/01/msg00010.html; https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
CVE: CVE-2020-27751
Published: 2020-12-08
Description: A flaw was found in ImageMagick in MagickCore/quantum-export.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned long long` as well as a shift exponent that is too large for 64-bit type. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
CVSS Score: 3.3 (LOW)
CWE: CWE-190, CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1891994; https://lists.debian.org/debian-lts-announce/2021/06/msg00000.html; https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
CVE: CVE-2020-27752
Published: 2020-12-08
Description: A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger a heap buffer overflow. This would most likely lead to an impact to application availability, but could potentially lead to an impact to data integrity as well. This flaw affects ImageMagick versions prior to 7.0.9-0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-122
References: https://bugzilla.redhat.com/show_bug.cgi?id=1894226; https://bugzilla.redhat.com/show_bug.cgi?id=1894226
CVE: CVE-2020-27753
Published: 2020-12-08
Description: There are several memory leaks in the MIFF coder in /coders/miff.c due to improper image depth values, which can be triggered by a specially crafted input file. These leaks could potentially lead to an impact to application availability or cause a denial of service. It was originally reported that the issues were in `AcquireMagickMemory()` because that is where LeakSanitizer detected the leaks, but the patch resolves issues in the MIFF coder, which incorrectly handles data being passed to `AcquireMagickMemory()`. This flaw affects ImageMagick versions prior to 7.0.9-0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=1894229; https://bugzilla.redhat.com/show_bug.cgi?id=1894229
CVE: CVE-2020-27754
Published: 2020-12-08
Description: In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller when ImageMagick processes a crafted input file. To mitigate this, the patch introduces and uses the ConstrainPixelIntensity() function, which forces the pixel intensities to be within the proper bounds in the event of an overflow. This flaw affects ImageMagick versions prior to 6.9.10-69 and 7.0.8-69.
CVSS Score: 3.3 (LOW)
CWE: CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1894231; https://lists.debian.org/debian-lts-announce/2021/03/msg00030.html; https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
CVE: CVE-2020-27755
Published: 2020-12-08
Description: in SetImageExtent() of /MagickCore/image.c, an incorrect image depth size can cause a memory leak because the code which checks for the proper image depth size does not reset the size in the event there is an invalid size. The patch resets the depth to a proper size before throwing an exception. The memory leak can be triggered by a crafted input file that is processed by ImageMagick and could cause an impact to application reliability, such as denial of service. This flaw affects ImageMagick versions prior to 7.0.9-0.
CVSS Score: 3.3 (LOW)
CWE: CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=1894232; https://bugzilla.redhat.com/show_bug.cgi?id=1894232
CVE: CVE-2020-27756
Published: 2020-12-08
Description: In ParseMetaGeometry() of MagickCore/geometry.c, image height and width calculations can lead to divide-by-zero conditions which also lead to undefined behavior. This flaw can be triggered by a crafted input file processed by ImageMagick and could impact application availability. The patch uses multiplication in addition to the function `PerceptibleReciprocal()` in order to prevent such divide-by-zero conditions. This flaw affects ImageMagick versions prior to 7.0.9-0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://bugzilla.redhat.com/show_bug.cgi?id=1894233; https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html; https://bugzilla.redhat.com/show_bug.cgi?id=1894233
CVE: CVE-2020-27757
Published: 2020-12-08
Description: A floating point math calculation in ScaleAnyToQuantum() of /MagickCore/quantum-private.h could lead to undefined behavior in the form of a value outside the range of type unsigned long long. The flaw could be triggered by a crafted input file under certain conditions when it is processed by ImageMagick. Red Hat Product Security marked this as Low because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to 7.0.8-68.
CVSS Score: 3.3 (LOW)
CWE: CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1894234; https://lists.debian.org/debian-lts-announce/2021/03/msg00030.html; https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
CVE: CVE-2020-27758
Published: 2020-12-08
Description: A flaw was found in ImageMagick in coders/txt.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned long long`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-68.
CVSS Score: 3.3 (LOW)
CWE: CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1894236; https://lists.debian.org/debian-lts-announce/2021/03/msg00030.html; https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
CVE: CVE-2020-27821
Published: 2020-12-08
Description: A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial of service. This flaw affects QEMU versions prior to 5.2.0.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://www.openwall.com/lists/oss-security/2020/12/16/6; https://bugzilla.redhat.com/show_bug.cgi?id=1902651; https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE: CVE-2020-27896
Published: 2020-12-08
Description: A path handling issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.0.1. A remote attacker may be able to modify the file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2020/Dec/26; http://seclists.org/fulldisclosure/2020/Dec/32; https://support.apple.com/en-us/HT211931
CVE: CVE-2020-27918
Published: 2020-12-08
Description: A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, Safari 14.0.1, tvOS 14.2, iTunes 12.11 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://seclists.org/fulldisclosure/2020/Dec/32; http://www.openwall.com/lists/oss-security/2021/03/22/1; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EQ3U3VBSOJB46WCO66TEWE5OAXLTU3YW/
CVE: CVE-2020-28274
Published: 2020-12-08
Description: Prototype pollution vulnerability in 'deepref' versions 1.1.1 through 1.2.1 allows attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28274%2Chttps://github.com/isaymatato/deepref/commit/24935e6a1060cb09c641d3075982f0b44cfca4c2; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28274%2Chttps://github.com/isaymatato/deepref/commit/24935e6a1060cb09c641d3075982f0b44cfca4c2
CVE: CVE-2020-9991
Published: 2020-12-08
Description: This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, iOS 14.0 and iPadOS 14.0, iCloud for Windows 7.21, tvOS 14.0. A remote attacker may be able to cause a denial of service.
CVSS Score: 7.5 (HIGH)
References: http://seclists.org/fulldisclosure/2020/Dec/32; https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E; https://support.apple.com/en-us/HT211843
CVE: CVE-2020-26234
Published: 2020-12-08
Description: Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. This problem is fixed in Opencast 7.9 and Opencast 8.8 Please be aware that fixing the problem means that Opencast will not simply accept any self-signed certificates any longer without properly importing them. If you need those, please make sure to import them into the Java key store. Better yet, get a valid certificate.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-346, CWE-346
References: https://github.com/opencast/opencast/commit/4225bf90af74557deaf8fb6b80b0705c9621acfc; https://github.com/opencast/opencast/security/advisories/GHSA-44cw-p2hm-gpf6; https://github.com/opencast/opencast/commit/4225bf90af74557deaf8fb6b80b0705c9621acfc
CVE: CVE-2020-26249
Published: 2020-12-09
Description: Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. In Red Discord Bot before version 0.1.7a an RCE exploit has been discovered. This exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserver front-end code. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This high severity exploit has been fixed on version 0.1.7a. There are no workarounds, bot owners must upgrade their relevant packages (Dashboard module and Dashboard webserver) in order to patch this issue.
CVSS Score: 7.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/Cog-Creators/Red-Dashboard/commit/99d88b[PII_REDACTED]66ce005b784ae8e31e955ab1; https://github.com/Cog-Creators/Red-Dashboard/commit/a6b[PII_REDACTED]ec87fb75305e7d1cc2d40c7ab91; https://github.com/Cog-Creators/Red-Dashboard/security/advisories/GHSA-hm45-mgqm-gjm4
CVE: CVE-2020-27614
Published: 2020-12-09
Description: AnyDesk for macOS versions 6.0.2 and older have a vulnerability in the XPC interface that does not properly validate client requests and allows local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://anydesk.com/cve/2020-27614/; https://download.anydesk.com/changelog.txt; https://anydesk.com/cve/2020-27614/
CVE: CVE-2020-10146
Published: 2020-12-09
Description: The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited on Teams clients to obtain sensitive information such as authentication tokens and to possibly execute arbitrary commands. This vulnerability was fixed for all Teams users in the online service on or around October 2020.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/oskarsve/ms-teams-rce; https://github.com/oskarsve/ms-teams-rce
CVE: CVE-2020-25627
Published: 2020-12-09
Description: The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed in 3.9.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://moodle.org/mod/forum/discuss.php?d=410839; https://moodle.org/mod/forum/discuss.php?d=410839
CVE: CVE-2020-26950
Published: 2020-12-09
Description: In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox ESR < 78.4.1, and Thunderbird < 78.4.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://packetstormsecurity.com/files/166175/Firefox-MCallGetProperty-Write-Side-Effects-Use-After-Free.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1675905; https://www.mozilla.org/security/advisories/mfsa2020-49/
CVE: CVE-2020-26951
Published: 2020-12-09
Description: A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1667113; https://www.mozilla.org/security/advisories/mfsa2020-50/; https://www.mozilla.org/security/advisories/mfsa2020-51/
CVE: CVE-2020-26952
Published: 2020-12-09
Description: Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially exploitable crash when handling out-of-memory errors. This vulnerability affects Firefox < 83.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1667685; https://www.mozilla.org/security/advisories/mfsa2020-50/; https://bugzilla.mozilla.org/show_bug.cgi?id=1667685
CVE: CVE-2020-26953
Published: 2020-12-09
Description: It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the user. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1656741; https://www.mozilla.org/security/advisories/mfsa2020-50/; https://www.mozilla.org/security/advisories/mfsa2020-51/
CVE: CVE-2020-26954
Published: 2020-12-09
Description: When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1657026; https://www.mozilla.org/security/advisories/mfsa2020-50/; https://bugzilla.mozilla.org/show_bug.cgi?id=1657026
CVE: CVE-2020-26955
Published: 2020-12-09
Description: When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of whether the original and subsequent request were in private and non-private browsing modes. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-565
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1663261; https://www.mozilla.org/security/advisories/mfsa2020-50/; https://bugzilla.mozilla.org/show_bug.cgi?id=1663261
CVE: CVE-2020-26956
Published: 2020-12-09
Description: In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1666300; https://www.mozilla.org/security/advisories/mfsa2020-50/; https://www.mozilla.org/security/advisories/mfsa2020-51/
CVE: CVE-2020-26957
Published: 2020-12-09
Description: OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-665
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1667179; https://www.mozilla.org/security/advisories/mfsa2020-50/; https://bugzilla.mozilla.org/show_bug.cgi?id=1667179
CVE: CVE-2020-26958
Published: 2020-12-09
Description: Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1669355; https://www.mozilla.org/security/advisories/mfsa2020-50/; https://www.mozilla.org/security/advisories/mfsa2020-51/
CVE: CVE-2020-26959
Published: 2020-12-09
Description: During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1669466; https://www.mozilla.org/security/advisories/mfsa2020-50/; https://www.mozilla.org/security/advisories/mfsa2020-51/
CVE: CVE-2020-26960
Published: 2020-12-09
Description: If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1670358; https://www.mozilla.org/security/advisories/mfsa2020-50/; https://www.mozilla.org/security/advisories/mfsa2020-51/
CVE: CVE-2020-26961
Published: 2020-12-09
Description: When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding attack. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1672528; https://www.mozilla.org/security/advisories/mfsa2020-50/; https://www.mozilla.org/security/advisories/mfsa2020-51/
CVE: CVE-2020-26962
Published: 2020-12-09
Description: Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated. This could have been used in clickjacking attacks, as well as be read across partitions in dynamic first party isolation. This vulnerability affects Firefox < 83.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=610997; https://www.mozilla.org/security/advisories/mfsa2020-50/; https://bugzilla.mozilla.org/show_bug.cgi?id=610997
CVE: CVE-2020-26963
Published: 2020-12-09
Description: Repeated calls to the history and location interfaces could have been used to hang the browser. This was addressed by introducing rate-limiting to these API calls. This vulnerability affects Firefox < 83.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1314912; https://www.mozilla.org/security/advisories/mfsa2020-50/; https://bugzilla.mozilla.org/show_bug.cgi?id=1314912
CVE: CVE-2020-26964
Published: 2020-12-09
Description: If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the browser to read and interact with web content. The feature was implemented as a unix domain socket, protected by the Android SELinux policy; however, SELinux was not enforced for versions prior to 6.0. This was fixed by removing the Remote Debugging via USB feature from affected devices. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.
CVSS Score: 6.8 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1658865; https://www.mozilla.org/security/advisories/mfsa2020-50/; https://bugzilla.mozilla.org/show_bug.cgi?id=1658865
CVE: CVE-2020-26965
Published: 2020-12-09
Description: Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remembers user input, a user typed their password and used that feature, the type of the password field was changed, resulting in a keyboard layout change and the possibility for the software keyboard to remember the typed password. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-212
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1661617; https://www.mozilla.org/security/advisories/mfsa2020-50/; https://www.mozilla.org/security/advisories/mfsa2020-51/
CVE: CVE-2020-26966
Published: 2020-12-09
Description: Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an information leak. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1663571; https://www.mozilla.org/security/advisories/mfsa2020-50/; https://www.mozilla.org/security/advisories/mfsa2020-51/