xdg-desktop-portal vulnerabilities (SUSE)
32 vulnerabilities.
xdg-desktop-portalSUSEXDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key8.3 Highxdg-desktop-portalSUSEXDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal8.8 Highxdg-desktop-portalSUSEFlatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash...2.9 Lowxdg-desktop-portalSUSEMemory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 1418.8 Highxdg-desktop-portalSUSEMemory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 1418.8 Highxdg-desktop-portalSUSESearch terms persisted in URL bar8.1 Highxdg-desktop-portalSUSEMemory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 1418.8 Highxdg-desktop-portalSUSEIncorrect JavaScript state machine for generators6.5 Mediumxdg-desktop-portalSUSECSP frame-src was not correctly enforced for paths9.8 Criticalxdg-desktop-portalSUSEXSLT documents could bypass CSP8.1 Highxdg-desktop-portalSUSEIncorrect URL stripping in CSP reports9.8 Criticalxdg-desktop-portalSUSENameless cookies shadow secure cookies9.1 Criticalxdg-desktop-portalSUSEDNS rebinding circumvents CORS8.1 Highxdg-desktop-portalSUSEPotential user-assisted code execution in “Copy as cURL” command8.1 Highxdg-desktop-portalSUSEjavascript: URLs executed on object and embed tags8.1 Highxdg-desktop-portalSUSELarge branch table could lead to truncated instruction9.8 Criticalxdg-desktop-portalSUSEJavaScript engine only wrote partial return value to stack6.5 Mediumxdg-desktop-portalSUSEMemory safety bugs fixed in Firefox 140 and Thunderbird 1408.1 Highxdg-desktop-portalSUSESave as in Devtools could download files without sanitizing the extension8.1 Highxdg-desktop-portalSUSEHTTPS-Only exception screen lacked anti-clickjacking delay4.3 Mediumxdg-desktop-portalSUSEWebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate9.8 Criticalxdg-desktop-portalSUSEDNS Requests leaked outside of a configured SOCKS proxy8.6 Highxdg-desktop-portalSUSEThe prompt in Firefox for Android that asks before opening a link in an external application could be bypassed6.5 Mediumxdg-desktop-portalSUSEFirefox for Android opened URLs specified in a link querystring parameter4.3 Mediumxdg-desktop-portalSUSEContent-Disposition header ignored when a file is included in an embed or object tag6.1 Mediumxdg-desktop-portalSUSEconnect-src Content Security Policy restriction could be bypassed9.1 Criticalxdg-desktop-portalSUSEIncorrect parsing of URLs could have allowed embedding of youtube.com6.5 Mediumxdg-desktop-portalSUSENo warning when opening executable terminal files on macOS8.8 Highxdg-desktop-portalSUSEThe WebCompat WebExtension shipped with Firefox exposed a persistent UUID4.3 Mediumxdg-desktop-portalSUSEUse-after-free in FontFaceSet9.8 Criticalxdg-desktop-portalSUSEFlatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsing8.4 Highxdg-desktop-portalSUSEFlatpak sandbox escape via spawn portal7.3 High