CVE-2019-11723

A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across different "containers" for people who use the Firefox Multi-Account Containers Web Extension. This vulnerability affects Firefox < 68.

• CWE-346

• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.htmlMailing List, Third Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1528335Issue Tracking, Permissions Required, Vendor Advisory
• https://security.gentoo.org/glsa/201908-12Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2019-21/Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.htmlMailing List, Third Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1528335Issue Tracking, Permissions Required, Vendor Advisory
• https://security.gentoo.org/glsa/201908-12Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2019-21/Vendor Advisory

Published

Jul 23, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11718Activity Stream can display content from sent from the Snipp…5.3
• CVE-2019-11719When importing a curve25519 private key in PKCS#8format with…
• CVE-2019-1172An information disclosure vulnerability exists in Azure Acti…4.3
• CVE-2019-11720Some unicode characters are incorrectly treated as whitespac…6.1
• CVE-2019-11721The unicode latin 'kra' character can be used to spoof a sta…6.5
• CVE-2019-11722Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-11724Application permissions give additional remote troubleshooti…6.1
• CVE-2019-11725When a user navigates to site marked as unsafe by the Safebr…6.5
• CVE-2019-11727A vulnerability exists where it possible to force Network Se…
• CVE-2019-11728The HTTP Alternative Services header, Alt-Svc, can be used b…4.7
• CVE-2019-11729Empty or malformed p256-ECDH public keys may trigger a segme…
• CVE-2019-1173An elevation of privilege vulnerability exists in the way th…7