CVE-2023-4054

When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 102.14, Firefox ESR < 115.1, Thunderbird < 102.14, and Thunderbird < 115.1.

• https://bugzilla.mozilla.org/show_bug.cgi?id=1840777Issue Tracking, Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2023-29/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-30/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-31/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-32/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-33/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1840777Issue Tracking, Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2023-29/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-30/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-31/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-32/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-33/Vendor Advisory

Published

Aug 1, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40533Rejected reason: This CVE ID is a duplicate of CVE-2022-4046…
• CVE-2023-40534When a client-side HTTP/2 profile and the HTTP MRF Router op…7.5
• CVE-2023-40535Stored cross-site scripting vulnerability in View setting pa…5.4
• CVE-2023-40536Race condition for some some Intel(R) PROSet/Wireless WiFi s…4.3
• CVE-2023-40537 An authenticated user's session cookie may remain valid for…8.1
• CVE-2023-40539Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2023-40540Non-Transparent Sharing of Microarchitectural Resources in s…4.4
• CVE-2023-40541This issue was addressed by adding an additional prompt for …5.5
• CVE-2023-40542When TCP Verified Accept is enabled on a TCP profile that is…7.5
• CVE-2023-40544 An attacker with access to the network where the …5.7
• CVE-2023-40545Authentication bypass when an OAuth2 Client is using client_…9.8
• CVE-2023-40546A flaw was found in Shim when an error happened while creati…5.5