CVE-2024-11701

The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 133 and Thunderbird < 133.

• CWE-290

• https://bugzilla.mozilla.org/show_bug.cgi?id=1914797Issue Tracking
• https://www.mozilla.org/security/advisories/mfsa2024-63/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2024-67/Vendor Advisory

Published

Nov 26, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-11696The application failed to account for exceptions thrown by t…5.4
• CVE-2024-11697When handling keypress events, an attacker may have been abl…8.8
• CVE-2024-11698A flaw in handling fullscreen transitions may have inadverte…9.8
• CVE-2024-11699Memory safety bugs present in Firefox 132, Firefox ESR 128.4…8.8
• CVE-2024-1170The Post Form – Registration Form – Profile Form for User Pr…8.2
• CVE-2024-11700Malicious websites may have been able to perform user intent…8.1
• CVE-2024-11702Copying sensitive information from Private Browsing tabs on …7.5
• CVE-2024-11703On Android, Firefox may have inadvertently allowed viewing s…5.7
• CVE-2024-11704A double-free issue could have occurred in `sec_pkcs7_decode…9.8
• CVE-2024-11705`NSC_DeriveKey` inadvertently assumed that the `phKey` param…9.1
• CVE-2024-11706A null pointer dereference may have inadvertently occurred i…6.5
• CVE-2024-11707The My auctions allegro plugin for WordPress is vulnerable t…6.1