CVE-2024-5687

If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new tab may have been incorrect. The triggering principal is used to calculate many values, including the `Referer` and `Sec-*` headers, meaning there is the potential for incorrect security checks within the browser in addition to incorrect or misleading information sent to remote websites. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 127.

• CWE-284

• https://bugzilla.mozilla.org/show_bug.cgi?id=1889066Exploit, Issue Tracking
• https://www.mozilla.org/security/advisories/mfsa2024-25/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1889066Exploit, Issue Tracking
• https://www.mozilla.org/security/advisories/mfsa2024-25/Vendor Advisory

Published

Jun 11, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-56839A vulnerability has been identified in RUGGEDCOM ROX MX5000 …8.6
• CVE-2024-5684An attacker with access to the private network (the charger …8.8
• CVE-2024-56840A vulnerability has been identified in RUGGEDCOM ROX MX5000 …7.5
• CVE-2024-56841A vulnerability has been identified in Mendix LDAP (All vers…9.1
• CVE-2024-5685Users with "User:edit" and "Self:api" permissions can promot…8.1
• CVE-2024-5686The WPZOOM Addons for Elementor (Templates, Widgets) plugin …5.4
• CVE-2024-5688If a garbage collection was triggered at the right time, a u…8.1
• CVE-2024-56882Sage DPW before 2024_12_000 is vulnerable to Cross Site Scri…5.4
• CVE-2024-56883Sage DPW before 2024_12_001 is vulnerable to Incorrect Acces…8.1
• CVE-2024-56889Incorrect access control in the endpoint /admin/m_delete.php…7.5
• CVE-2024-5689In addition to detecting when a user was taking a screenshot…4.3
• CVE-2024-56897Improper access control in the HTTP server in YI Car Dashcam…9.8