CVE-2019-11720

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This allows malicious code to then be processed, evading cross-site scripting (XSS) filtering. This vulnerability affects Firefox < 68.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 23, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-117216.5The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar. This allows for domain spoofing attacks aCVE-2019-117237.5A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. ThiCVE-2019-117246.1Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been retired and now rediCVE-2019-117256.5When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation is interrupted but resCVE-2019-117275.3A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures whenCVE-2019-117284.7The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that the accessible to a usCVE-2019-117297.5Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memCVE-2019-11737.0An elevation of privilege vulnerability exists in the way that the PsmServiceExtHost.dll handles objects in memory. An attacker who successfCVE-2019-117306.5A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same direcCVE-2019-117339.8When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It wCVE-2019-117349.8Mozilla developers and community members reported memory safety bugs present in Firefox 68. Some of these bugs showed evidence of memory corCVE-2019-117358.8Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68. Some of these bugs showed evi