CVE-2024-0753

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 122
Mozilla	Firefox ESR	>= unspecified, < 115.7
Mozilla	Thunderbird	>= unspecified, < 115.7

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1870262Issue Tracking, Release Notes
https://lists.debian.org/debian-lts-announce/2024/01/msg00015.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/01/msg00022.htmlMailing List, Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2024-01/Release Notes, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-02/Release Notes, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-04/Release Notes, Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1870262Issue Tracking, Release Notes
https://lists.debian.org/debian-lts-announce/2024/01/msg00015.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/01/msg00022.htmlMailing List, Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2024-01/Release Notes, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-02/Release Notes, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-04/Release Notes, Vendor Advisory
https://www.youtube.com/watch?v=JjMb7Z8ak2k

Timeline

Published: Jan 23, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-07546.5Some WASM source files could have caused a crash when loaded in devtools. This vulnerability affects Firefox < 122.CVE-2024-07558.8Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence of memory corruption CVE-2024-07565.4The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 lacks validation of URLs when adding iframes, allowing att CVE-2024-07575.4The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 is not properly filtering which file extensions are allowe CVE-2024-07586.1MolecularFaces before 0.3.0 is vulnerable to cross site scripting. A remote attacker can execute arbitrary JavaScript in the context of a vi CVE-2024-07597.5Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or a CVE-2024-07607.5A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. T CVE-2024-07617.5The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to ins CVE-2024-07627.8Potential buffer overflow in unsafe UEFI variable handling in Phoenix SecureCore™ for select Intel platforms This issue affects: Phoe CVE-2024-07638.1Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal. The attack CVE-2024-07656.5As a default user on a multi-user instance of AnythingLLM, you could execute a call to the `/export-data` endpoint of the system and then un CVE-2024-07664.3The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a mi