CVE-2024-11700

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Malicious websites may have been able to perform user intent confirmation through tapjacking. This could have led to users unknowingly approving the launch of external applications, potentially exposing them to underlying vulnerabilities. This vulnerability affects Firefox < 133 and Thunderbird < 133.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-1021

Affected software

No affected versions have been published.

Timeline

Published
Nov 26, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-117014.3The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could have led to user confusCVE-2024-117027.5Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-baseCVE-2024-117035.7On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN authentication. This vulnerabilitCVE-2024-117049.8A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specific conditions, the sCVE-2024-117059.1`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV)CVE-2024-117066.5A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the `SEC_ASN1DecodeItem_Util` function, when hCVE-2024-117076.1The My auctions allegro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to,CVE-2024-117086.5Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. This vulnerability affecCVE-2024-117094.3The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checkCVE-2024-11715.4The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to StCVE-2024-117104.9The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via tCVE-2024-117117.5The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via t