alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2020-6385 (published 2020-02-11)
Insufficient policy enforcement in storage in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass site isolation via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-754
Affected vendors: debian, fedoraproject, google, opensuse, redhat, suse
Affected products: backports_sle, chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora, linux_enterprise, package_hub
CVE-2020-6386 (published 2020-02-27)
Use after free in speech in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google, redhat
Affected products: chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora
CVE-2020-6387 (published 2020-02-11)
Out of bounds write in WebRTC in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted video stream.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google
Affected products: chrome
CVE-2020-6388 (published 2020-02-11)
Out of bounds access in WebAudio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: google
Affected products: chrome
CVE-2020-6389 (published 2020-02-11)
Out of bounds write in WebRTC in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted video stream.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google
Affected products: chrome
CVE-2020-6390 (published 2020-02-11)
Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse, redhat, suse
Affected products: backports_sle, chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora, linux_enterprise, package_hub
CVE-2020-6391 (published 2020-02-11)
Insufficient validation of untrusted input in Blink in Google Chrome prior to 80.0.3987.87 allowed a local attacker to bypass content security policy via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-79
Affected vendors: debian, fedoraproject, google, opensuse, redhat, suse
Affected products: backports_sle, chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora, linux_enterprise, package_hub
CVE-2020-6392 (published 2020-02-11)
Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-79
Affected vendors: debian, fedoraproject, google, opensuse, redhat, suse
Affected products: backports_sle, chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora, linux_enterprise, package_hub
CVE-2020-6393 (published 2020-02-11)
Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: debian, fedoraproject, google, opensuse, redhat, suse
Affected products: backports_sle, chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora, linux_enterprise, package_hub
CVE-2020-6394 (published 2020-02-11)
Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Affected vendors: debian, fedoraproject, google, opensuse, redhat, suse
Affected products: backports_sle, chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora, linux_enterprise, package_hub
CVE-2020-6395 (published 2020-02-11)
Out of bounds read in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: google
Affected products: chrome
CVE-2020-6396 (published 2020-02-11)
Inappropriate implementation in Skia in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected vendors: debian, fedoraproject, google, opensuse, redhat, suse
Affected products: backports_sle, chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora, linux_enterprise, package_hub
CVE-2020-6397 (published 2020-02-11)
Inappropriate implementation in sharing in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: debian, fedoraproject, google, opensuse, redhat, suse
Affected products: backports_sle, chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora, linux_enterprise, package_hub
CVE-2020-6398 (published 2020-02-11)
Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-908
Affected vendors: debian, fedoraproject, google, opensuse, redhat, suse
Affected products: backports_sle, chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora, linux_enterprise, package_hub
CVE-2020-6399 (published 2020-02-11)
Insufficient policy enforcement in AppCache in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-20
Affected vendors: google, opensuse
Affected products: backports_sle, chrome
CVE-2020-6400 (published 2020-02-11)
Inappropriate implementation in CORS in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-203
Affected vendors: debian, fedoraproject, google, opensuse, redhat, suse
Affected products: backports_sle, chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora, linux_enterprise, package_hub
CVE-2020-6401 (published 2020-02-11)
Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-20
Affected vendors: google, opensuse
Affected products: backports_sle, chrome
CVE-2020-6402 (published 2020-02-11)
Insufficient policy enforcement in downloads in Google Chrome on OS X prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: apple, debian, fedoraproject, google, opensuse, redhat, suse
Affected products: backports_sle, chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora, linux_enterprise, macos, package_hub
CVE-2020-6403 (published 2020-02-11)
Incorrect implementation in Omnibox in Google Chrome on iOS prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected vendors: apple, debian, fedoraproject, google, opensuse, redhat, suse
Affected products: backports_sle, chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora, iphone_os, linux_enterprise, package_hub
CVE-2020-6404 (published 2020-02-11)
Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse, redhat, suse
Affected products: backports_sle, chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora, linux_enterprise, package_hub
CVE-2020-6405 (published 2020-02-11)
Out of bounds read in SQLite in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: google
Affected products: chrome
CVE-2020-6406 (published 2020-02-11)
Use after free in audio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google, redhat, suse
Affected products: chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora, linux_enterprise, package_hub
CVE-2020-6407 (published 2020-02-27)
Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google
Affected products: chrome
CVE-2020-6408 (published 2020-02-11)
Insufficient policy enforcement in CORS in Google Chrome prior to 80.0.3987.87 allowed a local attacker to obtain potentially sensitive information via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Affected vendors: debian, fedoraproject, google, opensuse, redhat, suse
Affected products: backports_sle, chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora, linux_enterprise, package_hub
CVE-2020-6409 (published 2020-02-11)
Inappropriate implementation in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker who convinced the user to enter a URI to bypass navigation restrictions via a crafted domain name.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: google
Affected products: chrome
CVE-2020-6410 (published 2020-02-11)
Insufficient policy enforcement in navigation in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to confuse the user via a crafted domain name.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: google
Affected products: chrome
CVE-2020-6411 (published 2020-02-11)
Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Weakness: CWE-20
Affected vendors: google
Affected products: chrome
CVE-2020-6412 (published 2020-02-11)
Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Weakness: CWE-20
Affected vendors: google, opensuse
Affected products: backports_sle, chrome
CVE-2020-6413 (published 2020-02-11)
Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass HTML validators via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: google, opensuse
Affected products: backports_sle, chrome
CVE-2020-6414 (published 2020-02-11)
Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: google, opensuse
Affected products: backports_sle, chrome
CVE-2020-6415 (published 2020-02-11)
Inappropriate implementation in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse, redhat, suse
Affected products: backports_sle, chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora, linux_enterprise, package_hub
CVE-2020-6416 (published 2020-02-11)
Insufficient data validation in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: debian, fedoraproject, google, opensuse, redhat, suse
Affected products: backports_sle, chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora, linux_enterprise, package_hub
CVE-2020-6417 (published 2020-02-11)
Inappropriate implementation in installer in Google Chrome prior to 80.0.3987.87 allowed a local attacker to execute arbitrary code via a crafted registry entry.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: google
Affected products: chrome
CVE-2020-6418 (published 2020-02-27)
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-843
Affected vendors: debian, fedoraproject, google, redhat
Affected products: chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, fedora
Added to CISA KEV catalog: 2021-11-03
KEV required action: Apply updates per vendor instructions.
CVE-2020-6419 (published 2020-06-03)
Out of bounds write in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google
Affected products: chrome
CVE-2020-6420 (published 2020-03-23)
Insufficient policy enforcement in media in Google Chrome prior to 80.0.3987.132 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6422 (published 2020-03-23)
Use after free in WebGL in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse, suse
Affected products: backports_sle, chrome, debian_linux, fedora, suse_linux_enterprise_desktop, suse_linux_enterprise_server
CVE-2020-6423 (published 2020-04-13)
Use after free in audio in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6424 (published 2020-03-23)
Use after free in media in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google, opensuse, suse
Affected products: backports_sle, chrome, debian_linux, fedora, suse_linux_enterprise_desktop, suse_linux_enterprise_server
CVE-2020-6425 (published 2020-03-23)
Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome Extension.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Weakness: CWE-20
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports, chrome, debian_linux, fedora
CVE-2020-6426 (published 2020-03-23)
Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse, suse
Affected products: backports_sle, chrome, debian_linux, fedora, suse_linux_enterprise_desktop, suse_linux_enterprise_server
CVE-2020-6427 (published 2020-03-23)
Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse, suse
Affected products: backports_sle, chrome, debian_linux, fedora, suse_linux_enterprise_desktop, suse_linux_enterprise_server
CVE-2020-6428 (published 2020-03-23)
Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse, suse
Affected products: backports_sle, chrome, debian_linux, fedora, suse_linux_enterprise_desktop, suse_linux_enterprise_server
CVE-2020-6429 (published 2020-03-23)
Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse, suse
Affected products: backports_sle, chrome, debian_linux, fedora, suse_linux_enterprise_desktop, suse_linux_enterprise_server
CVE-2020-6430 (published 2020-04-13)
Type Confusion in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-843
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6431 (published 2020-04-13)
Insufficient policy enforcement in full screen in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-276
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports, chrome, debian_linux, fedora, leap
CVE-2020-6432 (published 2020-04-13)
Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports, chrome, debian_linux, fedora, leap
CVE-2020-6433 (published 2020-04-13)
Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports, chrome, debian_linux, fedora, leap
CVE-2020-6434 (published 2020-04-13)
Use after free in devtools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6435 (published 2020-04-13)
Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports, chrome, debian_linux, fedora, leap
CVE-2020-6436 (published 2020-04-13)
Use after free in window management in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6437 (published 2020-04-13)
Inappropriate implementation in WebView in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a crafted application.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports, chrome, debian_linux, fedora, leap
CVE-2020-6438 (published 2020-04-13)
Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Weakness: CWE-209
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6439 (published 2020-04-13)
Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass security UI via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports, chrome, debian_linux, fedora, leap
CVE-2020-6440 (published 2020-04-13)
Inappropriate implementation in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information via a crafted Chrome Extension.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports, chrome, debian_linux, fedora, leap
CVE-2020-6441 (published 2020-04-13)
Insufficient policy enforcement in omnibox in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass security UI via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-276
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports, chrome, debian_linux, fedora, leap
CVE-2020-6442 (published 2020-04-13)
Inappropriate implementation in cache in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Weakness: CWE-668
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports, chrome, debian_linux, fedora, leap
CVE-2020-6443 (published 2020-04-13)
Insufficient data validation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user to use devtools to execute arbitrary code via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-345
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports, chrome, debian_linux, fedora, leap
CVE-2020-6444 (published 2020-04-13)
Uninitialized use in WebRTC in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Weakness: CWE-908
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6445 (published 2020-04-13)
Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-276
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports, chrome, debian_linux, fedora, leap
CVE-2020-6446 (published 2020-04-13)
Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-276
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports, chrome, debian_linux, fedora, leap
CVE-2020-6447 (published 2020-04-13)
Inappropriate implementation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user to use devtools to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6448 (published 2020-04-13)
Use after free in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6449 (published 2020-03-23)
Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google, opensuse, suse
Affected products: backports_sle, chrome, debian_linux, fedora, suse_linux_enterprise_desktop, suse_linux_enterprise_server
CVE-2020-6450 (published 2020-04-13)
Use after free in WebAudio in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: fedoraproject, google, opensuse
Affected products: backports_sle, chrome, fedora, leap
CVE-2020-6451 (published 2020-04-13)
Use after free in WebAudio in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: fedoraproject, google, opensuse
Affected products: backports_sle, chrome, fedora, leap
CVE-2020-6452 (published 2020-04-13)
Heap buffer overflow in media in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: fedoraproject, google, opensuse
Affected products: backports, chrome, fedora, leap
CVE-2020-6453 (published 2020-06-03)
Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google
Affected products: chrome
CVE-2020-6454 (published 2020-04-13)
Use after free in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6455 (published 2020-04-13)
Out of bounds read in WebSQL in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports, chrome, debian_linux, fedora, leap
CVE-2020-6456 (published 2020-04-13)
Insufficient validation of untrusted input in clipboard in Google Chrome prior to 81.0.4044.92 allowed a local attacker to bypass site isolation via crafted clipboard contents.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-276
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports, chrome, debian_linux, fedora, leap
CVE-2020-6457 (published 2020-05-21)
Use after free in speech recognizer in Google Chrome prior to 81.0.4044.113 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2020-6458 (published 2020-05-21)
Out of bounds read and write in PDFium in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2020-6459 (published 2020-05-21)
Use after free in payments in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2020-6460 (published 2020-05-21)
Insufficient data validation in URL formatting in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to perform domain spoofing via a crafted domain name.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2020-6461 (published 2020-05-21)
Use after free in storage in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2020-6462 (published 2020-05-21)
Use after free in task scheduling in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2020-6463 (published 2020-05-21)
Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: canonical, debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap, ubuntu_linux
CVE-2020-6464 (published 2020-05-21)
Type confusion in Blink in Google Chrome prior to 81.0.4044.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, google, opensuse
Affected products: chrome, debian_linux, leap
CVE-2020-6465 (published 2020-05-21)
Use after free in reader mode in Google Chrome on Android prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6466 (published 2020-05-21)
Use after free in media in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6467 (published 2020-05-21)
Use after free in WebRTC in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6468 (published 2020-05-21)
Type confusion in V8 in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6469 (published 2020-05-21)
Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6470 (published 2020-05-21)
Insufficient validation of untrusted input in clipboard in Google Chrome prior to 83.0.4103.61 allowed a local attacker to inject arbitrary scripts or HTML (UXSS) via crafted clipboard contents.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6471 (published 2020-05-21)
Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6472 (published 2020-05-21)
Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory or disk via a crafted Chrome Extension.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6473 (published 2020-05-21)
Insufficient policy enforcement in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-203
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6474 (published 2020-05-21)
Use after free in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6475 (published 2020-05-21)
Incorrect implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6476 (published 2020-05-21)
Insufficient policy enforcement in tab strip in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-276
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6477 (published 2020-05-21)
Inappropriate implementation in installer in Google Chrome on OS X prior to 83.0.4103.61 allowed a local attacker to perform privilege escalation via a crafted file.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-59
Affected vendors: apple, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, fedora, leap, mac_os_x
CVE-2020-6478 (published 2020-05-21)
Inappropriate implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6479 (published 2020-05-21)
Inappropriate implementation in sharing in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6480 (published 2020-05-21)
Insufficient policy enforcement in enterprise in Google Chrome prior to 83.0.4103.61 allowed a local attacker to bypass navigation restrictions via UI actions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-276
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6481 (published 2020-05-21)
Insufficient policy enforcement in URL formatting in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to perform domain spoofing via a crafted domain name.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6482 (published 2020-05-21)
Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-276
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6483 (published 2020-05-21)
Insufficient policy enforcement in payments in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-276
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6484 (published 2020-05-21)
Insufficient data validation in ChromeDriver in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted request.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-276
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6485 (published 2020-05-21)
Insufficient data validation in media router in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-20
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, chrome_os, debian_linux, fedora, leap
CVE-2020-6486 (published 2020-05-21)
Insufficient policy enforcement in navigations in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6487 (published 2020-05-21)
Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-276
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6488 (published 2020-05-21)
Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-276
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6489 (published 2020-05-21)
Inappropriate implementation in developer tools in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had convinced the user to take certain actions in developer tools to obtain potentially sensitive information from disk via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6490 (published 2020-05-21)
Insufficient data validation in loader in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had been able to write to disk to leak cross-origin data via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Weakness: CWE-668
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6491 (published 2020-05-21)
Insufficient data validation in site information in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted domain name.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6492 (published 2021-11-02)
Use after free in ANGLE in Google Chrome prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: google
Affected products: chrome
CVE-2020-6493 (published 2020-06-03)
Use after free in WebAuthentication in Google Chrome prior to 83.0.4103.97 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, google, opensuse
Affected products: backports, chrome, debian_linux, leap
CVE-2020-6494 (published 2020-06-03)
Incorrect security UI in payments in Google Chrome on Android prior to 83.0.4103.97 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: debian, google, opensuse
Affected products: android, backports_sle, chrome, debian_linux, leap
CVE-2020-6495 (published 2020-06-03)
Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.97 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-276
Affected vendors: debian, google, opensuse
Affected products: backports, chrome, debian_linux, leap