alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2020-6496 (published 2020-06-03)
Use after free in payments in Google Chrome on MacOS prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: apple, debian, google, opensuse
Affected products: backports_sle, chrome, debian_linux, leap, macos
CVE-2020-6497 (published 2020-06-03)
Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain spoofing via a crafted URI.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-276
Affected vendors: apple, debian, google
Affected products: chrome, debian_linux, iphone_os
CVE-2020-6498 (published 2020-06-03)
Incorrect implementation in user interface in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-276
Affected vendors: apple, debian, google
Affected products: chrome, debian_linux, iphone_os
CVE-2020-6499 (published 2020-06-03)
Inappropriate implementation in AppCache in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass AppCache security restrictions via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: google
Affected products: chrome
CVE-2020-6500 (published 2020-06-03)
Inappropriate implementation in interstitials in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: google
Affected products: chrome
CVE-2020-6501 (published 2020-06-03)
Insufficient policy enforcement in CSP in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-276
Affected vendors: google
Affected products: chrome
CVE-2020-6502 (published 2020-06-03)
Incorrect implementation in permissions in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-276
Affected vendors: google
Affected products: chrome
CVE-2020-6503 (published 2020-06-03)
Inappropriate implementation in accessibility in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-209
Affected vendors: google
Affected products: chrome
CVE-2020-6504 (published 2020-06-03)
Insufficient policy enforcement in notifications in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass notification restrictions via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-276
Affected vendors: google
Affected products: chrome
CVE-2020-6505 (published 2020-07-22)
Use after free in speech in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: google
Affected products: chrome
CVE-2020-6506 (published 2020-07-22)
Insufficient policy enforcement in WebView in Google Chrome on Android prior to 83.0.4103.106 allowed a remote attacker to bypass site isolation via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: google
Affected products: android, chrome
CVE-2020-6507 (published 2020-07-22)
Out of bounds write in V8 in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: google
Affected products: chrome
CVE-2020-6509 (published 2020-07-22)
Use after free in extensions in Google Chrome prior to 83.0.4103.116 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: google
Affected products: chrome
CVE-2020-6510 (published 2020-07-22)
Heap buffer overflow in background fetch in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6511 (published 2020-07-22)
Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-209
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6512 (published 2020-07-22)
Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6513 (published 2020-07-22)
Heap buffer overflow in PDFium in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6514 (published 2020-07-22)
Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap corruption via a crafted SCTP stream.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-200
Affected vendors: apple, canonical, debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, ipados, iphone_os, leap, safari, tvos, ubuntu_linux, watchos
CVE-2020-6515 (published 2020-07-22)
Use after free in tab strip in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6516 (published 2020-07-22)
Policy bypass in CORS in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6517 (published 2020-07-22)
Heap buffer overflow in history in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6518 (published 2020-07-22)
Use after free in developer tools in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had convinced the user to use developer tools to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6519 (published 2020-07-22)
Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6520 (published 2020-07-22)
Buffer overflow in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6521 (published 2020-07-22)
Side-channel information leakage in autofill in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6522 (published 2020-07-22)
Inappropriate implementation in external protocol handlers in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6523 (published 2020-07-22)
Out of bounds write in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6524 (published 2020-07-22)
Heap buffer overflow in WebAudio in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6525 (published 2020-07-22)
Heap buffer overflow in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6526 (published 2020-07-22)
Inappropriate implementation in iframe sandbox in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6527 (published 2020-07-22)
Insufficient policy enforcement in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-276
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6528 (published 2020-07-22)
Incorrect security UI in basic auth in Google Chrome on iOS prior to 84.0.4147.89 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected vendors: apple, debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, iphone_os, leap
CVE-2020-6529 (published 2020-07-22)
Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to leak cross-origin data via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Weakness: CWE-295
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6530 (published 2020-07-22)
Out of bounds memory access in developer tools in Google Chrome prior to 84.0.4147.89 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6531 (published 2020-07-22)
Side-channel information leakage in scroll to text in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Weakness: CWE-203
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6532 (published 2020-09-21)
Use after free in SCTP in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6533 (published 2020-07-22)
Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6534 (published 2020-07-22)
Heap buffer overflow in WebRTC in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6535 (published 2020-07-22)
Insufficient data validation in WebUI in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had compromised the renderer process to inject scripts or HTML into a privileged page via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6536 (published 2020-07-22)
Incorrect security UI in PWAs in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had persuaded the user to install a PWA to spoof the contents of the Omnibox (URL bar) via a crafted PWA.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6537 (published 2020-09-21)
Type confusion in V8 in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-843
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6538 (published 2020-09-21)
Inappropriate implementation in WebView in Google Chrome on Android prior to 84.0.4147.105 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6539 (published 2020-09-21)
Use after free in CSS in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6540 (published 2020-09-21)
Buffer overflow in Skia in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6541 (published 2020-09-21)
Use after free in WebUSB in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6542 (published 2020-09-21)
Use after free in ANGLE in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6543 (published 2020-09-21)
Use after free in task scheduling in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6544 (published 2020-09-21)
Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6545 (published 2020-09-21)
Use after free in audio in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6546 (published 2020-09-21)
Inappropriate implementation in installer in Google Chrome prior to 84.0.4147.125 allowed a local attacker to potentially elevate privilege via a crafted filesystem.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-59
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6547 (published 2020-09-21)
Incorrect security UI in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-1021
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6548 (published 2020-09-21)
Heap buffer overflow in Skia in Google Chrome prior to 84.0.4147.125 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6549 (published 2020-09-21)
Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6550 (published 2020-09-21)
Use after free in IndexedDB in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6551 (published 2020-09-21)
Use after free in WebXR in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6552 (published 2020-09-21)
Use after free in Blink in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6553 (published 2020-09-21)
Use after free in offline mode in Google Chrome on iOS prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: apple, debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora, iphone_os
CVE-2020-6554 (published 2020-09-21)
Use after free in extensions in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted Chrome Extension.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6555 (published 2020-09-21)
Out of bounds read in WebGL in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L)
Weakness: CWE-125
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2020-6556 (published 2020-09-21)
Heap buffer overflow in SwiftShader in Google Chrome prior to 84.0.4147.135 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: chrome, debian_linux, fedora, leap
CVE-2020-6557 (published 2020-11-03)
Inappropriate implementation in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora
CVE-2020-6558 (published 2020-09-21)
Insufficient policy enforcement in iOSWeb in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-79
Affected vendors: apple, debian, google, opensuse
Affected products: backports_sle, chrome, debian_linux, iphone_os, leap
CVE-2020-6559 (published 2020-09-21)
Use after free in presentation API in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6560 (published 2020-09-21)
Insufficient policy enforcement in autofill in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6561 (published 2020-09-21)
Inappropriate implementation in Content Security Policy in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6562 (published 2020-09-21)
Insufficient policy enforcement in Blink in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-79
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6563 (published 2020-09-21)
Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: android, backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6564 (published 2020-09-21)
Inappropriate implementation in permissions in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of a permission dialog via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-281
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6565 (published 2020-09-21)
Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: apple, debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, iphone_os, leap
CVE-2020-6566 (published 2020-09-21)
Insufficient policy enforcement in media in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6567 (published 2020-09-21)
Insufficient validation of untrusted input in command line handling in Google Chrome on Windows prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-20
Affected vendors: debian, fedoraproject, google, microsoft, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap, windows
CVE-2020-6568 (published 2020-09-21)
Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: android, backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6569 (published 2020-09-21)
Integer overflow in WebUSB in Google Chrome prior to 85.0.4183.83 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Weakness: CWE-190
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6570 (published 2020-09-21)
Information leakage in WebRTC in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive information via a crafted WebRTC interaction.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6571 (published 2020-09-21)
Insufficient data validation in Omnibox in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-20
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6572 (published 2021-01-14)
Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: google
Affected products: chrome
Added to CISA KEV catalog: 2022-01-10
KEV required action: Apply updates per vendor instructions.
CVE-2020-6573 (published 2020-09-21)
Use after free in video in Google Chrome on Android prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6574 (published 2020-09-21)
Insufficient policy enforcement in installer in Google Chrome on OS X prior to 85.0.4183.102 allowed a local attacker to potentially achieve privilege escalation via a crafted binary.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: apple, debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap, mac_os_x
CVE-2020-6575 (published 2020-09-21)
Race in Mojo in Google Chrome prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6576 (published 2020-09-21)
Use after free in offscreen canvas in Google Chrome prior to 85.0.4183.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google, opensuse
Affected products: backports_sle, chrome, debian_linux, fedora, leap
CVE-2020-6577 (published 2021-03-19)
The IT-Recht Kanzlei plugin in Zen Cart 1.5.6c (German edition) allows itrk-api.php rechtstext_language SQL Injection.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: it-recht-kanzlei
Affected products: it-recht-kanzlei
CVE-2020-6578 (published 2021-03-19)
Zen Cart 1.5.6d allows reflected XSS via the main_page parameter to includes/templates/template_default/common/tpl_main_page.php or includes/templates/responsive_classic/common/tpl_main_page.php.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: zen-cart
Affected products: zen_cart
CVE-2020-6579 (published 2020-04-30)
Cross-site scripting (XSS) vulnerability in mailhive/cloudbeez/cloudloader.php and mailhive/cloudbeez/cloudloader_core.php in the MailBeez plugin for ZenCart before 3.9.22 allows remote attackers to inject arbitrary web script or HTML via the cloudloader_mode parameter.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: mailbeez
Affected products: mailbeez
CVE-2020-6581 (published 2020-03-16)
Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not as the \n newline sequence). This can cause command injection.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: fedoraproject, nagios
Affected products: fedora, remote_plug_in_executor
CVE-2020-6582 (published 2020-03-16)
Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-681
Affected vendors: fedoraproject, nagios
Affected products: fedora, remote_plug_in_executor
CVE-2020-6583 (published 2020-01-08)
BigProf Online Invoicing System (OIS) through 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability, retrieve the session cookie from the administrator login, and take over the administrator account via the Name field in an Add New Client action.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bigprof
Affected products: online_invoicing_system
CVE-2020-6584 (published 2020-03-16)
Nagios Log Server 2.1.3 has Incorrect Access Control.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-269
Affected vendors: nagios
Affected products: nagios
CVE-2020-6585 (published 2020-03-16)
Nagios Log Server 2.1.3 has CSRF.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: nagios
Affected products: nagios
CVE-2020-6586 (published 2020-03-16)
Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: nagios
Affected products: nagios
CVE-2020-6590 (published 2021-04-08)
Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-611
Affected vendors: forcepoint
Affected products: data_loss_prevention, email_security, web_security_content_gateway
CVE-2020-6609 (published 2020-01-08)
GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in read_pages_map in decode_r2007.c.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: gnu, opensuse
Affected products: backports_sle, leap, libredwg
CVE-2020-6610 (published 2020-01-08)
GNU LibreDWG 0.9.3.2564 has an attempted excessive memory allocation in read_sections_map in decode_r2007.c.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-770
Affected vendors: gnu, opensuse
Affected products: backports, leap, libredwg
CVE-2020-6611 (published 2020-01-08)
GNU LibreDWG 0.9.3.2564 has a NULL pointer dereference in get_next_owned_entity in dwg.c.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: gnu, opensuse
Affected products: backports_sle, leap, libredwg
CVE-2020-6612 (published 2020-01-08)
GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in copy_compressed_bytes in decode_r2007.c.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: gnu, opensuse
Affected products: backports_sle, leap, libredwg
CVE-2020-6613 (published 2020-01-08)
GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in bit_search_sentinel in bits.c.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: gnu, opensuse
Affected products: backports_sle, leap, libredwg
CVE-2020-6614 (published 2020-01-08)
GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in bfr_read in decode.c.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: gnu, opensuse
Affected products: backports_sle, leap, libredwg
CVE-2020-6615 (published 2020-01-08)
GNU LibreDWG 0.9.3.2564 has an invalid pointer dereference in dwg_dynapi_entity_value in dynapi.c (dynapi.c is generated by gen-dynapi.pl).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: gnu, opensuse
Affected products: backports_sle, leap, libredwg
CVE-2020-6616 (published 2020-05-08)
Some Broadcom chips mishandle Bluetooth random-number generation because a low-entropy Pseudo Random Number Generator (PRNG) is used in situations where a Hardware Random Number Generator (HRNG) should have been used to prevent spoofing. This affects, for example, Samsung Galaxy S8, S8+, and Note8 devices with the BCM4361 chipset. The Samsung ID is SVE-2020-16882 (May 2020).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: apple, google, samsung
Affected products: android, galaxy_note8, galaxy_s8, galaxy_s8_plus, ipados, iphone_os, mac_os_x
CVE-2020-6617 (published 2020-01-08)
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-617
Affected vendors: nothings
Affected products: stb_truetype.h
CVE-2020-6618 (published 2020-01-08)
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: nothings
Affected products: stb_truetype.h
CVE-2020-6619 (published 2020-01-08)
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__buf_seek.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-617
Affected vendors: nothings
Affected products: stb_truetype.h
CVE-2020-6620 (published 2020-01-08)
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_get8.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: nothings
Affected products: stb_truetype.h
CVE-2020-6621 (published 2020-01-08)
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: nothings
Affected products: stb_truetype.h
CVE-2020-6622 (published 2020-01-08)
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: nothings
Affected products: stb_truetype.h
CVE-2020-6623 (published 2020-01-08)
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-617
Affected vendors: nothings
Affected products: stb_truetype.h
CVE-2020-6624 (published 2020-01-09)
jhead through 3.04 has a heap-based buffer over-read in process_DQT in jpgqguess.c.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: jhead_project
Affected products: jhead
CVE-2020-6625 (published 2020-01-09)
jhead through 3.04 has a heap-based buffer over-read in Get32s when called from ProcessGpsInfo in gpsinfo.c.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: jhead_project
Affected products: jhead
CVE-2020-6627 (published 2022-12-06)
The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in cirrus/application/helpers/mv_backend_helper.php by leveraging the "start" state and sending a check_device_name request.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: seagate
Affected products: stcg2000300, stcg2000300_firmware, stcg3000300, stcg3000300_firmware, stcg4000300, stcg4000300_firmware
CVE-2020-6628 (published 2020-01-09)
Ming (aka libming) 0.4.8 has a heap-based buffer over-read in the function decompile_SWITCH() in decompile.c.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: libming
Affected products: libming
CVE-2020-6629 (published 2020-01-09)
Ming (aka libming) 0.4.8 has z NULL pointer dereference in the function decompileGETURL2() in decompile.c.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: libming
Affected products: libming
CVE-2020-6630 (published 2020-01-09)
An issue was discovered in GPAC version 0.8.0. There is a NULL pointer dereference in the function gf_isom_get_media_data_size() in isomedia/isom_read.c.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: gpac
Affected products: gpac
CVE-2020-6631 (published 2020-01-09)
An issue was discovered in GPAC version 0.8.0. There is a NULL pointer dereference in the function gf_m2ts_stream_process_pmt() in media_tools/m2ts_mux.c.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: gpac
Affected products: gpac
CVE-2020-6632 (published 2020-01-09)
In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a QuickAccess link. This is related to AdminQuickAccessesController.php, themes/default/template/header.tpl, and themes/new-theme/js/header.js.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: prestashop
Affected products: prestashop
CVE-2020-6637 (published 2020-08-24)
openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: os4ed
Affected products: opensis
CVE-2020-6638 (published 2020-01-21)
Grin through 2.1.1 has Insufficient Validation.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: grin
Affected products: grin
CVE-2020-6640 (published 2020-06-04)
An improper neutralization of input vulnerability in the Admin Profile of FortiAnalyzer may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Description Area.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: fortinet
Affected products: fortianalyzer
CVE-2020-6641 (published 2021-06-02)
Two authorization bypass through user-controlled key vulnerabilities in the Fortinet FortiPresence 2.1.0 administration interface may allow an attacker to gain access to some user data via portal manager or portal users parameters.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-639
Affected vendors: fortinet
Affected products: fortipresence
CVE-2020-6643 (published 2020-03-12)
An improper neutralization of input vulnerability in the URL Description in Fortinet FortiIsolator version 1.2.2 allows a remote authenticated attacker to perform a cross site scripting attack (XSS).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: fortinet
Affected products: fortiisolator
CVE-2020-6644 (published 2020-06-22)
An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-613
Affected vendors: fortinet
Affected products: fortideceptor
CVE-2020-6646 (published 2020-03-17)
An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Disclaimer Description of a Replacement Message.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: fortinet
Affected products: fortiweb
CVE-2020-6647 (published 2020-04-07)
An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site scripting attack (XSS) via the name parameter.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: fortinet
Affected products: fortiadc_firmware
CVE-2020-6648 (published 2020-10-21)
A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an authenticated attacker to obtain sensitive information such as users passwords by connecting to FortiGate CLI and executing the "diag sys ha checksum show" command.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-312
Affected vendors: fortinet
Affected products: fortios, fortiproxy
CVE-2020-6649 (published 2021-02-08)
An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks)
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-613
Affected vendors: fortinet
Affected products: fortiisolator
CVE-2020-6650 (published 2020-03-23)
UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call e.g.”eval” in “Update Manager” class when software attempts to see if there are updates available. This results in arbitrary code execution on the machine where software is installed.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-95
Affected vendors: eaton
Affected products: ups_companion