deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-26912
Published: 2021-02-08
Description: NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in SupportRpcServlet.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://ssd-disclosure.com/?p=4676; https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/; https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020
CVE: CVE-2021-26913
Published: 2021-02-08
Description: NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in RpcServlet.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://ssd-disclosure.com/?p=4676; https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/; https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020
CVE: CVE-2021-26914
Published: 2021-02-08
Description: NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in MvcUtil valueStringToObject.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: http://packetstormsecurity.com/files/162617/NetMotion-Mobility-Server-MvcUtil-Java-Deserialization.html; https://ssd-disclosure.com/?p=4676; https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/
CVE: CVE-2021-26915
Published: 2021-02-08
Description: NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in webrepdb StatusServlet.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://ssd-disclosure.com/?p=4676; https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/; https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020
CVE: CVE-2021-26916
Published: 2021-02-08
Description: In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML through the Filters/CheckDiscountCouponAttribute.cs discountcode parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nopSolutions/nopCommerce/issues/5322; https://github.com/nopSolutions/nopCommerce/issues/5322
CVE: CVE-2020-14391
Published: 2021-02-08
Description: A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly uses Red Hat Customer Portal credentials when a user registers a system through the GNOME Settings User Interface. This flaw allows a local attacker to discover the Red Hat Customer Portal password. The highest threat from this vulnerability is to confidentiality.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://bugzilla.redhat.com/show_bug.cgi?id=1873093; https://bugzilla.redhat.com/show_bug.cgi?id=1873093
CVE: CVE-2020-29021
Published: 2021-02-08
Description: A vulnerability in web UI input field of GateManager allows authenticated attacker to enter script tags that could cause XSS. This issue affects: GateManager all versions prior to 9.3.
CVSS Score: 3.5 (LOW)
CWE: CWE-20, CWE-79
References: https://www.secomea.com/support/cybersecurity-advisory/; https://www.secomea.com/support/cybersecurity-advisory/
CVE: CVE-2021-26917
Published: 2021-02-08
Description: PyBitmessage through 0.6.3.2 allows attackers to write screen captures to Potentially Unwanted Directories via a crafted apinotifypath value. NOTE: the discoverer states "security mitigation may not be necessary as there is no evidence yet that these screen intercepts are actually transported away from the local host." NOTE: it is unclear whether there are any common use cases in which apinotifypath is controlled by an attacker
CVSS Score: 5.5 (MEDIUM)
References: https://attack.mitre.org/techniques/T1113/; https://github.com/Bitmessage/PyBitmessage/blob/f381721bec31641002e2f240309600c4994855a7/src/api.py#L35-L37; https://github.com/Bitmessage/PyBitmessage/releases
CVE: CVE-2021-3294
Published: 2021-02-09
Description: CASAP Automated Enrollment System 1.0 is affected by cross-site scripting (XSS) in users.php. An attacker can steal a cookie to perform user redirection to a malicious website.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://casap.com; http://packetstormsecurity.com/files/161421/CASAP-Automated-Enrollment-System-1.0-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/49469
CVE: CVE-2021-26918
Published: 2021-02-09
Description: The ProBot bot through 2021-02-08 for Discord might allow attackers to interfere with the intended purpose of the "Send an image when a user joins the server" feature (or possibly have unspecified other impact) because the uploader web service allows double extensions (such as .html.jpg) with the text/html content type. NOTE: there may not be cases in which an uploader web service is customer controlled; however, the nature of the issue has substantial interaction with customer controlled configuration. NOTE: the vendor states "This is just an uploader (like any other one) which uploads files to cloud storage and accepts various file types. There is no kind of vulnerability and it won't compromise either the client side or the server side.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: http://packetstormsecurity.com/files/161347/Discord-Probot-Arbitrary-File-Upload.html; https://raw.githubusercontent.com/TheLastVvV/Vulnerability-Reports-and-CVE/main/Reports/Discord%20Probot%20-%20Unrestricted%20File%20Upload.txt; http://packetstormsecurity.com/files/161347/Discord-Probot-Arbitrary-File-Upload.html
CVE: CVE-2020-24685
Published: 2021-02-09
Description: An unauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service (DoS) vulnerability. Vulnerability allows attacker to stop the PLC. After stopping (ERR LED flashing red), physical access to the PLC is required in order to restart the application. This issue affects: ABB AC500 V2 products with onboard Ethernet version 2.8.4 and prior versions.
CVSS Score: 8.6 (HIGH)
CWE: CWE-789, CWE-770
References: https://search.abb.com/library/Download.aspx?DocumentID=3ADR010667&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=3ADR010667&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-13407
Published: 2021-02-09
Description: Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS, which can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 1 of 3)
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2020-13408
Published: 2021-02-09
Description: Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS, which can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 2 of 3)
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2020-13409
Published: 2021-02-09
Description: Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS, which can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 3 of 3)
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2020-13460
Published: 2021-02-09
Description: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities were present in Tufin SecureTrack, affecting all versions prior to R20-2 GA.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2020-13461
Published: 2021-02-09
Description: Username enumeration in present in Tufin SecureTrack. It's affecting all versions of SecureTrack. The vendor has decided not to fix this vulnerability. Vendor's response: "This attack requires access to the internal network. If an attacker is part of the internal network, they do not require access to TOS to know the usernames".
CVSS Score: 4.3 (MEDIUM)
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2020-13462
Published: 2021-02-09
Description: Insecure Direct Object Reference (IDOR) exists in Tufin SecureChange, affecting all versions prior to R20-2 GA. Fixed in version R20-2 GA.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-639
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2021-23327
Published: 2021-02-09
Description: The package apexcharts before 3.24.0 are vulnerable to Cross-site Scripting (XSS) via lack of sanitization of graph legend fields.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/apexcharts/apexcharts.js/commit/68f3f34d125719b4767614fe0a595cc65bde1d19; https://github.com/apexcharts/apexcharts.js/pull/2158; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1070616
CVE: CVE-2021-26925
Published: 2021-02-09
Description: Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/roundcube/roundcubemail/commit/9dc276d5f26042db02754fa1bac6fbd683c6d596; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QPAMYM2DQODSCQIAVNFJR2ETG7WMJOD/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q752JPOHTR6H72FK3EIPJZ5O24Z7RGLM/
CVE: CVE-2020-16044
Published: 2021-02-09
Description: Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1163228; https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-22840
Published: 2021-02-09
Description: Open redirect vulnerability in b2evolution CMS version prior to 6.11.6 allows an attacker to perform malicious open redirects to an attacker controlled resource via redirect_to parameter in email_passthrough.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://packetstormsecurity.com/files/161362/b2evolution-CMS-6.11.6-Open-Redirection.html; https://github.com/b2evolution/b2evolution/issues/102; https://www.exploit-db.com/exploits/49554
CVE: CVE-2020-22841
Published: 2021-02-09
Description: Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious JavaScript code execution via the plugin name input field in the plugin module.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/161363/b2evolution-CMS-6.11.6-Cross-Site-Scripting.html; https://github.com/b2evolution/b2evolution/issues/102; https://www.exploit-db.com/exploits/49551
CVE: CVE-2021-21117
Published: 2021-02-09
Description: Insufficient policy enforcement in Cryptohome in Google Chrome prior to 88.0.4324.96 allowed a local attacker to perform OS-level privilege escalation via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-362
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1137179; https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html
CVE: CVE-2021-21118
Published: 2021-02-09
Description: Insufficient data validation in V8 in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1161357; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21118
CVE: CVE-2021-21119
Published: 2021-02-09
Description: Use after free in Media in Google Chrome prior to 88.0.4324.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1160534; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21119
CVE: CVE-2021-21120
Published: 2021-02-09
Description: Use after free in WebSQL in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1160602; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21120
CVE: CVE-2021-21121
Published: 2021-02-09
Description: Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1161143; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21121
CVE: CVE-2021-21122
Published: 2021-02-09
Description: Use after free in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1162131; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21122
CVE: CVE-2021-21123
Published: 2021-02-09
Description: Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1137247; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21123
CVE: CVE-2021-21124
Published: 2021-02-09
Description: Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1131346; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21124
CVE: CVE-2021-21125
Published: 2021-02-09
Description: Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.
CVSS Score: 8.1 (HIGH)
CWE: CWE-59
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1152327; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21125
CVE: CVE-2021-21126
Published: 2021-02-09
Description: Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass site isolation via a crafted Chrome Extension.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1108126; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21126
CVE: CVE-2021-21127
Published: 2021-02-09
Description: Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass content security policy via a crafted Chrome Extension.
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1115590; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21127
CVE: CVE-2021-21128
Published: 2021-02-09
Description: Heap buffer overflow in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1138877; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21128
CVE: CVE-2021-21129
Published: 2021-02-09
Description: Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1140403; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21129
CVE: CVE-2021-21130
Published: 2021-02-09
Description: Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1140410; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21130
CVE: CVE-2021-21131
Published: 2021-02-09
Description: Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-59, CWE-434
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1140417; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21131
CVE: CVE-2021-21132
Published: 2021-02-09
Description: Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted Chrome Extension.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-1021
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1128206; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21132
CVE: CVE-2021-21133
Published: 2021-02-09
Description: Insufficient policy enforcement in Downloads in Google Chrome prior to 88.0.4324.96 allowed an attacker who convinced a user to download files to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1157743; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21133
CVE: CVE-2021-21134
Published: 2021-02-09
Description: Incorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote attacker to spoof security UI via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1157800; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21134
CVE: CVE-2021-21135
Published: 2021-02-09
Description: Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1157818; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21135
CVE: CVE-2021-21136
Published: 2021-02-09
Description: Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1038002; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21136
CVE: CVE-2021-21137
Published: 2021-02-09
Description: Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1093791; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21137
CVE: CVE-2021-21138
Published: 2021-02-09
Description: Use after free in DevTools in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially perform a sandbox escape via a crafted file.
CVSS Score: 8.6 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1122487; https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html
CVE: CVE-2021-21139
Published: 2021-02-09
Description: Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1021
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/937131; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21139
CVE: CVE-2021-21140
Published: 2021-02-09
Description: Uninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially perform out of bounds memory access via via a USB device.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1136327; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21140