deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-3990
Published: 2023-07-28
Description: A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/mingSoft/MCMS/issues/I7K4DQ; https://vuldb.com/?ctiid.235611; https://vuldb.com/?id.235611
CVE: CVE-2023-3670
Published: 2023-07-28
Description: In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.
CVSS Score: 7.3 (HIGH)
CWE: CWE-668
References: https://cert.vde.com/en/advisories/VDE-2023-024; https://cert.vde.com/en/advisories/VDE-2023-024
CVE: CVE-2023-2685
Published: 2023-07-28
Description: A vulnerability was found in AO-OPC server versions mentioned above. As the directory information for the service entry is not enclosed in quotation marks, potential attackers could possibly call up another application than the AO-OPC server by starting the service. The service might be started with system user privileges which could cause a shift in user access privileges.

It is unlikely to exploit the vulnerability in well maintained Windows installations since the attacker would need write access to system folders.

An update is available that resolves the vulnerability found during an internal review in the product AO-OPC = 3.2.1 

CVSS Score: 7.2 (HIGH)
CWE: CWE-428
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108468A4093&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK108468A4093&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2023-31932
Published: 2023-07-28
Description: Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the viewid parameter of the view-enquiry.php file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/DiliLearngent/BugReport/blob/main/php/Rail-Pass-Management-System/bug5-SQL-Injection-viewid.md; https://github.com/DiliLearngent/BugReport/blob/main/php/Rail-Pass-Management-System/bug5-SQL-Injection-viewid.md
CVE: CVE-2023-31933
Published: 2023-07-28
Description: Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the editid parameter of the edit-pass-detail.php file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/DiliLearngent/BugReport/blob/main/php/Rail-Pass-Management-System/bug4-SQL-Injection-editid2.md; https://github.com/DiliLearngent/BugReport/blob/main/php/Rail-Pass-Management-System/bug4-SQL-Injection-editid2.md
CVE: CVE-2023-31934
Published: 2023-07-28
Description: Cross Site Scripting vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to obtain sensitive information via the adminname parameter of admin-profile.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/DiliLearngent/BugReport/blob/main/php/Rail-Pass-Management-System/bug1-XSS-in-Admin-Name.md; https://github.com/DiliLearngent/BugReport/blob/main/php/Rail-Pass-Management-System/bug1-XSS-in-Admin-Name.md
CVE: CVE-2023-31935
Published: 2023-07-28
Description: Cross Site Scripting vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to obtain sensitive information via the emial parameter of admin-profile.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/DiliLearngent/BugReport/blob/main/php/Rail-Pass-Management-System/bug1-XSS-in-Admin-Name.md; https://github.com/DiliLearngent/BugReport/blob/main/php/Rail-Pass-Management-System/bug2-XSS-in-Email-address.md; https://github.com/DiliLearngent/BugReport/blob/main/php/Rail-Pass-Management-System/bug1-XSS-in-Admin-Name.md
CVE: CVE-2023-31936
Published: 2023-07-28
Description: Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the viewid parameter of the view-pass-detail.php file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/DiliLearngent/BugReport/blob/main/php/Rail-Pass-Management-System/bug6-SQL-Injection-viewid2.md; https://github.com/DiliLearngent/BugReport/blob/main/php/Rail-Pass-Management-System/bug6-SQL-Injection-viewid2.md
CVE: CVE-2023-31937
Published: 2023-07-28
Description: Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the editid parameter of the edit-cateogry-detail.php file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/DiliLearngent/BugReport/blob/main/php/Rail-Pass-Management-System/bug3-SQL-Injection-editid.md; https://github.com/DiliLearngent/BugReport/blob/main/php/Rail-Pass-Management-System/bug3-SQL-Injection-editid.md
CVE: CVE-2023-39190
Published: 2023-07-28
Description: Rejected reason: CVE-2023-39190 was found to be a duplicate of CVE-2023-31436. Please see https://access.redhat.com/security/cve/CVE-2023-31436 for information about affected products and security errata.
CVE: CVE-2023-37467
Published: 2023-07-28
Description: Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a CSP (Content Security Policy) nonce reuse vulnerability was discovered could allow cross-site scripting (XSS) attacks to bypass CSP protection for anonymous (i.e. unauthenticated) users. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to bypass CSP and execute successfully. This vulnerability isn't applicable to logged-in users. Version 3.1.0.beta7 contains a patch. The stable branch doesn't have this vulnerability. A workaround to prevent the vulnerability is to disable Google Tag Manager, i.e., unset the `gtm container id` setting.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-323, CWE-79
References: https://github.com/discourse/discourse/commit/0976c8fad6970b6182e7837bf87de07709407f25; https://github.com/discourse/discourse/security/advisories/GHSA-gr5h-hm62-jr3j; https://github.com/discourse/discourse/commit/0976c8fad6970b6182e7837bf87de07709407f25
CVE: CVE-2023-37754
Published: 2023-07-28
Description: PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/PowerJob/PowerJob/; https://github.com/PowerJob/PowerJob/issues/675; https://novysodope.github.io/2023/07/02/100/
CVE: CVE-2023-38992
Published: 2023-07-28
Description: jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jeecgboot/jeecg-boot/issues/5173; https://github.com/jeecgboot/jeecg-boot/issues/5173
CVE: CVE-2023-39010
Published: 2023-07-28
Description: BoofCV 0.42 was discovered to contain a code injection vulnerability via the component boofcv.io.calibration.CalibrationIO.load. This vulnerability is exploited by loading a crafted camera calibration file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/lessthanoptimal/BoofCV/issues/406; https://github.com/lessthanoptimal/BoofCV/issues/406
CVE: CVE-2023-39013
Published: 2023-07-28
Description: Duke v1.2 and below was discovered to contain a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.init.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/larsga/Duke/issues/273; https://github.com/larsga/Duke/issues/273
CVE: CVE-2023-39015
Published: 2023-07-28
Description: webmagic-extension v0.9.0 and below was discovered to contain a code injection vulnerability via the component us.codecraft.webmagic.downloader.PhantomJSDownloader.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/code4craft/webmagic/issues/1122; https://github.com/code4craft/webmagic/issues/1122
CVE: CVE-2023-39016
Published: 2023-07-28
Description: bboss-persistent v6.0.9 and below was discovered to contain a code injection vulnerability in the component com.frameworkset.common.poolman.util.SQLManager.createPool. This vulnerability is exploited via passing an unchecked argument.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://gitee.com/bboss/bboss/issues/I7MH08; https://gitee.com/bboss/bboss/issues/I7MH08
CVE: CVE-2023-39017
Published: 2023-07-28
Description: quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple parties because it is not plausible that untrusted user input would reach the code location where injection must occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/quartz-scheduler/quartz/issues/943; https://github.com/quartz-scheduler/quartz/issues/943
CVE: CVE-2023-39018
Published: 2023-07-28
Description: FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple third parties because there are no realistic use cases in which FFmpeg.java uses untrusted input for the path of the executable file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/bramp/ffmpeg-cli-wrapper/blob/master/src/main/java/net/bramp/ffmpeg/FFmpeg.java; https://github.com/bramp/ffmpeg-cli-wrapper/issues/291; https://github.com/bramp/ffmpeg-cli-wrapper/blob/master/src/main/java/net/bramp/ffmpeg/FFmpeg.java
CVE: CVE-2023-39020
Published: 2023-07-28
Description: stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability is exploited via passing an unchecked argument.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/LetianYuan/My-CVE-Public-References/tree/main/edu_stanford_nlp_stanford-parser; https://github.com/LetianYuan/My-CVE-Public-References/tree/main/edu_stanford_nlp_stanford-parser
CVE: CVE-2023-39021
Published: 2023-07-28
Description: wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Setup.apply. This vulnerability is exploited via passing an unchecked argument.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/LetianYuan/My-CVE-Public-References/tree/main/com_wix_wix-embedded-mysql; https://github.com/LetianYuan/My-CVE-Public-References/tree/main/com_wix_wix-embedded-mysql
CVE: CVE-2023-39022
Published: 2023-07-28
Description: oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateless. This vulnerability is exploited via passing an unchecked argument.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/LetianYuan/My-CVE-Public-References/tree/main/opensymphony_oscore; https://github.com/LetianYuan/My-CVE-Public-References/tree/main/opensymphony_oscore
CVE: CVE-2023-39023
Published: 2023-07-28
Description: university compass v2.2.0 and below was discovered to contain a code injection vulnerability in the component org.compass.core.executor.DefaultExecutorManager.configure. This vulnerability is exploited via passing an unchecked argument.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/LetianYuan/My-CVE-Public-References/tree/main/org_compass-project_compass; https://github.com/LetianYuan/My-CVE-Public-References/tree/main/org_compass-project_compass
CVE: CVE-2023-37904
Published: 2023-07-28
Description: Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, more users than permitted could be created from invite links. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. As a workaround, use restrict to email address invites.
CVSS Score: 2.6 (LOW)
CWE: CWE-362
References: https://github.com/discourse/discourse/commit/62a609ea2d0645a27ee8adbb01ce10a5e03a600b; https://github.com/discourse/discourse/security/advisories/GHSA-6wj5-4ph2-c7qg; https://github.com/discourse/discourse/commit/62a609ea2d0645a27ee8adbb01ce10a5e03a600b
CVE: CVE-2023-37906
Published: 2023-07-28
Description: Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can edit a post in a topic and cause a DoS with a carefully crafted edit reason. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://github.com/discourse/discourse/commit/dcc825bda505a344eda403a1b8733f30e784034a; https://github.com/discourse/discourse/security/advisories/GHSA-pjv6-47x6-mx7c; https://github.com/discourse/discourse/commit/dcc825bda505a344eda403a1b8733f30e784034a
CVE: CVE-2023-38498
Published: 2023-07-28
Description: Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can prevent the defer queue from proceeding promptly on sites hosted in the same multisite installation. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerability. Users of multisite configurations should upgrade.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-770, CWE-770
References: https://github.com/discourse/discourse/commit/26e267478d785e2f32ee7da4613e2cf4a65ff182; https://github.com/discourse/discourse/security/advisories/GHSA-wv29-rm3f-4g2j; https://github.com/discourse/discourse/commit/26e267478d785e2f32ee7da4613e2cf4a65ff182
CVE: CVE-2023-38684
Published: 2023-07-28
Description: Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, in multiple controller actions, Discourse accepts limit params but does not impose any upper bound on the values being accepted. Without an upper bound, the software may allow arbitrary users to generate DB queries which may end up exhausting the resources on the server. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://github.com/discourse/discourse/commit/bfc3132bb22bd5b7e86f428746b89c4d3d7f5a70; https://github.com/discourse/discourse/security/advisories/GHSA-ff7g-xv79-hgmf; https://github.com/discourse/discourse/commit/bfc3132bb22bd5b7e86f428746b89c4d3d7f5a70
CVE: CVE-2023-38685
Published: 2023-07-28
Description: Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, information about restricted-visibility topic tags could be obtained by unauthorized users. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/discourse/discourse/commit/[PII_REDACTED]69a0a66c25775cc3870582a679ef8b; https://github.com/discourse/discourse/security/advisories/GHSA-wx6x-q4gp-mgv5; https://github.com/discourse/discourse/commit/[PII_REDACTED]69a0a66c25775cc3870582a679ef8b
CVE: CVE-2023-3488
Published: 2023-07-28
Description: Uninitialized buffer in GBL parser in Silicon Labs GSDK v4.3.0 and earlier allows attacker to leak data from Secure stack via malformed GBL file.


CVSS Score: 3.8 (LOW)
CWE: CWE-908, CWE-908
References: https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000Wi3HwQAJ?operationContext=S1; https://github.com/SiliconLabs/gecko_sdk/releases; https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000Wi3HwQAJ?operationContext=S1
CVE: CVE-2023-38988
Published: 2023-07-28
Description: An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators.
CVSS Score: 4.3 (MEDIUM)
References: https://github.com/thinkgem/jeesite/issues/517; https://github.com/thinkgem/jeesite/issues/517
CVE: CVE-2023-3598
Published: 2023-07-28
Description: Out of bounds read and write in ANGLE in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html; https://crbug.com/1427865; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/
CVE: CVE-2021-4316
Published: 2023-07-29
Description: Inappropriate implementation in Cast UI in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to spoof browser UI via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/1152952; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2021-4317
Published: 2023-07-29
Description: Use after free in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1260783; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2021-4318
Published: 2023-07-29
Description: Object corruption in Blink in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html; https://crbug.com/1237730; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2021-4319
Published: 2023-07-29
Description: Use after free in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop.html; https://crbug.com/1214199; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2021-4320
Published: 2023-07-29
Description: Use after free in Blink in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1224238; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2021-4321
Published: 2023-07-29
Description: Policy bypass in Blink in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1161891; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2021-4322
Published: 2023-07-29
Description: Use after free in DevTools in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1190550; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2021-4323
Published: 2023-07-29
Description: Insufficient validation of untrusted input in Extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extension to access local files via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html; https://crbug.com/1176031; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2021-4324
Published: 2023-07-29
Description: Insufficient policy enforcement in Google Update in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to read arbitrary files via a malicious file. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1193233; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2022-4906
Published: 2023-07-29
Description: Inappropriate implementation in Blink in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1382434; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/
CVE: CVE-2022-4907
Published: 2023-07-29
Description: Uninitialized Use in FFmpeg in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1358168; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/
CVE: CVE-2022-4908
Published: 2023-07-29
Description: Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html; https://crbug.com/1359122; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/