deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-5653
Published: 2020-11-02
Description: Buffer overflow vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows a remote unauthenticated attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://jvn.jp/vu/JVNVU92513419/index.html; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-012.pdf; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-012_en.pdf
CVE: CVE-2020-5654
Published: 2020-11-02
Description: Session fixation vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-384
References: https://jvn.jp/vu/JVNVU92513419/index.html; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-012.pdf; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-012_en.pdf
CVE: CVE-2020-5655
Published: 2020-11-02
Description: NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://jvn.jp/vu/JVNVU92513419/index.html; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-012.pdf; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-012_en.pdf
CVE: CVE-2020-5656
Published: 2020-11-02
Description: Improper access control vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows a remote unauthenticated attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
CVSS Score: 9.8 (CRITICAL)
References: https://jvn.jp/vu/JVNVU92513419/index.html; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-012.pdf; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-012_en.pdf
CVE: CVE-2020-5657
Published: 2020-11-02
Description: Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows unauthenticated attackers on adjacent network to stop the network functions of the products via a specially crafted packet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-88
References: https://jvn.jp/vu/JVNVU92513419/index.html; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-012.pdf; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-012_en.pdf
CVE: CVE-2020-5658
Published: 2020-11-02
Description: Resource Management Errors vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.
CVSS Score: 7.5 (HIGH)
References: https://jvn.jp/vu/JVNVU92513419/index.html; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-012.pdf; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-012_en.pdf
CVE: CVE-2020-6014
Published: 2020-11-02
Description: Check Point Endpoint Security Client for Windows, with Anti-Bot or Threat Emulation blades installed, before version E83.20, tries to load a non-existent DLL during a query for the Domain Name. An attacker with administrator privileges can leverage this to gain code execution within a Check Point Software Technologies signed binary, where under certain circumstances may cause the client to terminate.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-114, CWE-426
References: https://supportcontent.checkpoint.com/solutions?id=sk168081; https://supportcontent.checkpoint.com/solutions?id=sk168081
CVE: CVE-2020-8173
Published: 2020-11-02
Description: A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter time than intended.
CVSS Score: 2.2 (LOW)
CWE: CWE-310, CWE-311
References: https://hackerone.com/reports/852841; https://nextcloud.com/security/advisory/?id=NC-SA-2020-023; https://hackerone.com/reports/852841
CVE: CVE-2020-8183
Published: 2020-11-02
Description: A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-256, CWE-522
References: https://hackerone.com/reports/885041; https://nextcloud.com/security/advisory/?id=NC-SA-2020-026; https://hackerone.com/reports/885041
CVE: CVE-2020-8236
Published: 2020-11-02
Description: A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification by asking for the PIN of the passwordless WebAuthn but not verifying it.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://hackerone.com/reports/924393; https://nextcloud.com/security/advisory/?id=NC-SA-2020-037; https://hackerone.com/reports/924393
CVE: CVE-2020-9368
Published: 2020-11-02
Description: The Module Olea Gift On Order module through 5.0.8 for PrestaShop enables an unauthenticated user to read arbitrary files on the server via getfile.php?file=/.. directory traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/Intrinsec/CERT/blob/master/Advisories/CVE-2020-9368.md; https://www.intrinsec.com/publications/; https://github.com/Intrinsec/CERT/blob/master/Advisories/CVE-2020-9368.md
CVE: CVE-2020-23868
Published: 2020-11-02
Description: NeDi 1.9C allows inc/rt-popup.php d XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/harsh-bothra/f4285d20a7718d2e1934c042b04d9fac; https://gist.github.com/harsh-bothra/f4285d20a7718d2e1934c042b04d9fac
CVE: CVE-2020-23989
Published: 2020-11-02
Description: NeDi 1.9C allows pwsec.php oid XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/harsh-bothra/d8c86b8279b23ff6d371f832ba0a5b6b; https://gist.github.com/harsh-bothra/d8c86b8279b23ff6d371f832ba0a5b6b
CVE: CVE-2020-26939
Published: 2020-11-02
Description: In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://github.com/bcgit/bc-java/wiki/CVE-2020-26939; https://lists.apache.org/thread.html/r8c36ba34e80e05eecb1f80071cc834d705616f315b634ec0c7d8f42e%40%3Cissues.solr.apache.org%3E; https://github.com/bcgit/bc-java/wiki/CVE-2020-26939
CVE: CVE-2020-7757
Published: 2020-11-02
Description: This affects all versions of package droppy. It is possible to traverse directories to fetch configuration files from a droopy server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/silverwind/droppy/blob/master/server/server.js%23L845; https://snyk.io/vuln/SNYK-JS-DROPPY-1023656; https://github.com/silverwind/droppy/blob/master/server/server.js%23L845
CVE: CVE-2020-7758
Published: 2020-11-02
Description: This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/browserless/chrome/blob/master/src/routes.ts%23L175; https://github.com/browserless/chrome/commit/848b87e5bea4f8473eea85261a5ff922d6ebd2b6; https://github.com/browserless/chrome/releases/tag/1.40.2-chrome-stable
CVE: CVE-2020-9861
Published: 2020-11-02
Description: A stack overflow issue existed in Swift for Linux. The issue was addressed with improved input validation for dealing with deeply nested malicious JSON input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://forums.swift.org/t/swift-5-1-5-for-linux-jsonserialization-limit-recursion-when-parsing/34514; https://forums.swift.org/t/swift-5-1-5-for-linux-jsonserialization-limit-recursion-when-parsing/34514
CVE: CVE-2020-15967
Published: 2020-11-03
Description: Use after free in payments in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1127322
CVE: CVE-2020-15968
Published: 2020-11-03
Description: Use after free in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1126424
CVE: CVE-2020-15969
Published: 2020-11-03
Description: Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; http://seclists.org/fulldisclosure/2020/Dec/24; http://seclists.org/fulldisclosure/2020/Dec/26
CVE: CVE-2020-15970
Published: 2020-11-03
Description: Use after free in NFC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1108299
CVE: CVE-2020-15971
Published: 2020-11-03
Description: Use after free in printing in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1114062
CVE: CVE-2020-15972
Published: 2020-11-03
Description: Use after free in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; http://packetstormsecurity.com/files/172842/Chrome-Renderer-Remote-Code-Execution.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html
CVE: CVE-2020-15973
Published: 2020-11-03
Description: Insufficient policy enforcement in extensions in Google Chrome prior to 86.0.4240.75 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1106890
CVE: CVE-2020-15974
Published: 2020-11-03
Description: Integer overflow in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to bypass site isolation via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1104103
CVE: CVE-2020-15975
Published: 2020-11-03
Description: Integer overflow in SwiftShader in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1110800
CVE: CVE-2020-15976
Published: 2020-11-03
Description: Use after free in WebXR in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1123522
CVE: CVE-2020-15977
Published: 2020-11-03
Description: Insufficient data validation in dialogs in Google Chrome on OS X prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1097724
CVE: CVE-2020-15978
Published: 2020-11-03
Description: Insufficient data validation in navigation in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1116280
CVE: CVE-2020-15979
Published: 2020-11-03
Description: Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1127319
CVE: CVE-2020-15980
Published: 2020-11-03
Description: Insufficient policy enforcement in Intents in Google Chrome on Android prior to 86.0.4240.75 allowed a local attacker to bypass navigation restrictions via crafted Intents.
CVSS Score: 7.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1092453
CVE: CVE-2020-15981
Published: 2020-11-03
Description: Out of bounds read in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1123023
CVE: CVE-2020-15982
Published: 2020-11-03
Description: Inappropriate implementation in cache in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1039882
CVE: CVE-2020-15983
Published: 2020-11-03
Description: Insufficient data validation in webUI in Google Chrome on ChromeOS prior to 86.0.4240.75 allowed a local attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1076786
CVE: CVE-2020-15984
Published: 2020-11-03
Description: Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 86.0.4240.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted URL.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1080395
CVE: CVE-2020-15985
Published: 2020-11-03
Description: Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to spoof security UI via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1099276
CVE: CVE-2020-15986
Published: 2020-11-03
Description: Integer overflow in media in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190, CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1100247
CVE: CVE-2020-15987
Published: 2020-11-03
Description: Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted WebRTC stream.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1127774
CVE: CVE-2020-15988
Published: 2020-11-03
Description: Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 86.0.4240.75 allowed a remote attacker who convinced the user to open files to execute arbitrary code via a crafted HTML page.
CVSS Score: 6.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1092518
CVE: CVE-2020-15989
Published: 2020-11-03
Description: Uninitialized data in PDFium in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1108351
CVE: CVE-2020-15990
Published: 2020-11-03
Description: Use after free in autofill in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1133671
CVE: CVE-2020-15991
Published: 2020-11-03
Description: Use after free in password manager in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1133688
CVE: CVE-2020-15992
Published: 2020-11-03
Description: Insufficient policy enforcement in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1110195
CVE: CVE-2020-15993
Published: 2020-11-03
Description: Use after free in printing in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html; https://crbug.com/1133983; https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html
CVE: CVE-2020-15994
Published: 2020-11-03
Description: Use after free in V8 in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html; https://crbug.com/1117258; https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html