deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-21361
Published: 2021-03-09
Description: The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixed in version 3.0.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-jpcm-4485-69p7; https://github.com/bmuschko/gradle-vagrant-plugin/blob/292129f9343d00d391543fae06239e9b0f33db73/src/main/groovy/com/bmuschko/gradle/vagrant/process/GDKExternalProcessExecutor.groovy#L42-L44; https://github.com/bmuschko/gradle-vagrant-plugin/issues/19
CVE: CVE-2021-24033
Published: 2021-03-09
Description: react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://github.com/facebook/create-react-app/pull/10644; https://www.facebook.com/security/advisories/cve-2021-24033; https://github.com/facebook/create-react-app/pull/10644
CVE: CVE-2021-20272
Published: 2021-03-09
Description: A flaw was found in privoxy before 3.0.32. An assertion failure could be triggered with a crafted CGI request leading to server crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://bugzilla.redhat.com/show_bug.cgi?id=1936651; https://lists.debian.org/debian-lts-announce/2021/03/msg00009.html; https://security.gentoo.org/glsa/202107-16
CVE: CVE-2021-20273
Published: 2021-03-09
Description: A flaw was found in privoxy before 3.0.32. A crash can occur via a crafted CGI request if Privoxy is toggled off.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=1936658; https://lists.debian.org/debian-lts-announce/2021/03/msg00009.html; https://security.gentoo.org/glsa/202107-16
CVE: CVE-2021-20274
Published: 2021-03-09
Description: A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks server misbehaves.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1936662; https://security.gentoo.org/glsa/202107-16; https://www.privoxy.org/announce.txt
CVE: CVE-2021-20275
Published: 2021-03-09
Description: A flaw was found in privoxy before 3.0.32. A invalid read of size two may occur in chunked_body_is_complete() leading to denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1936666; https://lists.debian.org/debian-lts-announce/2021/03/msg00009.html; https://security.gentoo.org/glsa/202107-16
CVE: CVE-2021-20276
Published: 2021-03-09
Description: A flaw was found in privoxy before 3.0.32. Invalid memory access with an invalid pattern passed to pcre_compile() may lead to denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1936668; https://lists.debian.org/debian-lts-announce/2021/03/msg00009.html; https://security.gentoo.org/glsa/202107-16
CVE: CVE-2021-28006
Published: 2021-03-09
Description: Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in admin.php through the options parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/49605; https://www.exploit-db.com/exploits/49605
CVE: CVE-2021-20341
Published: 2021-03-09
Description: IBM Cloud Pak for Multicloud Management Monitoring 2.2 returns potentially sensitive information in headers which could lead to further attacks against the system. IBM X-Force ID: 194513.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/194513; https://www.ibm.com/support/pages/node/6426997; https://exchange.xforce.ibmcloud.com/vulnerabilities/194513
CVE: CVE-2021-21480
Published: 2021-03-09
Description: SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). An attacker can intercept a request to the server, inject malicious JSP code in the request and forward to server. When this dashboard is opened by users having at least SAP_XMII Developer role, malicious content in the dashboard gets executed, leading to remote code execution in the server, which allows privilege escalation. The malicious JSP code can contain certain OS commands, through which an attacker can read sensitive files in the server, modify files or even delete contents in the server thus compromising the confidentiality, integrity and availability of the server hosting the SAP MII application. Also, an attacker authenticated as a developer can use the application to upload and execute a file which will permit them to execute operating systems commands completely compromising the server hosting the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: http://packetstormsecurity.com/files/163164/SAP-XMII-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2021/Jun/30; https://launchpad.support.sap.com/#/notes/3022622
CVE: CVE-2021-21481
Published: 2021-03-09
Description: The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might allow an unauthorized attacker to access configuration objects, including such that grant administrative privileges. This could result in complete compromise of system confidentiality, integrity, and availability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://launchpad.support.sap.com/#/notes/3022422; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://launchpad.support.sap.com/#/notes/3022422
CVE: CVE-2021-21484
Published: 2021-03-09
Description: LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthenticated bind.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://launchpad.support.sap.com/#/notes/3017378; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://launchpad.support.sap.com/#/notes/3017378
CVE: CVE-2021-21486
Published: 2021-03-09
Description: SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/3007888; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://launchpad.support.sap.com/#/notes/3007888
CVE: CVE-2021-21487
Published: 2021-03-09
Description: SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/3023778; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://launchpad.support.sap.com/#/notes/3023778
CVE: CVE-2021-21488
Published: 2021-03-09
Description: Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without verification, leading to insecure deserialization which triggers the attacker’s code, therefore impacting Availability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-502
References: https://launchpad.support.sap.com/#/notes/2983436; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://launchpad.support.sap.com/#/notes/2983436
CVE: CVE-2021-21493
Published: 2021-03-09
Description: When a user opens manipulated Graphics Interchange Format (.GIF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 3.3 (LOW)
References: https://launchpad.support.sap.com/#/notes/3027758; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://www.zerodayinitiative.com/advisories/ZDI-21-289/
CVE: CVE-2021-25915
Published: 2021-03-09
Description: Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://github.com/eugeneware/changeset/commit/9e588844edbb9993b32e7366cc799262b4447f99; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25915; https://github.com/eugeneware/changeset/commit/9e588844edbb9993b32e7366cc799262b4447f99
CVE: CVE-2021-27584
Published: 2021-03-09
Description: When a user opens manipulated PhotoShop Document (.PSD) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 3.3 (LOW)
References: https://launchpad.support.sap.com/#/notes/3027758; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://launchpad.support.sap.com/#/notes/3027758
CVE: CVE-2021-27585
Published: 2021-03-09
Description: When a user opens manipulated Computer Graphics Metafile (.CGM) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 7.8 (HIGH)
References: https://launchpad.support.sap.com/#/notes/3027758; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://www.zerodayinitiative.com/advisories/ZDI-21-288/
CVE: CVE-2021-27586
Published: 2021-03-09
Description: When a user opens manipulated Interchange File Format (.IFF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 7.8 (HIGH)
References: https://launchpad.support.sap.com/#/notes/3027758; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://www.zerodayinitiative.com/advisories/ZDI-21-315/
CVE: CVE-2021-27587
Published: 2021-03-09
Description: When a user opens manipulated Jupiter Tessellation (.JT) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 7.8 (HIGH)
References: https://launchpad.support.sap.com/#/notes/3027758; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://www.zerodayinitiative.com/advisories/ZDI-21-310/
CVE: CVE-2021-27588
Published: 2021-03-09
Description: When a user opens manipulated HPGL format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 7.8 (HIGH)
References: https://launchpad.support.sap.com/#/notes/3027758; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://www.zerodayinitiative.com/advisories/ZDI-21-292/
CVE: CVE-2021-27589
Published: 2021-03-09
Description: When a user opens manipulated Scalable Vector Graphics (.SVG) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 7.8 (HIGH)
References: https://launchpad.support.sap.com/#/notes/3027758; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://www.zerodayinitiative.com/advisories/ZDI-21-306/
CVE: CVE-2021-27590
Published: 2021-03-09
Description: When a user opens manipulated Tag Image File Format (.TIFF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 7.8 (HIGH)
References: https://launchpad.support.sap.com/#/notes/3027758; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://www.zerodayinitiative.com/advisories/ZDI-21-294/
CVE: CVE-2021-27591
Published: 2021-03-09
Description: When a user opens manipulated Portable Document Format (.PDF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 7.8 (HIGH)
References: https://launchpad.support.sap.com/#/notes/3027758; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://www.zerodayinitiative.com/advisories/ZDI-21-298/
CVE: CVE-2021-27592
Published: 2021-03-09
Description: When a user opens manipulated Universal 3D (.U3D) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 7.8 (HIGH)
References: https://launchpad.support.sap.com/#/notes/3027767; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://www.zerodayinitiative.com/advisories/ZDI-21-311/
CVE: CVE-2020-35451
Published: 2021-03-09
Description: There is a race condition in OozieSharelibCLI in Apache Oozie before version 5.2.1 which allows a malicious attacker to replace the files in Oozie's sharelib during it's creation.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-377, CWE-362
References: http://www.openwall.com/lists/oss-security/2021/03/09/2; https://lists.apache.org/thread.html/r8688debdb8b586aab3e53dee2d675fc9212de0ec627a8d3cd43b5ab5%40%3Cuser.oozie.apache.org%3E; https://lists.apache.org/thread.html/r8688debdb8b586aab3e53dee2d675fc9212de0ec627a8d3cd43b5ab5%40%3Cuser.oozie.apache.org%3E
CVE: CVE-2020-8356
Published: 2021-03-09
Description: An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal LXCO log file in clear text. Affected logs are captured in the First Failure Data Capture (FFDC) service log. The FFDC service log is only generated when requested by a privileged LXCO user and it is only accessible to the privileged LXCO user that requested the file.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://support.lenovo.com/us/en/product_security/LEN-49884; https://support.lenovo.com/us/en/product_security/LEN-49884
CVE: CVE-2020-8357
Published: 2021-03-09
Description: A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.200.2042, that could allow configuration files to be written to non-standard locations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://iknow.lenovo.com.cn/detail/dc_195029.html; https://iknow.lenovo.com.cn/detail/dc_195029.html
CVE: CVE-2021-3417
Published: 2021-03-09
Description: An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), if added as a Resource Manager, are encoded then written to an internal LXCO log file each time a session is established with LXCA. Affected logs are captured in the First Failure Data Capture (FFDC) service log. The FFDC service log is only generated when requested by a privileged LXCO user and it is only accessible to the privileged LXCO user that requested the file.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://support.lenovo.com/us/en/product_security/LEN-49884; https://support.lenovo.com/us/en/product_security/LEN-49884
CVE: CVE-2020-28150
Published: 2021-03-09
Description: I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied data in a Redirect.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://c41nc.co.uk/?page_id=85; https://c41nc.co.uk/?page_id=85
CVE: CVE-2021-20241
Published: 2021-03-09
Description: A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://bugzilla.redhat.com/show_bug.cgi?id=1928952; https://github.com/ImageMagick/ImageMagick/pull/3177; https://lists.debian.org/debian-lts-announce/2021/03/msg00030.html
CVE: CVE-2021-20243
Published: 2021-03-09
Description: A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://bugzilla.redhat.com/show_bug.cgi?id=1928958; https://github.com/ImageMagick/ImageMagick/pull/3193; https://lists.debian.org/debian-lts-announce/2021/06/msg00000.html
CVE: CVE-2021-20253
Published: 2021-03-09
Description: A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low privileged user to the awx user from outside the isolated environment. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-552
References: https://bugzilla.redhat.com/show_bug.cgi?id=1928847; https://bugzilla.redhat.com/show_bug.cgi?id=1928847
CVE: CVE-2021-20262
Published: 2021-03-09
Description: A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. This flaw allows an attacker to take over an account if they can obtain temporary, physical access to a user’s browser. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-306
References: https://bugzilla.redhat.com/show_bug.cgi?id=1933639; https://bugzilla.redhat.com/show_bug.cgi?id=1933639
CVE: CVE-2021-20263
Published: 2021-03-09
Description: A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.
CVSS Score: 3.3 (LOW)
CWE: CWE-281, CWE-281
References: https://bugzilla.redhat.com/show_bug.cgi?id=1933668; https://security.gentoo.org/glsa/202208-27; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-20268
Published: 2021-03-09
Description: An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user running the eBPF script calls dev_map_init_map or sock_map_alloc. This flaw allows a local user to crash the system or possibly escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1923816; https://lore.kernel.org/bpf/CACAyw99bEYWJCSGqfLiJ9Jp5YE1ZsZSiJxb4RFUTwbofipf0dA%40mail.gmail.com/T/#m8929643e99bea9c18ed490a7bc2591145eac6444; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-21159
Published: 2021-03-09
Description: Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html; https://crbug.com/1171049; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBT54RKAE5XLMWSHLVUKJ7T2XHHYMXLH/
CVE: CVE-2021-21160
Published: 2021-03-09
Description: Heap buffer overflow in WebAudio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html; https://crbug.com/1170531; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBT54RKAE5XLMWSHLVUKJ7T2XHHYMXLH/
CVE: CVE-2021-21161
Published: 2021-03-09
Description: Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html; https://crbug.com/1173702; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBT54RKAE5XLMWSHLVUKJ7T2XHHYMXLH/
CVE: CVE-2021-21162
Published: 2021-03-09
Description: Use after free in WebRTC in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html; https://crbug.com/1172054; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBT54RKAE5XLMWSHLVUKJ7T2XHHYMXLH/
CVE: CVE-2021-21163
Published: 2021-03-09
Description: Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page and a malicious server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html; https://crbug.com/1111239; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBT54RKAE5XLMWSHLVUKJ7T2XHHYMXLH/
CVE: CVE-2021-21164
Published: 2021-03-09
Description: Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html; https://crbug.com/1164846; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBT54RKAE5XLMWSHLVUKJ7T2XHHYMXLH/
CVE: CVE-2021-21165
Published: 2021-03-09
Description: Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-362
References: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html; https://crbug.com/1174582; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBT54RKAE5XLMWSHLVUKJ7T2XHHYMXLH/
CVE: CVE-2021-21166
Published: 2021-03-09
Description: Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-362, CWE-362
References: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html; https://crbug.com/1177465; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBT54RKAE5XLMWSHLVUKJ7T2XHHYMXLH/