deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-36915
Published: 2022-07-27
Description: Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2404; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36916
Published: 2022-07-27
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manual backup.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2656; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36917
Published: 2022-07-27
Description: A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a manual backup.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2656; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36918
Published: 2022-07-27
Description: Jenkins Buckminster Plugin 1.1.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2747; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36919
Published: 2022-07-27
Description: A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2790%20%281%29; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36920
Published: 2022-07-27
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2790%20%282%29; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36921
Published: 2022-07-27
Description: A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2790%20%282%29; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36922
Published: 2022-07-27
Description: Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, resulting in a reflected cross-site scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2812; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-33943
Published: 2022-07-27
Description: Authenticated (contributor or higher user role) Cross-Site Scripting (XSS) vulnerability in Nico Amarilla's BxSlider WP plugin <= 2.0.0 at WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/bxslider-wp/wordpress-bxslider-wp-plugin-2-0-0-authenticated-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/bxslider-wp/#developers; https://patchstack.com/database/vulnerability/bxslider-wp/wordpress-bxslider-wp-plugin-2-0-0-authenticated-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-35669
Published: 2022-07-27
Description: Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 20.005.30334 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-35672
Published: 2022-07-27
Description: Adobe Acrobat Reader version 22.001.20085 (and earlier), 20.005.30314 (and earlier) and 17.012.30205 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb22-16.html; https://helpx.adobe.com/security/products/acrobat/apsb22-16.html
CVE: CVE-2022-34120
Published: 2022-07-27
Description: Barangay Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the module editing function at /pages/activity/activity.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/wangsj37/bug_report/blob/main/vendors/itsourcecode.com/barangay-management-system/RCE-1.md; https://github.com/wangsj37/bug_report/blob/main/vendors/itsourcecode.com/barangay-management-system/RCE-1.md
CVE: CVE-2022-34121
Published: 2022-07-27
Description: Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-829
References: https://github.com/CuppaCMS/CuppaCMS/issues/18; https://github.com/hansmach1ne/MyExploits/tree/main/LFI_in_CuppaCMS_templates; https://github.com/CuppaCMS/CuppaCMS/issues/18
CVE: CVE-2022-36946
Published: 2022-07-27
Description: nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len.
CVSS Score: 7.5 (HIGH)
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164; https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html; https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html
CVE: CVE-2020-6998
Published: 2022-07-27
Description: The connection establishment algorithm found in Rockwell Automation CompactLogix 5370 and ControlLogix 5570 versions 33 and prior does not sufficiently manage its control flow during execution, creating an infinite loop. This may allow an attacker to send specially crafted CIP packet requests to a controller, which may cause denial-of-service conditions in communications with other products.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130398; https://www.cisa.gov/uscert/ics/advisories/icsa-21-061-02; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130398
CVE: CVE-2021-38410
Published: 2022-07-27
Description: AVEVA Software Platform Common Services (PCS) Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to DLL hijacking through an uncontrolled search path element, which may allow an attacker control to one or more locations in the search path.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427, CWE-427
References: https://www.aveva.com/en/support-and-success/cyber-security-updates/; https://www.cisa.gov/uscert/ics/advisories/icsa-21-252-01; https://www.aveva.com/en/support-and-success/cyber-security-updates/
CVE: CVE-2021-38417
Published: 2022-07-27
Description: VISAM VBASE version 11.6.0.6 is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user viewing access to folders and files in the directory listing.
CVSS Score: 7.4 (HIGH)
CWE: CWE-284
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01; https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01
CVE: CVE-2021-42535
Published: 2022-07-27
Description: VISAM VBASE version 11.6.0.6 does not neutralize or incorrectly neutralizes user-controllable input before the data is placed in output used as a public-facing webpage.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01; https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01
CVE: CVE-2021-42537
Published: 2022-07-27
Description: VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01; https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01
CVE: CVE-2022-35911
Published: 2022-07-27
Description: On Patlite NH-FB series devices through 1.46, remote attackers can cause a denial of service by omitting the query string. NOTE: the vendor's perspective is that "omitting the query string does not cause a denial of service and the indicated event can not be reproduced.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://packetstormsecurity.com/files/167797/Patlite-1.46-Buffer-Overflow.html; https://www.patlite.co.jp/product/detail[PII_REDACTED].html; https://www.patlite.com/network-products/lineup/nh-fb.html
CVE: CVE-2022-36948
Published: 2022-07-27
Description: In Veritas NetBackup OpsCenter, a DOM XSS attack can occur. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue7; https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue7
CVE: CVE-2022-36949
Published: 2022-07-27
Description: In Veritas NetBackup OpsCenter, an attacker with local access to a NetBackup OpsCenter server could potentially escalate their privileges. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.
CVSS Score: 9.3 (CRITICAL)
References: https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue5; https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue5
CVE: CVE-2022-36950
Published: 2022-07-27
Description: In Veritas NetBackup OpsCenter, an unauthenticated remote attacker may be able to perform remote command execution through a Java classloader manipulation. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.
CVSS Score: 9.8 (CRITICAL)
References: https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue3; https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue3
CVE: CVE-2022-36951
Published: 2022-07-27
Description: In Veritas NetBackup OpsCenter, an unauthenticated remote attacker may compromise the host by exploiting an incorrectly patched vulnerability. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.
CVSS Score: 9.8 (CRITICAL)
References: https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue2; https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue2
CVE: CVE-2022-36952
Published: 2022-07-27
Description: In Veritas NetBackup OpsCenter, a hard-coded credential exists that could be used to exploit the underlying VxSS subsystem. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.
CVSS Score: 8.4 (HIGH)
CWE: CWE-798
References: https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue6; https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue6
CVE: CVE-2022-36953
Published: 2022-07-27
Description: In Veritas NetBackup OpsCenter, certain endpoints could allow an unauthenticated remote attacker to gain sensitive information. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.
CVSS Score: 4.3 (MEDIUM)
References: https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue8; https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue8
CVE: CVE-2022-36954
Published: 2022-07-27
Description: In Veritas NetBackup OpsCenter, under specific conditions, an authenticated remote attacker may be able to create or modify OpsCenter user accounts. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.
CVSS Score: 9.9 (CRITICAL)
References: https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue1; https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue1
CVE: CVE-2022-36955
Published: 2022-07-27
Description: In Veritas NetBackup, an attacker with unprivileged local access to a NetBackup Client may send specific commands to escalate their privileges. This affects 8.0 through 8.1.2, 8.2, 8.3 through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1.
CVSS Score: 7.8 (HIGH)
References: https://www.veritas.com/content/support/en_US/security/VTS22-008#Issue2; https://www.veritas.com/content/support/en_US/security/VTS22-008#Issue2
CVE: CVE-2022-36956
Published: 2022-07-27
Description: In Veritas NetBackup, the NetBackup Client allows arbitrary command execution from any remote host that has access to a valid host-id NetBackup certificate/private key from the same domain. The affects 9.0.x through 9.0.0.1 and 9.1.x through 9.1.0.1.
CVSS Score: 9.0 (CRITICAL)
References: https://www.veritas.com/content/support/en_US/security/VTS22-008#Issue1; https://www.veritas.com/content/support/en_US/security/VTS22-008#Issue1
CVE: CVE-2022-1853
Published: 2022-07-27
Description: Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1324864; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1854
Published: 2022-07-27
Description: Use after free in ANGLE in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1320024; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1855
Published: 2022-07-27
Description: Use after free in Messaging in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1228661; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1856
Published: 2022-07-27
Description: Use after free in User Education in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension or specific user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1323239; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1857
Published: 2022-07-27
Description: Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to bypass file system restrictions via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1227995; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1858
Published: 2022-07-27
Description: Out of bounds read in DevTools in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to perform an out of bounds memory read via specific user interaction.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1314310; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1859
Published: 2022-07-27
Description: Use after free in Performance Manager in Google Chrome prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1322744; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1860
Published: 2022-07-27
Description: Use after free in UI Foundations in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific user interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1297209; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1861
Published: 2022-07-27
Description: Use after free in Sharing in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to enage in specific user interactions to potentially exploit heap corruption via specific user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1316846; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1862
Published: 2022-07-27
Description: Inappropriate implementation in Extensions in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass profile restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1236325; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1863
Published: 2022-07-27
Description: Use after free in Tab Groups in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1292870; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1864
Published: 2022-07-27
Description: Use after free in WebApp Installs in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1320624; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1865
Published: 2022-07-27
Description: Use after free in Bookmarks in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1289192; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1866
Published: 2022-07-27
Description: Use after free in Tablet Mode in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific user interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1292264; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1867
Published: 2022-07-27
Description: Insufficient validation of untrusted input in Data Transfer in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to bypass same origin policy via a crafted clipboard content.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1315563; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1868
Published: 2022-07-27
Description: Inappropriate implementation in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1301203; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1869
Published: 2022-07-27
Description: Type Confusion in V8 in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1309467; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1870
Published: 2022-07-27
Description: Use after free in App Service in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1323236; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1871
Published: 2022-07-27
Description: Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass file system policy via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1308199; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1872
Published: 2022-07-27
Description: Insufficient policy enforcement in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass downloads policy via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html; https://crbug.com/1310461; https://security.gentoo.org/glsa/202208-25