deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-27455
Published: 2021-07-02
Description: Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read while processing project files, which may allow an attacker to disclose information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-182-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-182-03
CVE: CVE-2021-35029
Published: 2021-07-02
Description: An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://www.zyxel.com/support/Zyxel_security_advisory_for_attacks_against_security_appliances.shtml; https://www.zyxel.com/support/Zyxel_security_advisory_for_attacks_against_security_appliances.shtml
CVE: CVE-2021-35197
Published: 2021-07-02
Description: In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "sitewide block" applied, it is able to still "purge" pages through the MediaWiki Action API (which a "sitewide block" should have prevented).
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://lists.debian.org/debian-lts-announce/2021/10/msg00003.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA/
CVE: CVE-2021-36125
Published: 2021-07-02
Description: An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalRenameRequest page is vulnerable to infinite loops and denial of service attacks when a user's current username is beyond an arbitrary maximum configuration value (MaxNameChars).
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://gerrit.wikimedia.org/r/q/I97d8b3236b5abed8ba9a9c4d3ab5050c2e782c22; https://phabricator.wikimedia.org/T260865; https://gerrit.wikimedia.org/r/q/I97d8b3236b5abed8ba9a9c4d3ab5050c2e782c22
CVE: CVE-2021-36126
Published: 2021-07-02
Description: An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. If the MediaWiki:Abusefilter-blocker message is invalid within the content language, the filter user falls back to the English version, but that English version could also be invalid on a wiki. This would result in a fatal error, and potentially fail to block or restrict a potentially nefarious user.
CVSS Score: 9.8 (CRITICAL)
References: https://gerrit.wikimedia.org/r/q/I9e9f44b7663e810de70fb9ac7f6760f83dd4895b; https://phabricator.wikimedia.org/T284364; https://gerrit.wikimedia.org/r/q/I9e9f44b7663e810de70fb9ac7f6760f83dd4895b
CVE: CVE-2021-36127
Published: 2021-07-02
Description: An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalUserRights page provided search results which, for a suppressed MediaWiki user, were different than for any other user, thus easily disclosing suppressed accounts (which are supposed to be completely hidden).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-922
References: https://gerrit.wikimedia.org/r/q/I4e4dbcad61e1d4f6fd8b038bf63d19c69081a8ec; https://phabricator.wikimedia.org/T285190; https://gerrit.wikimedia.org/r/q/I4e4dbcad61e1d4f6fd8b038bf63d19c69081a8ec
CVE: CVE-2021-36128
Published: 2021-07-02
Description: An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. Autoblocks for CentralAuth-issued suppression blocks are not properly implemented.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-755
References: https://gerrit.wikimedia.org/r/q/I15d14c88a1e30df92c470bc191c4ee573172d4d1; https://gerrit.wikimedia.org/r/q/I3e[PII_REDACTED]3380c798b62edfda726b6e374f89; https://phabricator.wikimedia.org/T281972
CVE: CVE-2021-36129
Published: 2021-07-02
Description: An issue was discovered in the Translate extension in MediaWiki through 1.36. The Aggregategroups Action API module does not validate the parameter for aggregategroup when action=remove is set, thus allowing users with the translate-manage right to silently delete various groups' metadata.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://gerrit.wikimedia.org/r/q/I3619a7e88c2eb979babb7b027d4fdbfabc0af792; https://phabricator.wikimedia.org/T282932; https://gerrit.wikimedia.org/r/q/I3619a7e88c2eb979babb7b027d4fdbfabc0af792
CVE: CVE-2021-36130
Published: 2021-07-02
Description: An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36. Within several gift-related special pages, a privileged user with the awardmanage right could inject arbitrary HTML and JavaScript within various gift-related data fields. The attack could easily propagate across many pages for many users.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/q/Id915eba45497a1a0dc1c4e00818a2fd4c0ce55d3; https://phabricator.wikimedia.org/T281043; https://gerrit.wikimedia.org/r/q/Id915eba45497a1a0dc1c4e00818a2fd4c0ce55d3
CVE: CVE-2021-36131
Published: 2021-07-02
Description: An XSS issue was discovered in the SportsTeams extension in MediaWiki through 1.36. Within several special pages, a privileged user could inject arbitrary HTML and JavaScript within various data fields. The attack could easily propagate across many pages for many users.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/q/Ic312cc9b8463c8e7c3298a661abfcff2cc2332cb; https://phabricator.wikimedia.org/T281196; https://gerrit.wikimedia.org/r/q/Ic312cc9b8463c8e7c3298a661abfcff2cc2332cb
CVE: CVE-2021-36132
Published: 2021-07-02
Description: An issue was discovered in the FileImporter extension in MediaWiki through 1.36. For certain relaxed configurations of the $wgFileImporterRequiredRight variable, it might not validate all appropriate user rights, thus allowing a user with insufficient rights to perform operations (specifically file uploads) that they should not be allowed to perform.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://gerrit.wikimedia.org/r/q/I8ff2a67abd2c118a3469e4410eac2a451bfa76c3; https://phabricator.wikimedia.org/T280590; https://gerrit.wikimedia.org/r/q/I8ff2a67abd2c118a3469e4410eac2a451bfa76c3
CVE: CVE-2021-3606
Published: 2021-07-02
Description: OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (openvpn.exe).
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://community.openvpn.net/openvpn/wiki/CVE-2021-3606; https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements; https://community.openvpn.net/openvpn/wiki/CVE-2021-3606
CVE: CVE-2021-3613
Published: 2021-07-02
Description: OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (OpenVPNConnect.exe).
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://openvpn.net/vpn-server-resources/openvpn-connect-for-windows-change-log/; https://openvpn.net/vpn-server-resources/openvpn-connect-for-windows-change-log/
CVE: CVE-2021-27950
Published: 2021-07-02
Description: A SQL injection vulnerability in azurWebEngine in Sita AzurCMS through 1.2.3.12 allows an authenticated attacker to execute arbitrary SQL commands via the id parameter to mesdocs.ajax.php in azurWebEngine/eShop. By default, the query is executed as DBA.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.azurcms.com/; https://raw.githubusercontent.com/post-cyberlabs/CVE-Advisory/main/CVE-2021-27950.pdf; https://www.sitasoftware.lu/
CVE: CVE-2021-32735
Published: 2021-07-02
Description: Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's `ListItem` component (used in the pages and files section for example) displayed HTML in page titles as it is. This could be used for cross-site scripting (XSS) attacks. Malicious authenticated Panel users can escalate their privileges if they get access to the Panel session of an admin user. Visitors without Panel access can use the attack vector if the site allows changing site data from a frontend form. Kirby 3.5.7 patches the vulnerability. As a partial workaround, site administrators can protect against attacks from visitors without Panel access by validating or sanitizing provided data from the frontend form.
CVSS Score: 7.1 (HIGH)
CWE: CWE-80, CWE-79
References: https://github.com/getkirby/kirby/releases/tag/3.5.7; https://github.com/getkirby/kirby/security/advisories/GHSA-2f2w-349x-vrqm; https://github.com/getkirby/kirby/releases/tag/3.5.7
CVE: CVE-2021-23402
Published: 2021-07-02
Description: All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1321
References: https://github.com/kripod/record-like-deep-assign/blob/v1.0.1/src/mod.ts%23L17-L35; https://snyk.io/vuln/SNYK-JS-RECORDLIKEDEEPASSIGN-1311024; https://github.com/kripod/record-like-deep-assign/blob/v1.0.1/src/mod.ts%23L17-L35
CVE: CVE-2021-32639
Published: 2021-07-02
Description: Emissary is a P2P-based, data-driven workflow engine. Emissary version 6.4.0 is vulnerable to Server-Side Request Forgery (SSRF). In particular, the `RegisterPeerAction` endpoint and the `AddChildDirectoryAction` endpoint are vulnerable to SSRF. This vulnerability may lead to credential leaks. Emissary version 7.0 contains a patch. As a workaround, disable network access to Emissary from untrusted sources.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/AddChildDirectoryAction.java; https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/RegisterPeerAction.java; https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-2p8j-2rf3-h4xr
CVE: CVE-2021-23403
Published: 2021-07-02
Description: All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1321
References: https://github.com/BadOPCode/NoDash/blob/master/src/Merge.ts; https://snyk.io/vuln/SNYK-JS-TSNODASH-1311009; https://github.com/BadOPCode/NoDash/blob/master/src/Merge.ts
CVE: CVE-2020-23178
Published: 2021-07-02
Description: An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack and impersonate the victim user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-294
References: https://github.com/PHPFusion/PHPFusion/issues/2314; https://github.com/PHPFusion/PHPFusion/issues/2314
CVE: CVE-2020-23179
Published: 2021-07-02
Description: A stored cross site scripting (XSS) vulnerability in administration/settings_main.php of PHP-Fusion 9.03.50 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Site footer" field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/PHPFusion/PHPFusion/issues/2320; https://github.com/PHPFusion/PHPFusion/issues/2320
CVE: CVE-2020-23181
Published: 2021-07-02
Description: A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Manage Theme" field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/phpfusion/PHPFusion/issues/2326; https://github.com/phpfusion/PHPFusion/issues/2326
CVE: CVE-2020-23182
Published: 2021-07-02
Description: The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites via a crafted payload entered into the Shoutbox message panel.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://github.com/phpfusion/PHPFusion/issues/2329; https://github.com/phpfusion/PHPFusion/issues/2329
CVE: CVE-2020-23184
Published: 2021-07-02
Description: A stored cross site scripting (XSS) vulnerability in /administration/settings_registration.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Registration" field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/phpfusion/PHPFusion/issues/2323; https://github.com/phpfusion/PHPFusion/issues/2323
CVE: CVE-2020-23185
Published: 2021-07-02
Description: A stored cross site scripting (XSS) vulnerability in /administration/setting_security.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/phpfusion/PHPFusion/issues/2331; https://github.com/phpfusion/PHPFusion/issues/2331
CVE: CVE-2020-23190
Published: 2021-07-02
Description: A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/phpList/phplist3/issues/667; https://github.com/phpList/phplist3/issues/667
CVE: CVE-2020-23192
Published: 2021-07-02
Description: A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload in the "admin" parameter under the "Manage administrators" module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/phpList/phplist3/issues/671; https://github.com/phpList/phplist3/issues/671
CVE: CVE-2020-23194
Published: 2021-07-02
Description: A stored cross site scripting (XSS) vulnerability in the "Import Subscribers" feature in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/phpList/phplist3/issues/678; https://github.com/phpList/phplist3/issues/678
CVE: CVE-2020-36395
Published: 2021-07-02
Description: A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LavaLite/cms/issues/321; https://github.com/LavaLite/cms/issues/321
CVE: CVE-2020-36396
Published: 2021-07-02
Description: A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LavaLite/cms/issues/322; https://github.com/LavaLite/cms/issues/322
CVE: CVE-2020-36397
Published: 2021-07-02
Description: A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LavaLite/cms/issues/323; https://github.com/LavaLite/cms/issues/323
CVE: CVE-2020-36398
Published: 2021-07-02
Description: A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "Campaign" field under the "Send a campaign" module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/phpList/phplist3/issues/676; https://github.com/phpList/phplist3/issues/676
CVE: CVE-2020-36399
Published: 2021-07-02
Description: A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "rule1" parameter under the "Bounce Rules" module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/phpList/phplist3/issues/675; https://github.com/phpList/phplist3/issues/675
CVE: CVE-2020-36408
Published: 2021-07-02
Description: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Shortcut" parameter under the "Manage Shortcuts" module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12325; http://dev.cmsmadesimple.org/bug/view/12325
CVE: CVE-2020-36409
Published: 2021-07-02
Description: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Category" parameter under the "Categories" module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12325; http://dev.cmsmadesimple.org/bug/view/12325
CVE: CVE-2020-36410
Published: 2021-07-02
Description: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Email address to receive notification of news submission" parameter under the "Options" module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12325; http://dev.cmsmadesimple.org/bug/view/12325
CVE: CVE-2020-36411
Published: 2021-07-02
Description: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Path for the {page_image} tag:" or "Path for thumbnail field:" parameters under the "Content Editing Settings" module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12325; http://dev.cmsmadesimple.org/bug/view/12325
CVE: CVE-2020-36412
Published: 2021-07-02
Description: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Search Text" field under the "Admin Search" module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12325; http://dev.cmsmadesimple.org/bug/view/12325
CVE: CVE-2020-36413
Published: 2021-07-02
Description: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Exclude these IP addresses from the "Site Down" status" parameter under the "Maintenance Mode" module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12325; http://dev.cmsmadesimple.org/bug/view/12325
CVE: CVE-2020-36414
Published: 2021-07-02
Description: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "URL (slug)" or "Extra" fields under the "Add Article" feature.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12325; http://dev.cmsmadesimple.org/bug/view/12325
CVE: CVE-2020-36415
Published: 2021-07-02
Description: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Stylesheet" parameter under the "Stylesheets" module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12325; http://dev.cmsmadesimple.org/bug/view/12325
CVE: CVE-2020-36416
Published: 2021-07-02
Description: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Design" parameter under the "Designs" module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12325; http://dev.cmsmadesimple.org/bug/view/12325
CVE: CVE-2021-31874
Published: 2021-07-02
Description: Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database application.
CVSS Score: 5.9 (MEDIUM)
References: https://blog.stmcyber.com/vulns/cve-2021-31874/; https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6104-released-with-an-important-security-fixes; https://blog.stmcyber.com/vulns/cve-2021-31874/
CVE: CVE-2021-32737
Published: 2021-07-02
Description: Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-site-scripting) in the collection title. The problem is patched in version 1.6.41. As a workaround, one may manually patch the affected JavaScript files in lieu of updating.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/sulu/sulu/releases/tag/1.6.41; https://github.com/sulu/sulu/security/advisories/GHSA-gm2x-6475-g9r8; https://github.com/sulu/sulu/releases/tag/1.6.41
CVE: CVE-2021-30554
Published: 2021-07-02
Description: Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop_17.html; https://crbug.com/1219857; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30555
Published: 2021-07-02
Description: Use after free in Sharing in Google Chrome prior to 91.0.4472.114 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page and user gesture.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop_17.html; https://crbug.com/1215029; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30556
Published: 2021-07-02
Description: Use after free in WebAudio in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop_17.html; https://crbug.com/1212599; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30557
Published: 2021-07-02
Description: Use after free in TabGroups in Google Chrome prior to 91.0.4472.114 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop_17.html; https://crbug.com/1202102; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/