deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-31761
Published: 2021-04-25
Description: Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: http://packetstormsecurity.com/files/163559/Webmin-1.973-Cross-Site-Request-Forgery.html; https://github.com/Mesh3l911/CVE-2021-31761; https://github.com/electronicbots/CVE-2021-31761
CVE: CVE-2021-31762
Published: 2021-04-25
Description: Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users feature, and then get a reverse shell through Webmin's running process feature.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/163492/Webmin-1.973-Cross-Site-Request-Forgery.html; https://github.com/Mesh3l911/CVE-2021-31762; https://github.com/electronicbots/CVE-2021-31762
CVE: CVE-2021-20680
Published: 2021-04-26
Description: Cross-site scripting vulnerability in NEC Aterm devices (Aterm WG1900HP2 firmware Ver.1.3.1 and earlier, Aterm WG1900HP firmware Ver.2.5.1 and earlier, Aterm WG1800HP4 firmware Ver.1.3.1 and earlier, Aterm WG1800HP3 firmware Ver.1.5.1 and earlier, Aterm WG1200HS2 firmware Ver.2.5.0 and earlier, Aterm WG1200HP3 firmware Ver.1.3.1 and earlier, Aterm WG1200HP2 firmware Ver.2.5.0 and earlier, Aterm W1200EX firmware Ver.1.3.1 and earlier, Aterm W1200EX-MS firmware Ver.1.3.1 and earlier, Aterm WG1200HS firmware all versions Aterm WG1200HP firmware all versions Aterm WF800HP firmware all versions Aterm WF300HP2 firmware all versions Aterm WR8165N firmware all versions Aterm W500P firmware all versions, and Aterm W300P firmware all versions) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jpn.nec.com/security-info/secinfo/nv21-008.html; https://jvn.jp/en/jp/JVN67456944/index.html; https://jpn.nec.com/security-info/secinfo/nv21-008.html
CVE: CVE-2021-20693
Published: 2021-04-26
Description: Improper access control vulnerability in Gurunavi App for Android ver.10.0.10 and earlier and for iOS ver.11.1.2 and earlier allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://jvn.jp/en/jp/JVN54025691/index.html; https://jvn.jp/en/jp/JVN54025691/index.html
CVE: CVE-2021-20694
Published: 2021-04-26
Description: Improper access control vulnerability in DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to bypass access restriction and to start a telnet service via unspecified vectors.
CVSS Score: 8.8 (HIGH)
References: https://jvn.jp/en/vu/JVNVU92898656/index.html; https://www.dlink-jp.com/support/release/jvnvu92898656_dap-1880ac.html; https://jvn.jp/en/vu/JVNVU92898656/index.html
CVE: CVE-2021-20695
Published: 2021-04-26
Description: Improper following of a certificate's chain of trust vulnerability in DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to gain root privileges via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-295
References: https://jvn.jp/en/vu/JVNVU92898656/index.html; https://www.dlink-jp.com/support/release/jvnvu92898656_dap-1880ac.html; https://jvn.jp/en/vu/JVNVU92898656/index.html
CVE: CVE-2021-20696
Published: 2021-04-26
Description: DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to execute arbitrary OS commands by sending a specially crafted request to a specific CGI program.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU92898656/index.html; https://www.dlink-jp.com/support/release/jvnvu92898656_dap-1880ac.html; https://jvn.jp/en/vu/JVNVU92898656/index.html
CVE: CVE-2021-20697
Published: 2021-04-26
Description: Missing authentication for critical function in DAP-1880AC firmware version 1.21 and earlier allows a remote attacker to login to the device as an authenticated user without the access privilege via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://jvn.jp/en/vu/JVNVU92898656/index.html; https://www.dlink-jp.com/support/release/jvnvu92898656_dap-1880ac.html; https://jvn.jp/en/vu/JVNVU92898656/index.html
CVE: CVE-2021-20708
Published: 2021-04-26
Description: NEC Aterm devices (Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier) allow authenticated attackers to execute arbitrary OS commands by sending a specially crafted request to a specific URL.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv21-010.html; https://jvn.jp/en/jp/JVN29739718/index.html; https://jpn.nec.com/security-info/secinfo/nv21-010.html
CVE: CVE-2021-20709
Published: 2021-04-26
Description: Improper validation of integrity check value vulnerability in NEC Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier allows an attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to a specific URL.
CVSS Score: 7.2 (HIGH)
CWE: CWE-354
References: https://jpn.nec.com/security-info/secinfo/nv21-010.html; https://jvn.jp/en/jp/JVN29739718/index.html; https://jpn.nec.com/security-info/secinfo/nv21-010.html
CVE: CVE-2021-20710
Published: 2021-04-26
Description: Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.5.1 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jpn.nec.com/security-info/secinfo/nv21-010.html; https://jvn.jp/en/jp/JVN29739718/index.html; https://jpn.nec.com/security-info/secinfo/nv21-010.html
CVE: CVE-2021-20711
Published: 2021-04-26
Description: Aterm WG2600HS firmware Ver1.5.1 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv21-010.html; https://jvn.jp/en/jp/JVN29739718/index.html; https://jpn.nec.com/security-info/secinfo/nv21-010.html
CVE: CVE-2021-20712
Published: 2021-04-26
Description: Improper access control vulnerability in NEC Aterm WG2600HS firmware Ver1.5.1 and earlier, and Aterm WX3000HP firmware Ver1.1.2 and earlier allows a device connected to the LAN side to be accessed from the WAN side due to the defect in the IPv6 firewall function.
CVSS Score: 5.3 (MEDIUM)
References: https://jpn.nec.com/security-info/secinfo/nv21-010.html; https://jvn.jp/en/jp/JVN29739718/index.html; https://jpn.nec.com/security-info/secinfo/nv21-010.html
CVE: CVE-2021-31803
Published: 2021-04-26
Description: cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.cpanel.net/changelogs/94-change-log/; https://docs.cpanel.net/changelogs/94-change-log/
CVE: CVE-2021-31804
Published: 2021-04-26
Description: LeoCAD before 21.03 sometimes allows a use-after-free during the opening of a new document.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/leozide/leocad/issues/645; https://github.com/leozide/leocad/issues/645
CVE: CVE-2021-23365
Published: 2021-04-26
Description: The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-287
References: https://github.com/TykTechnologies/tyk-identity-broker/commit/243092965b0f93a95a14cb882b5b9a3df61dd5c0; https://github.com/TykTechnologies/tyk-identity-broker/commit/46f70420e0911e4e8b638575e29d394c227c75d0; https://github.com/TykTechnologies/tyk-identity-broker/pull/147
CVE: CVE-2021-25927
Published: 2021-04-26
Description: Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://github.com/jessie-codes/safe-flat/commit/4b9b7db976bba8c968354f4315f5f9c219b7cbf3; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25927; https://github.com/jessie-codes/safe-flat/commit/4b9b7db976bba8c968354f4315f5f9c219b7cbf3
CVE: CVE-2021-25928
Published: 2021-04-26
Description: Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://github.com/mantacode/safe-obj/blob/6ab63529182b6cf11704ac84f10800290afd3f9f/lib/index.js#L122; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25928; https://github.com/mantacode/safe-obj/blob/6ab63529182b6cf11704ac84f10800290afd3f9f/lib/index.js#L122
CVE: CVE-2021-26797
Published: 2021-04-26
Description: An access control vulnerability in Hame SD1 Wi-Fi firmware <=V[PII_REDACTED]4640 allows an attacker to get system administrator through an open Telnet service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://le0nc.blogspot.com/2021/04/cve-2021-26797-access-control.html; https://le0nc.blogspot.com/2021/04/cve-2021-26797-access-control.html
CVE: CVE-2021-28079
Published: 2021-04-26
Description: Jamovi <=1.6.18 is affected by a cross-site scripting (XSS) vulnerability. The column-name is vulnerable to XSS in the ElectronJS Framework. An attacker can make a .omv (Jamovi) document containing a payload. When opened by victim, the payload is triggered.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/theart42/cves/blob/master/CVE-2021-28079/CVE-2021-28079.md; https://www.jamovi.org; https://github.com/theart42/cves/blob/master/CVE-2021-28079/CVE-2021-28079.md
CVE: CVE-2021-31802
Published: 2021-04-26
Description: NETGEAR R7000 1.0.11.116 devices have a heap-based Buffer Overflow that is exploitable from the local network without authentication. The vulnerability exists within the handling of an HTTP request. An attacker can leverage this to execute code as root. The problem is that a user-provided length value is trusted during a backup.cgi file upload. The attacker must add a \n before the Content-Length header.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://ssd-disclosure.com/ssd-advisory-netgear-nighthawk-r7000-httpd-preauth-rce/; https://www.netgear.com/about/security/; https://ssd-disclosure.com/ssd-advisory-netgear-nighthawk-r7000-httpd-preauth-rce/
CVE: CVE-2020-15078
Published: 2021-04-26
Description: OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-305, CWE-306
References: https://community.openvpn.net/openvpn/wiki/CVE-2020-15078; https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements; https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html
CVE: CVE-2021-25838
Published: 2021-04-26
Description: The Import function in MintHCM RELEASE 3.0.8 allows an attacker to execute a cross-site scripting (XSS) payload in file-upload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/C1inton/CVE-Record/blob/master/CVE%20Record/%5BCVE-2021-25838%5DMintHCM%203.0.8.md; https://minthcm.org/; https://github.com/C1inton/CVE-Record/blob/master/CVE%20Record/%5BCVE-2021-25838%5DMintHCM%203.0.8.md
CVE: CVE-2021-25839
Published: 2021-04-26
Description: A weak password requirement vulnerability exists in the Create New User function of MintHCM RELEASE 3.0.8, which could lead an attacker to easier password brute-forcing.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://github.com/C1inton/CVE-Record/blob/master/CVE%20Record/%5BCVE-2021-25839%5DMintHCM%203.0.8.md; https://minthcm.org/; https://github.com/C1inton/CVE-Record/blob/master/CVE%20Record/%5BCVE-2021-25839%5DMintHCM%203.0.8.md
CVE: CVE-2021-28399
Published: 2021-04-26
Description: OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/C1inton/CVE-Record/blob/master/CVE%20Record/%5BCVE-2021-28399%5DOrangeHRM%204.7.md; https://www.orangehrm.com/; https://github.com/C1inton/CVE-Record/blob/master/CVE%20Record/%5BCVE-2021-28399%5DOrangeHRM%204.7.md
CVE: CVE-2021-3472
Published: 2021-04-26
Description: A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-191
References: http://www.openwall.com/lists/oss-security/2021/04/13/1; https://bugzilla.redhat.com/show_bug.cgi?id=1944167; https://gitlab.freedesktop.org/xorg/xserver/-/commit/7aaf54a1884f71dc363f0b884e57bcb67407a6cd
CVE: CVE-2021-3494
Published: 2021-04-26
Description: A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if certain conditions are met. The highest threat from this flaw is to system confidentiality. This flaw affects Foreman versions before 2.5.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://bugzilla.redhat.com/show_bug.cgi?id=1948005; https://bugzilla.redhat.com/show_bug.cgi?id=1948005
CVE: CVE-2021-23382
Published: 2021-04-26
Description: The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333
References: https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c1735956; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641; https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640
CVE: CVE-2021-27851
Published: 2021-04-26
Description: A security vulnerability that can lead to local privilege escalation has been found in ’guix-daemon’. It affects multi-user setups in which ’guix-daemon’ runs locally. The attack consists in having an unprivileged user spawn a build process, for instance with `guix build`, that makes its build directory world-writable. The user then creates a hardlink to a root-owned file such as /etc/shadow in that build directory. If the user passed the --keep-failed option and the build eventually fails, the daemon changes ownership of the whole build tree, including the hardlink, to the user. At that point, the user has write access to the target file. Versions after and including v0.11.0-3298-g2608e40988, and versions prior to v1.2.0-75109-g94f0312546 are vulnerable.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264, CWE-59
References: https://bugs.gnu.org/47229; https://guix.gnu.org/en/blog/2021/risk-of-local-privilege-escalation-via-guix-daemon/; https://bugs.gnu.org/47229
CVE: CVE-2020-4562
Published: 2021-04-26
Description: IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by allowing cross-window communication with unrestricted target origin via documentation frames.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183904; https://www.ibm.com/support/pages/node/6446699; https://exchange.xforce.ibmcloud.com/vulnerabilities/183904
CVE: CVE-2021-20432
Published: 2021-04-26
Description: IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 196344.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196344; https://www.ibm.com/support/pages/node/6445733; https://exchange.xforce.ibmcloud.com/vulnerabilities/196344
CVE: CVE-2021-20532
Published: 2021-04-26
Description: IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 could allow a local user to escalate their privileges to take full control of the system due to insecure directory permissions. IBM X-Force ID: 198811.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198811; https://www.ibm.com/support/pages/node/6445503; https://exchange.xforce.ibmcloud.com/vulnerabilities/198811
CVE: CVE-2021-20536
Published: 2021-04-26
Description: IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 198836.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198836; https://www.ibm.com/support/pages/node/6445739; https://exchange.xforce.ibmcloud.com/vulnerabilities/198836
CVE: CVE-2021-20546
Published: 2021-04-26
Description: IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local attacker could overflow a buffer and cause the application to crash. IBM X-Force ID: 198934
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198934; https://www.ibm.com/support/pages/node/6445497; https://exchange.xforce.ibmcloud.com/vulnerabilities/198934
CVE: CVE-2021-21201
Published: 2021-04-26
Description: Use after free in permissions in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html; https://crbug.com/1025683; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21202
Published: 2021-04-26
Description: Use after free in extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.
CVSS Score: 8.6 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html; https://crbug.com/1188889; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21203
Published: 2021-04-26
Description: Use after free in Blink in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html; https://crbug.com/1192054; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21204
Published: 2021-04-26
Description: Use after free in Blink in Google Chrome on OS X prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html; https://crbug.com/1189926; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21205
Published: 2021-04-26
Description: Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 8.1 (HIGH)
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html; https://crbug.com/1165654; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21206
Published: 2021-04-26
Description: Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop.html; https://crbug.com/1196781; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21207
Published: 2021-04-26
Description: Use after free in IndexedDB in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.
CVSS Score: 8.6 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html; https://crbug.com/1185732; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21208
Published: 2021-04-26
Description: Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing via a crafted QR code.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html; https://crbug.com/1039539; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21209
Published: 2021-04-26
Description: Inappropriate implementation in storage in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html; https://crbug.com/1143526; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21210
Published: 2021-04-26
Description: Inappropriate implementation in Network in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially access local UDP ports via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html; https://crbug.com/1184562; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21211
Published: 2021-04-26
Description: Inappropriate implementation in Navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html; https://crbug.com/1103119; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21212
Published: 2021-04-26
Description: Incorrect security UI in Network Config UI in Google Chrome on ChromeOS prior to 90.0.4430.72 allowed a remote attacker to potentially compromise WiFi connection security via a malicious WAP.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html; https://crbug.com/1145024; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/