deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-13321
Published: 2020-02-10
Description: This vulnerability allows network adjacent attackers to execute arbitrary code on affected installations of Xiaomi Browser Prior to 10.4.0. User interaction is required to exploit this vulnerability in that the target must connect to a malicious access point. The specific flaw exists within the handling of HTTP responses to the Captive Portal. A crafted HTML response can cause the Captive Portal to to open a browser to a specified location without user interaction. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-7467.
CVSS Score: 8.0 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.zerodayinitiative.com/advisories/ZDI-19-659/; https://www.zerodayinitiative.com/advisories/ZDI-19-659/
CVE: CVE-2019-13322
Published: 2020-02-10
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Browser Prior to 10.4.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the miui.share application. The issue results from the lack of proper validation of user-supplied data, which can result in an arbitrary application download. An attacker can leverage this vulnerability to execute code in the context of the user. Was ZDI-CAN-7483.
CVSS Score: 8.8 (HIGH)
CWE: CWE-356, CWE-20
References: https://www.zerodayinitiative.com/advisories/ZDI-19-660/; https://www.zerodayinitiative.com/advisories/ZDI-19-660/
CVE: CVE-2019-17060
Published: 2020-02-10
Description: The Bluetooth Low Energy (BLE) stack implementation on the NXP KW41Z (based on the MCUXpresso SDK with Bluetooth Low Energy Driver 2.2.1 and earlier) does not properly restrict the BLE Link Layer header and executes certain memory contents upon receiving a packet with a Link Layer ID (LLID) equal to zero. This allows attackers within radio range to cause deadlocks, cause anomalous behavior in the BLE state machine, or trigger a buffer overflow via a crafted BLE Link Layer frame.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://asset-group.github.io/disclosures/sweyntooth/; https://www.nxp.com/products/wireless/bluetooth-low-energy:BLUETOOTH-LOW-ENERGY-BLE; https://asset-group.github.io/disclosures/sweyntooth/
CVE: CVE-2019-17061
Published: 2020-02-10
Description: The Bluetooth Low Energy (BLE) stack implementation on Cypress PSoC 4 through 3.62 devices does not properly restrict the BLE Link Layer header and executes certain memory contents upon receiving a packet with a Link Layer ID (LLID) equal to zero. This allows attackers within radio range to cause deadlocks, cause anomalous behavior in the BLE state machine, or trigger a buffer overflow via a crafted BLE Link Layer frame.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://asset-group.github.io/disclosures/sweyntooth/; https://community.cypress.com/thread/53680; https://www.cypress.com/products/ble-bluetooth
CVE: CVE-2019-17137
Published: 2020-02-10
Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware version 1.1.0.86 Smart WiFi Router. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of path strings. By inserting a null byte into the path, the user can skip most authentication checks. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-8616.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-626
References: https://www.zerodayinitiative.com/advisories/ZDI-19-866/; https://www.zerodayinitiative.com/advisories/ZDI-19-866/
CVE: CVE-2019-17517
Published: 2020-02-10
Description: The Bluetooth Low Energy implementation on Dialog Semiconductor SDK through 5.0.4 for DA14580/1/2/3 devices does not properly restrict the L2CAP payload length, allowing attackers in radio range to cause a buffer overflow via a crafted Link Layer packet.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://asset-group.github.io/disclosures/sweyntooth/; https://www.dialog-semiconductor.com/products/connectivity/bluetooth-low-energy/smartbond-da14580-and-da14583; https://asset-group.github.io/disclosures/sweyntooth/
CVE: CVE-2019-17518
Published: 2020-02-10
Description: The Bluetooth Low Energy implementation on Dialog Semiconductor SDK through 1.0.14.1081 for DA1468x devices responds to link layer packets with a payload length larger than expected, allowing attackers in radio range to cause a buffer overflow via a crafted packet. This affects, for example, August Smart Lock.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://asset-group.github.io/disclosures/sweyntooth/; https://www.dialog-semiconductor.com/ja/products/connectivity/bluetooth-low-energy/smartbond-da14680-and-da14681; https://asset-group.github.io/disclosures/sweyntooth/
CVE: CVE-2019-17520
Published: 2020-02-10
Description: The Bluetooth Low Energy implementation on Texas Instruments SDK through 3.30.00.20 for CC2640R2 devices does not properly restrict the SM Public Key packet on reception, allowing attackers in radio range to cause a denial of service (crash) via crafted packets.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: http://www.ti.com/tool/LAUNCHXL-CC2640R2; https://asset-group.github.io/disclosures/sweyntooth/; https://www.youtube.com/watch?v=Iw8sIBLWE_w
CVE: CVE-2019-19193
Published: 2020-02-10
Description: The Bluetooth Low Energy peripheral implementation on Texas Instruments SIMPLELINK-CC2640R2-SDK through 3.30.00.20 and BLE-STACK through 1.5.0 before Q4 2019 for CC2640R2 and CC2540/1 devices does not properly restrict the advertisement connection request packet on reception, allowing attackers in radio range to cause a denial of service (crash) via a crafted packet.
CVSS Score: 6.5 (MEDIUM)
References: http://www.ti.com/tool/BLE-STACK; https://asset-group.github.io/disclosures/sweyntooth/; http://www.ti.com/tool/BLE-STACK
CVE: CVE-2019-19195
Published: 2020-02-10
Description: The Bluetooth Low Energy implementation on Microchip Technology BluSDK Smart through 6.2 for ATSAMB11 devices does not properly restrict link-layer data length on reception, allowing attackers in radio range to cause a denial of service (crash) via a crafted packet.
CVSS Score: 6.5 (MEDIUM)
References: https://asset-group.github.io/disclosures/sweyntooth/; https://www.microchip.com/wwwproducts/en/ATSAMB11; https://asset-group.github.io/disclosures/sweyntooth/
CVE: CVE-2019-6744
Published: 2020-02-10
Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of Samsung Knox 1.2.02.39 on Samsung Galaxy S9 build G9600ZHS3ARL1 Secure Folder. An attacker must first obtain physical access to the device in order to exploit this vulnerability. The specific flaws exists within the the handling of the lock screen for Secure Folder. The issue results from the lack of proper validation that a user has correctly authenticated. An attacker can leverage this vulnerability to disclose the contents of the secure container. Was ZDI-CAN-7381.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb; https://www.zerodayinitiative.com/advisories/ZDI-19-515/; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-8840
Published: 2020-02-10
Description: FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200610-01-fastjason-en; https://github.com/FasterXML/jackson-databind/issues/2620; https://lists.apache.org/thread.html/r078e68a926ea6be12e8404e47f45aabf04bb4668e8265c0de41db6db%40%3Ccommits.druid.apache.org%3E
CVE: CVE-2020-8841
Published: 2020-02-10
Description: An issue was discovered in TestLink 1.9.19. The relation_type parameter of the lib/requirements/reqSearch.php endpoint is vulnerable to authenticated SQL Injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/TestLinkOpenSourceTRMS/testlink-code/pull/239; https://github.com/ver007/testlink-1.9.19-sqlinject; https://github.com/TestLinkOpenSourceTRMS/testlink-code/pull/239
CVE: CVE-2013-4267
Published: 2020-02-11
Description: Ajaxeplorer before 5.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) archive_name parameter to the Power FS module (plugins/action.powerfs/class.PowerFSController.php), a (2) file name to the getTrustSizeOnFileSystem function in the File System (Standard) module (plugins/access.fs/class.fsAccessWrapper.php), or the (3) revision parameter to the Subversion Repository module (plugins/meta.svn/class.SvnManager.php).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://www.openwall.com/lists/oss-security/2013/08/21/16; https://github.com/pydio/pydio-core/commit/22a62840e5ac14bb389; https://www.tenable.com/plugins/nessus/70495
CVE: CVE-2013-4268
Published: 2020-02-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-4267. Reason: This issue was MERGED into CVE-2013-4267 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2013-4267 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-4269
Published: 2020-02-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-4267. Reason: This issue was MERGED into CVE-2013-4267 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2013-4267 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-5945
Published: 2020-02-11
Description: Multiple SQL injection vulnerabilities in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware before 1.08B77 allow remote attackers to execute arbitrary SQL commands via the password to (1) the login.authenticate function in share/lua/5.1/teamf1lualib/login.lua or (2) captivePortal.lua.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://tsd.dlink.com.tw/temp/PMD/12879/DSR-500_500N_1000_1000N_A1_Release_Notes_FW_v1.08B77_WW.pdf; http://tsd.dlink.com.tw/temp/PMD/12960/DSR-150N_A2_Release_Notes_FW_v1.05B64_WW.pdf; http://tsd.dlink.com.tw/temp/PMD/12966/DSR-150_A1_A2_Release_Notes_FW_v1.08B44_WW.pdf
CVE: CVE-2016-5710
Published: 2020-02-11
Description: NetApp Snap Creator Framework before 4.3P1 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-1021
References: https://kb.netapp.com/support/s/article/cve-2016-5710-clickjacking-vulnerability-in-snap-creator-framework; https://kb.netapp.com/support/s/article/cve-2016-5710-clickjacking-vulnerability-in-snap-creator-framework
CVE: CVE-2019-14514
Published: 2020-02-11
Description: An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a /system/bin/systemd binary that is run with root privileges on startup (this is unrelated to Red Hat's systemd init program, and is a closed-source proprietary tool that seems to be developed by Microvirt). This program opens TCP port 21509, presumably to receive installation-related commands from the host OS. Because everything after the installer:uninstall command is concatenated directly into a system() call, it is possible to execute arbitrary commands by supplying shell metacharacters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/seqred-s-a/cve-2019-14514; https://github.com/seqred-s-a/cve-2019-14514
CVE: CVE-2020-3933
Published: 2020-02-11
Description: TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, allows attackers to enumerate and exam user account in the system.
CVSS Score: 5.3 (MEDIUM)
References: https://gist.github.com/chtsecurity/4db471b34c3959e5ab9ec31570e4760b; https://www.chtsecurity.com/news/1bb85fcd-9048-4587-b4d3-b18335572bac; https://www.twcert.org.tw/en/cp-139-3317-d4edc-2.html
CVE: CVE-2020-3934
Published: 2020-02-11
Description: TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, contains a vulnerability of Pre-auth SQL Injection, allowing attackers to inject a specific SQL command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/chtsecurity/4db471b34c3959e5ab9ec31570e4760b; https://www.chtsecurity.com/news/1bb85fcd-9048-4587-b4d3-b18335572bac; https://www.twcert.org.tw/en/cp-139-3318-89f76-2.html
CVE: CVE-2020-3935
Published: 2020-02-11
Description: TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cookie, which divulges password to attackers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://gist.github.com/chtsecurity/4db471b34c3959e5ab9ec31570e4760b; https://www.chtsecurity.com/news/1bb85fcd-9048-4587-b4d3-b18335572bac; https://www.twcert.org.tw/en/cp-139-3319-d7b65-2.html
CVE: CVE-2020-5529
Published: 2020-02-11
Description: HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.
CVSS Score: 8.1 (HIGH)
CWE: CWE-665, CWE-94
References: https://github.com/HtmlUnit/htmlunit/releases/tag/2.37.0; https://jvn.jp/en/jp/JVN34535327/; https://lists.apache.org/thread.html/ra2cd7f8e61dc6b8a2d9065094cd1f46aa63ad10f237ee363e26e8563%40%3Ccommits.camel.apache.org%3E
CVE: CVE-2020-7217
Published: 2020-02-11
Description: An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00011.html; https://bugzilla.suse.com/show_bug.cgi?id=1160906; https://github.com/openSUSE/wicked/releases
CVE: CVE-2020-8596
Published: 2020-02-11
Description: participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possible to exfiltrate data and potentially execute code (if certain conditions are met).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://blog.impenetrable.tech/cve-2020-8596; https://wpvulndb.com/vulnerabilities/10068; https://blog.impenetrable.tech/cve-2020-8596
CVE: CVE-2018-14553
Published: 2020-02-11
Description: gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00020.html; https://bugzilla.redhat.com/show_bug.cgi?id=1599032; https://github.com/libgd/libgd/commit/a93eac0e843148dc2d631c3ba80af17e9c8c860f
CVE: CVE-2014-8347
Published: 2020-02-11
Description: An Authentication Bypass vulnerability exists in the MatchPasswordData function in DBEngine.dll in Filemaker Pro 13.03 and Filemaker Pro Advanced 12.04, which could let a malicious user obtain elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://packetstormsecurity.com/files/128853/Filemaker-Login-Bypass-Privilege-Escalation.html; http://www.exploit-db.com/exploits/35077; https://exchange.xforce.ibmcloud.com/vulnerabilities/97780
CVE: CVE-2019-18210
Published: 2020-02-11
Description: Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject JavaScript into the session of another user (e.g., enrolled student or site administrator) via the introeditor[text] parameter. NOTE: the discoverer and vendor disagree on whether Moodle customers have a reasonable expectation that anyone authenticated as a Teacher can be trusted with the ability to add arbitrary JavaScript (this ability is not documented on Moodle's Teacher_role page). Because the vendor has this expectation, they have stated "this report has been closed as a false positive, and not a bug."
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://docs.moodle.org/38/en/Teacher_role; https://gist.github.com/Danbardo/4a6b0fe8cb21ec6d7c54e6ac951bdb0a; https://docs.moodle.org/38/en/Teacher_role
CVE: CVE-2020-6378
Published: 2020-02-11
Description: Use after free in speech in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2020/01/stable-channel-update-for-desktop_16.html; https://crbug.com/1018677; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/
CVE: CVE-2020-6379
Published: 2020-02-11
Description: Use after free in V8 in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2020/01/stable-channel-update-for-desktop_16.html; https://crbug.com/1033407; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/
CVE: CVE-2020-6380
Published: 2020-02-11
Description: Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.130 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted Chrome Extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://chromereleases.googleblog.com/2020/01/stable-channel-update-for-desktop_16.html; https://crbug.com/1032170; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/
CVE: CVE-2020-6381
Published: 2020-02-11
Description: Integer overflow in JavaScript in Google Chrome on ChromeOS and Android prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html; https://access.redhat.com/errata/RHSA-2020:0514
CVE: CVE-2020-6382
Published: 2020-02-11
Description: Type confusion in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html; https://access.redhat.com/errata/RHSA-2020:0514
CVE: CVE-2020-6385
Published: 2020-02-11
Description: Insufficient policy enforcement in storage in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass site isolation via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-754
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html; https://access.redhat.com/errata/RHSA-2020:0514
CVE: CVE-2020-6387
Published: 2020-02-11
Description: Out of bounds write in WebRTC in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted video stream.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html; https://access.redhat.com/errata/RHSA-2020:0514
CVE: CVE-2020-6388
Published: 2020-02-11
Description: Out of bounds access in WebAudio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html; http://packetstormsecurity.com/files/157376/Chrome-AudioArray-Allocate-Data-Race-Out-Of-Bounds-Access.html
CVE: CVE-2020-6389
Published: 2020-02-11
Description: Out of bounds write in WebRTC in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted video stream.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html; https://access.redhat.com/errata/RHSA-2020:0514
CVE: CVE-2020-6390
Published: 2020-02-11
Description: Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html; http://packetstormsecurity.com/files/157419/Chrome-ReadableStream-Close-Out-Of-Bounds-Access.html
CVE: CVE-2020-6391
Published: 2020-02-11
Description: Insufficient validation of untrusted input in Blink in Google Chrome prior to 80.0.3987.87 allowed a local attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html; https://access.redhat.com/errata/RHSA-2020:0514
CVE: CVE-2020-6392
Published: 2020-02-11
Description: Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html; https://access.redhat.com/errata/RHSA-2020:0514
CVE: CVE-2020-6393
Published: 2020-02-11
Description: Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html; https://access.redhat.com/errata/RHSA-2020:0514
CVE: CVE-2020-6394
Published: 2020-02-11
Description: Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 5.4 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html; https://access.redhat.com/errata/RHSA-2020:0514