deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-32804
Published: 2021-08-03
Description: The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.
CVSS Score: 8.2 (HIGH)
CWE: CWE-22, CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4; https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9
CVE: CVE-2021-33320
Published: 2021-08-03
Description: The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5, does not limit the rate at which content can be flagged as inappropriate, which allows remote authenticated users to spam the site administrator with emails
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://issues.liferay.com/browse/LPE-17007; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747590; https://issues.liferay.com/browse/LPE-17007
CVE: CVE-2021-33321
Published: 2021-08-03
Description: Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true.
CVSS Score: 7.5 (HIGH)
CWE: CWE-640
References: https://help.liferay.com/hc/en-us/articles/[PII_REDACTED]32; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055; https://help.liferay.com/hc/en-us/articles/[PII_REDACTED]32
CVE: CVE-2021-33322
Published: 2021-08-03
Description: In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token.
CVSS Score: 7.5 (HIGH)
CWE: CWE-613
References: https://issues.liferay.com/browse/LPE-16981; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748020; https://issues.liferay.com/browse/LPE-16981
CVE: CVE-2021-33323
Published: 2021-08-03
Description: The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://issues.liferay.com/browse/LPE-17049; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747107; https://issues.liferay.com/browse/LPE-17049
CVE: CVE-2021-33324
Published: 2021-08-03
Description: The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a site's page administration.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: https://issues.liferay.com/browse/LPE-17001; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063; https://issues.liferay.com/browse/LPE-17001
CVE: CVE-2021-33325
Published: 2021-08-03
Description: The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text passwords are stored in the database if workflow is enabled for user creation, which allows attackers with access to the database to obtain a user's password.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-312
References: https://issues.liferay.com/browse/LPE-17042; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748389; https://issues.liferay.com/browse/LPE-17042
CVE: CVE-2021-33326
Published: 2021-08-03
Description: Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a modal window.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://issues.liferay.com/browse/LPE-17093; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747869; https://issues.liferay.com/browse/LPE-17093
CVE: CVE-2021-33327
Published: 2021-08-03
Description: The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibility" is enabled.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: https://issues.liferay.com/browse/LPE-17075; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747840; https://issues.liferay.com/browse/LPE-17075
CVE: CVE-2021-33328
Published: 2021-08-03
Description: Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the (1) _com_liferay_journal_web_portlet_JournalPortlet_name or (2) _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://issues.liferay.com/browse/LPE-17100; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747972; https://issues.liferay.com/browse/LPE-17100
CVE: CVE-2021-33330
Published: 2021-08-03
Description: Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user’s email address and current CSRF token.
CVSS Score: 4.3 (MEDIUM)
References: https://issues.liferay.com/browse/LPE-17127; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720; https://issues.liferay.com/browse/LPE-17127
CVE: CVE-2021-35343
Published: 2021-08-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allows a remote attacker to edit document name without victim's knowledge, by enticing an authenticated user to visit an attacker's web page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://medium.com/%40cyberdivision/cve-2021-35343-c5c298cbb2d4; https://medium.com/%40cyberdivision/cve-2021-35343-c5c298cbb2d4
CVE: CVE-2021-36542
Published: 2021-08-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0.16 allows a remote attacker to lock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://medium.com/%40cyberdivision/cve-2021-36542-a07585497eb8; https://medium.com/%40cyberdivision/cve-2021-36542-a07585497eb8
CVE: CVE-2021-36543
Published: 2021-08-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <6.0.16 allows a remote attacker to unlock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://cyberdivision.medium.com/cve-2021-36543-9622f50c6dc; https://cyberdivision.medium.com/cve-2021-36543-9622f50c6dc
CVE: CVE-2021-36701
Published: 2021-08-03
Description: In htmly version 2.8.1, is vulnerable to an Arbitrary File Deletion on the local host when delete backup files. The vulnerability may allow a remote attacker to delete arbitrary know files on the host.
CVSS Score: 9.1 (CRITICAL)
References: https://github.com/danpros/htmly/issues/481; https://github.com/danpros/htmly/issues/481
CVE: CVE-2021-36702
Published: 2021-08-03
Description: The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send authenticated post-http requests to add / content and inject arbitrary web scripts or HTML through special content.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/danpros/htmly/issues/481; https://github.com/danpros/htmly/issues/481
CVE: CVE-2021-36703
Published: 2021-08-03
Description: The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send an authenticated post HTTP request to admin/config and inject arbitrary web script or HTML through a special website name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/danpros/htmly/issues/481; https://github.com/danpros/htmly/issues/481
CVE: CVE-2021-30565
Published: 2021-08-03
Description: Out of bounds write in Tab Groups in Google Chrome on Linux and ChromeOS prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1210985; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30566
Published: 2021-08-03
Description: Stack buffer overflow in Printing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to potentially exploit stack corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1202661; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30567
Published: 2021-08-03
Description: Use after free in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to open DevTools to potentially exploit heap corruption via specific user gesture.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1211326; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30568
Published: 2021-08-03
Description: Heap buffer overflow in WebGL in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1219886; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30569
Published: 2021-08-03
Description: Use after free in sqlite in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1218707; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30571
Published: 2021-08-03
Description: Insufficient policy enforcement in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-863
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1101897; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30572
Published: 2021-08-03
Description: Use after free in Autofill in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1214234; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30573
Published: 2021-08-03
Description: Use after free in GPU in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1216822; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30574
Published: 2021-08-03
Description: Use after free in protocol handling in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1227315; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30575
Published: 2021-08-03
Description: Out of bounds write in Autofill in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1213313; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30576
Published: 2021-08-03
Description: Use after free in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1194896; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30577
Published: 2021-08-03
Description: Insufficient policy enforcement in Installer in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform local privilege escalation via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1204811; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30578
Published: 2021-08-03
Description: Uninitialized use in Media in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-908
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1201074; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30579
Published: 2021-08-03
Description: Use after free in UI framework in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1207277; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30580
Published: 2021-08-03
Description: Insufficient policy enforcement in Android intents in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious application to obtain potentially sensitive information via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1189092; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30581
Published: 2021-08-03
Description: Use after free in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1194431; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30582
Published: 2021-08-03
Description: Inappropriate implementation in Animation in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1205981; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30583
Published: 2021-08-03
Description: Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1179290; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30584
Published: 2021-08-03
Description: Incorrect security UI in Downloads in Google Chrome on Android prior to 92.0.4515.107 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1213350; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30585
Published: 2021-08-03
Description: Use after free in sensor handling in Google Chrome on Windows prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1023503; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30586
Published: 2021-08-03
Description: Use after free in dialog box handling in Windows in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1201032; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30587
Published: 2021-08-03
Description: Inappropriate implementation in Compositing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1204347; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30588
Published: 2021-08-03
Description: Type confusion in V8 in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1195650; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30589
Published: 2021-08-03
Description: Insufficient validation of untrusted input in Sharing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to bypass navigation restrictions via a crafted click-to-call link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-116
References: https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html; https://crbug.com/1180510; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-33331
Published: 2021-08-03
Description: Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19 and 7.2 before fix pack 8, allows remote attackers to redirect users to arbitrary external URLs via the 'redirect' parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://issues.liferay.com/browse/LPE-17022; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747627; https://issues.liferay.com/browse/LPE-17022