deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-0570
Published: 2019-01-08
Description: An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka "Windows Runtime Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/106415; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0570; https://www.exploit-db.com/exploits/46184/
CVE: CVE-2019-0571
Published: 2019-01-08
Description: An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers. This CVE ID is unique from CVE-2019-0572, CVE-2019-0573, CVE-2019-0574.
CVSS Score: 7.8 (HIGH)
CWE: CWE-706
References: http://www.securityfocus.com/bid/106426; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0571; https://www.exploit-db.com/exploits/46159/
CVE: CVE-2019-0572
Published: 2019-01-08
Description: An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers. This CVE ID is unique from CVE-2019-0571, CVE-2019-0573, CVE-2019-0574.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://www.securityfocus.com/bid/106428; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0572; https://www.exploit-db.com/exploits/46157/
CVE: CVE-2019-0573
Published: 2019-01-08
Description: An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers. This CVE ID is unique from CVE-2019-0571, CVE-2019-0572, CVE-2019-0574.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: http://www.securityfocus.com/bid/106430; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0573; https://www.exploit-db.com/exploits/46158/
CVE: CVE-2019-0574
Published: 2019-01-08
Description: An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers. This CVE ID is unique from CVE-2019-0571, CVE-2019-0572, CVE-2019-0573.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://www.securityfocus.com/bid/106431; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0574; https://www.exploit-db.com/exploits/46160/
CVE: CVE-2019-0575
Published: 2019-01-08
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/106404; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0575; http://www.securityfocus.com/bid/106404
CVE: CVE-2019-0576
Published: 2019-01-08
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/106422; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0576; http://www.securityfocus.com/bid/106422
CVE: CVE-2019-0577
Published: 2019-01-08
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/106423; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0577; http://www.securityfocus.com/bid/106423
CVE: CVE-2019-0578
Published: 2019-01-08
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/106424; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0578; http://www.securityfocus.com/bid/106424
CVE: CVE-2019-0579
Published: 2019-01-08
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/106425; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0579; http://www.securityfocus.com/bid/106425
CVE: CVE-2019-0580
Published: 2019-01-08
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/106429; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0580; http://www.securityfocus.com/bid/106429
CVE: CVE-2019-0581
Published: 2019-01-08
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/106432; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0581; http://www.securityfocus.com/bid/106432
CVE: CVE-2019-0582
Published: 2019-01-08
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0583, CVE-2019-0584.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/106433; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0582; http://www.securityfocus.com/bid/106433
CVE: CVE-2019-0583
Published: 2019-01-08
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0584.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/106435; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0583; http://www.securityfocus.com/bid/106435
CVE: CVE-2019-0584
Published: 2019-01-08
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/106436; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0584; http://www.securityfocus.com/bid/106436
CVE: CVE-2019-0585
Published: 2019-01-08
Description: A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft Word Remote Code Execution Vulnerability." This affects Word, Microsoft Office, Microsoft Office Word Viewer, Office 365 ProPlus, Microsoft SharePoint, Microsoft Office Online Server, Microsoft Word, Microsoft SharePoint Server.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/106392; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0585; http://www.securityfocus.com/bid/106392
CVE: CVE-2019-0586
Published: 2019-01-08
Description: A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106421; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0586; http://www.securityfocus.com/bid/106421
CVE: CVE-2019-0588
Published: 2019-01-08
Description: An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka "Microsoft Exchange Information Disclosure Vulnerability." This affects Microsoft Exchange Server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: http://www.securityfocus.com/bid/106437; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0588; http://www.securityfocus.com/bid/106437
CVE: CVE-2019-0622
Published: 2019-01-08
Description: An elevation of privilege vulnerability exists when Skype for Andriod fails to properly handle specific authentication requests, aka "Skype for Android Elevation of Privilege Vulnerability." This affects Skype 8.35.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/bid/106465; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0622; http://www.securityfocus.com/bid/106465
CVE: CVE-2019-5716
Published: 2019-01-08
Description: In Wireshark 2.6.0 to 2.6.5, the 6LoWPAN dissector could crash. This was addressed in epan/dissectors/packet-6lowpan.c by avoiding use of a TVB before its creation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/106482; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15217
CVE: CVE-2019-5717
Published: 2019-01-08
Description: In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the P_MUL dissector could crash. This was addressed in epan/dissectors/packet-p_mul.c by rejecting the invalid sequence number of zero.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/106482; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15337
CVE: CVE-2019-5718
Published: 2019-01-08
Description: In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the RTSE dissector and other ASN.1 dissectors could crash. This was addressed in epan/charsets.c by adding a get_t61_string length check.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/106482; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15373
CVE: CVE-2019-5719
Published: 2019-01-08
Description: In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the ISAKMP dissector could crash. This was addressed in epan/dissectors/packet-isakmp.c by properly handling the case of a missing decryption data block.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-327
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15374; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=b5b02f2a9b8772d8814096f86c60a32889d61f2c
CVE: CVE-2019-5721
Published: 2019-01-08
Description: In Wireshark 2.4.0 to 2.4.11, the ENIP dissector could crash. This was addressed in epan/dissectors/packet-enip.c by changing the memory-management approach so that a use-after-free is avoided.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14470; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=1c66174ec7aa19e2ddc79178cf59f15a654fc4fe
CVE: CVE-2019-5725
Published: 2019-01-08
Description: qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/novysodope/Qibosoft-CMS; https://github.com/novysodope/Qibosoft-CMS
CVE: CVE-2018-20674
Published: 2019-01-09
Description: D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A* before v1.21B08Beta, DIR-850L B* before v2.22B03Beta, and DIR-880L A* before v1.20B02Beta devices allow authenticated remote command execution.
CVSS Score: 8.8 (HIGH)
References: https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10101; https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10101
CVE: CVE-2018-20675
Published: 2019-01-09
Description: D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A* before v1.21B08Beta, DIR-850L B* before v2.22B03Beta, and DIR-880L A* before v1.20B02Beta devices allow authentication bypass.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10101; https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10101
CVE: CVE-2016-10735
Published: 2019-01-09
Description: In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/errata/RHBA-2019:1076; https://access.redhat.com/errata/RHBA-2019:1570; https://access.redhat.com/errata/RHSA-2019:1456
CVE: CVE-2018-20676
Published: 2019-01-09
Description: In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/errata/RHBA-2019:1076; https://access.redhat.com/errata/RHBA-2019:1570; https://access.redhat.com/errata/RHSA-2019:1456
CVE: CVE-2018-20677
Published: 2019-01-09
Description: In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/errata/RHBA-2019:1076; https://access.redhat.com/errata/RHBA-2019:1570; https://access.redhat.com/errata/RHSA-2019:1456
CVE: CVE-2019-3581
Published: 2019-01-09
Description: Improper input validation in the proxy component of McAfee Web Gateway 7.8.2.0 and later allows remote attackers to cause a denial of service via a crafted HTTP request parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10264; https://kc.mcafee.com/corporate/index?page=content&id=SB10264
CVE: CVE-2019-0542
Published: 2019-01-09
Description: A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/106434; https://access.redhat.com/errata/RHBA-2019:0959; https://access.redhat.com/errata/RHSA-2019:1422
CVE: CVE-2018-20679
Published: 2019-01-09
Description: An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html; http://seclists.org/fulldisclosure/2019/Sep/7; https://bugs.busybox.net/show_bug.cgi?id=11506
CVE: CVE-2019-5747
Published: 2019-01-09
Description: An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html; http://seclists.org/fulldisclosure/2019/Sep/7; https://bugs.busybox.net/show_bug.cgi?id=11506
CVE: CVE-2018-20680
Published: 2019-01-09
Description: Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/philippe/FrogCMS/issues/22; https://github.com/philippe/FrogCMS/issues/22
CVE: CVE-2019-5748
Published: 2019-01-09
Description: In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://github.com/traccar/traccar/commit/d7f6c53fd[PII_REDACTED]4013649b6807ec53227bf; https://www.traccar.org/blog/; https://github.com/traccar/traccar/commit/d7f6c53fd[PII_REDACTED]4013649b6807ec53227bf
CVE: CVE-2016-10403
Published: 2019-01-09
Description: Insufficient data validation on image data in PDFium in Google Chrome prior to 51.0.2704.63 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2016/05/stable-channel-update_25.html; https://crbug.com/602046; https://chromereleases.googleblog.com/2016/05/stable-channel-update_25.html
CVE: CVE-2016-9651
Published: 2019-01-09
Description: A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2017-15401
Published: 2019-01-09
Description: A memory corruption bug in WebAssembly could lead to out of bounds read and write through V8 in WebAssembly in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-787
References: https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-chrome-os_27.html; https://crbug.com/766260; https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-chrome-os_27.html
CVE: CVE-2017-15402
Published: 2019-01-09
Description: Using an ID that can be controlled by a compromised renderer which allows any frame to overwrite the page_state of any other frame in the same process in Navigation in Google Chrome on Chrome OS prior to 62.0.3202.74 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-chrome-os_27.html; https://crbug.com/766262; https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-chrome-os_27.html
CVE: CVE-2017-15403
Published: 2019-01-09
Description: Insufficient data validation in crosh could lead to a command injection under chronos privileges in Networking in Google Chrome on Chrome OS prior to 61.0.3163.113 allowed a local attacker to execute arbitrary code via a crafted HTML page.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77
References: https://chromereleases.googleblog.com/2017/10/stable-channel-updates-for-chrome-os.html; https://crbug.com/766271; https://chromereleases.googleblog.com/2017/10/stable-channel-updates-for-chrome-os.html