deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-1175
Published: 2022-04-04
Description: Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: http://packetstormsecurity.com/files/166829/Gitlab-14.9-Cross-Site-Scripting.html; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1175.json; https://gitlab.com/gitlab-org/gitlab/-/issues/353370
CVE: CVE-2022-1185
Published: 2022-04-04
Description: A denial of service vulnerability when rendering RDoc files in GitLab CE/EE versions 10 to 14.7.7, 14.8.0 to 14.8.5, and 14.9.0 to 14.9.2 allows an attacker to crash the GitLab web application with a maliciously crafted RDoc file
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1185.json; https://gitlab.com/gitlab-org/gitlab/-/issues/349148; https://hackerone.com/reports/1415071
CVE: CVE-2022-1188
Published: 2022-04-04
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 where a blind SSRF attack through the repository mirroring feature was possible.
CVSS Score: 3.7 (LOW)
CWE: CWE-918
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1188.json; https://gitlab.com/gitlab-org/gitlab/-/issues/354059; https://hackerone.com/reports/1486659
CVE: CVE-2022-1189
Published: 2022-04-04
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.2 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 that allowed for an unauthorised user to read the the approval rules of a private project.
CVSS Score: 3.1 (LOW)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1189.json; https://gitlab.com/gitlab-org/gitlab/-/issues/353718; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1189.json
CVE: CVE-2022-1190
Published: 2022-04-04
Description: Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1190.json; https://gitlab.com/gitlab-org/gitlab/-/issues/352392; https://hackerone.com/reports/1455036
CVE: CVE-2022-1233
Published: 2022-04-04
Description: URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-115, CWE-601
References: https://github.com/medialize/uri.js/commit/88805fd3da03bd7a5e60947adb49d182011f1277; https://huntr.dev/bounties/228d5548-1109-49f8-8aee-91038e88371c; https://github.com/medialize/uri.js/commit/88805fd3da03bd7a5e60947adb49d182011f1277
CVE: CVE-2022-23697
Published: 2022-04-04
Description: A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to resolve this vulnerability in HPE OneView.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04252en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04252en_us
CVE: CVE-2022-23698
Published: 2022-04-04
Description: A remote unauthenticated disclosure of information vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to resolve this vulnerability in HPE OneView.
CVSS Score: 7.5 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04252en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04252en_us
CVE: CVE-2022-23699
Published: 2022-04-04
Description: A local authentication restriction bypass vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to resolve this vulnerability in HPE OneView.
CVSS Score: 7.8 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04252en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04252en_us
CVE: CVE-2022-23700
Published: 2022-04-04
Description: A local unauthorized read access to files vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to resolve this vulnerability in HPE OneView.
CVSS Score: 5.5 (MEDIUM)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04252en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04252en_us
CVE: CVE-2022-25613
Published: 2022-04-04
Description: Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/fv-wordpress-flowplayer/wordpress-fv-flowplayer-video-player-plugin-7-5-18-727-authenticated-persistent-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers; https://patchstack.com/database/vulnerability/fv-wordpress-flowplayer/wordpress-fv-flowplayer-video-player-plugin-7-5-18-727-authenticated-persistent-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-25618
Published: 2022-04-04
Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpDataTables (WordPress plugin) versions <= 2.1.27
CVSS Score: 3.4 (LOW)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/wpdatatables/wordpress-wpdatatables-plugin-2-1-27-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/wpdatatables/#developers; https://patchstack.com/database/vulnerability/wpdatatables/wordpress-wpdatatables-plugin-2-1-27-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-27608
Published: 2022-04-04
Description: Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows is vulnerable to registry key tampering by users with Administrator privileges. This could result in a user disabling anti-tampering mechanisms which would then allow the user to disable Forcepoint One Endpoint and the protection offered by it.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://help.forcepoint.com/security/CVE/CVE-2022-27608.html; https://help.forcepoint.com/security/CVE/CVE-2022-27608.html
CVE: CVE-2022-27609
Published: 2022-04-04
Description: Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows does not provide sufficient anti-tampering protection of services by users with Administrator privileges. This could result in a user disabling Forcepoint One Endpoint and the protection offered by it.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://help.forcepoint.com/security/CVE/CVE-2022-27609.html; https://help.forcepoint.com/security/CVE/CVE-2022-27609.html
CVE: CVE-2022-27649
Published: 2022-04-04
Description: A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276, CWE-276
References: https://bugzilla.redhat.com/show_bug.cgi?id=2066568; https://github.com/containers/podman/commit/aafa80918a245edcbdaceb1191d749570f1872d0; https://github.com/containers/podman/security/advisories/GHSA-qvf8-p83w-v58j
CVE: CVE-2022-27650
Published: 2022-04-04
Description: A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276, CWE-276
References: https://bugzilla.redhat.com/show_bug.cgi?id=2066845; https://github.com/containers/crun/commit/1aeeed2e4fdeffb4875c0d0b[PII_REDACTED]94c8c6; https://github.com/containers/crun/security/advisories/GHSA-wr4f-w546-m398
CVE: CVE-2022-27651
Published: 2022-04-04
Description: A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://bugzilla.redhat.com/show_bug.cgi?id=2066840; https://github.com/containers/buildah/commit/e7e55c988c05dd74005184ceb64f097a0cfe645b; https://github.com/containers/buildah/security/advisories/GHSA-c3g4-w6cv-6v7h
CVE: CVE-2022-27441
Published: 2022-04-04
Description: A stored cross-site scripting (XSS) vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Phone text box.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/happy_source/tpcms/issues/I3YUCJ; https://gitee.com/happy_source/tpcms/issues/I3YUCJ
CVE: CVE-2022-27442
Published: 2022-04-04
Description: TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://gitee.com/happy_source/tpcms/issues/I3YNWY; https://gitee.com/happy_source/tpcms/issues/I3YNWY
CVE: CVE-2022-0603
Published: 2022-04-05
Description: Use after free in File Manager in Google Chrome on Chrome OS prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html; https://crbug.com/1290008; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html
CVE: CVE-2022-0604
Published: 2022-04-05
Description: Heap buffer overflow in Tab Groups in Google Chrome prior to 98.0.4758.102 allowed an attacker who convinced a user to install a malicious extension and engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html; https://crbug.com/1273397; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html
CVE: CVE-2022-0605
Published: 2022-04-05
Description: Use after free in Webstore API in Google Chrome prior to 98.0.4758.102 allowed an attacker who convinced a user to install a malicious extension and convinced a user to enage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html; https://crbug.com/1286940; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html
CVE: CVE-2022-0606
Published: 2022-04-05
Description: Use after free in ANGLE in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html; https://crbug.com/1288020; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html
CVE: CVE-2022-0607
Published: 2022-04-05
Description: Use after free in GPU in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html; https://crbug.com/1250655; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html
CVE: CVE-2022-0608
Published: 2022-04-05
Description: Integer overflow in Mojo in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html; https://crbug.com/1270333; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html
CVE: CVE-2022-0609
Published: 2022-04-05
Description: Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html; https://crbug.com/1296150; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html
CVE: CVE-2022-0610
Published: 2022-04-05
Description: Inappropriate implementation in Gamepad API in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html; https://crbug.com/1285449; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html
CVE: CVE-2022-23732
Published: 2022-04-05
Description: A path traversal vulnerability was identified in GitHub Enterprise Server management console that allowed the bypass of CSRF protections. This could potentially lead to privilege escalation. To exploit this vulnerability, an attacker would need to target a user that was actively logged into the management console. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.5 and was fixed in versions 3.1.19, 3.2.11, 3.3.6, 3.4.1. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 8.8 (HIGH)
CWE: CWE-23, CWE-22
References: https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.19; https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.11; https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.6
CVE: CVE-2021-45894
Published: 2022-04-05
Description: An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is Cleartext Transmission of Sensitive Information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://syss.de; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-066.txt; https://syss.de
CVE: CVE-2022-0452
Published: 2022-04-05
Description: Use after free in Safe Browsing in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html; https://crbug.com/1284584; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html
CVE: CVE-2022-0453
Published: 2022-04-05
Description: Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html; https://crbug.com/1284916; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html
CVE: CVE-2022-0454
Published: 2022-04-05
Description: Heap buffer overflow in ANGLE in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html; https://crbug.com/1287962; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html
CVE: CVE-2022-0455
Published: 2022-04-05
Description: Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 98.0.4758.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1021
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html; https://crbug.com/1270593; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html
CVE: CVE-2022-0456
Published: 2022-04-05
Description: Use after free in Web Search in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via profile destruction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html; https://crbug.com/1289523; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html
CVE: CVE-2022-0457
Published: 2022-04-05
Description: Type confusion in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html; https://crbug.com/1274445; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html
CVE: CVE-2022-0458
Published: 2022-04-05
Description: Use after free in Thumbnail Tab Strip in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html; https://crbug.com/1267060; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html
CVE: CVE-2022-0459
Published: 2022-04-05
Description: Use after free in Screen Capture in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process and convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html; https://crbug.com/1244205; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html
CVE: CVE-2022-0460
Published: 2022-04-05
Description: Use after free in Window Dialogue in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html; https://crbug.com/1250227; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html
CVE: CVE-2022-0461
Published: 2022-04-05
Description: Policy bypass in COOP in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to bypass iframe sandbox via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html; https://crbug.com/1256823; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html
CVE: CVE-2022-0462
Published: 2022-04-05
Description: Inappropriate implementation in Scroll in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html; https://crbug.com/1270470; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html
CVE: CVE-2022-0463
Published: 2022-04-05
Description: Use after free in Accessibility in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html; https://crbug.com/1268240; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html
CVE: CVE-2022-0464
Published: 2022-04-05
Description: Use after free in Accessibility in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html; https://crbug.com/1270095; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html
CVE: CVE-2022-0465
Published: 2022-04-05
Description: Use after free in Extensions in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html; https://crbug.com/1281941; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html
CVE: CVE-2022-0466
Published: 2022-04-05
Description: Inappropriate implementation in Extensions Platform in Google Chrome prior to 98.0.4758.80 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html; https://crbug.com/1115460; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html
CVE: CVE-2022-0467
Published: 2022-04-05
Description: Inappropriate implementation in Pointer Lock in Google Chrome on Windows prior to 98.0.4758.80 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html; https://crbug.com/1239496; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html
CVE: CVE-2022-0468
Published: 2022-04-05
Description: Use after free in Payments in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html; https://crbug.com/1252716; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html
CVE: CVE-2022-0469
Published: 2022-04-05
Description: Use after free in Cast in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific interactions to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html; https://crbug.com/1279531; https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html