deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-45461
Published: 2021-12-22
Description: FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19.
CVSS Score: 9.8 (CRITICAL)
References: https://community.freepbx.org/t/0-day-freepbx-exploit/80092; https://community.freepbx.org/t/security-issue-potential-rest-phone-apps-rce/80109; https://wiki.freepbx.org/display/FOP/2021-12-21+SECURITY%3A+Potential+Rest+Phone+Apps+RCE
CVE: CVE-2021-43853
Published: 2021-12-22
Description: Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation when parsing json input. Releases before version 21.12.22.1 are affected. A workaround exists that replaces one of the core JavaScript files embedded in the library. See the GHSA-5q7q-qqw2-hjq7 for workaround details.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79, CWE-502
References: https://github.com/michaelschwarz/Ajax.NET-Professional/commit/c89e39b9679fcb8ab6644fe21cc7e652cb615e2b; https://github.com/michaelschwarz/Ajax.NET-Professional/releases/tag/v21.12.22.1; https://github.com/michaelschwarz/Ajax.NET-Professional/security/advisories/GHSA-5q7q-qqw2-hjq7
CVE: CVE-2020-20425
Published: 2021-12-22
Description: S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in the search function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://government.com; https://github.com/Sea0o/vulnerability/issues/1; https://www.s-cms.cn/
CVE: CVE-2020-20426
Published: 2021-12-22
Description: S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in /function/booksave.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://government.com; https://github.com/Sea0o/vulnerability/issues/2; https://www.s-cms.cn/
CVE: CVE-2020-20593
Published: 2021-12-22
Description: A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrator account.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: http://www.rockoa.com/view_demo.html; https://github.com/alixiaowei/alixiaowei.github.io/issues/1; http://www.rockoa.com/view_demo.html
CVE: CVE-2020-20595
Published: 2021-12-22
Description: A cross-site request forgery (CSRF) in OPMS v1.3 and below allows attackers to arbitrarily add a user account via /user/add.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/lock-upme/OPMS/issues/25; https://github.com/lock-upme/OPMS/issues/25
CVE: CVE-2020-20597
Published: 2021-12-22
Description: A cross-site scripting (XSS) vulnerability in the potrtalItemName parameter in \web\PortalController.java of lemon V1.10.0 allows attackers to execute arbitrary web scripts or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xuhuisheng/lemon/issues/198; https://github.com/xuhuisheng/lemon/issues/198
CVE: CVE-2020-20598
Published: 2021-12-22
Description: A cross-site scripting (XSS) vulnerability in the Editing component of lemon V1.10.0 allows attackers to execute arbitrary web scripts or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xuhuisheng/lemon/issues/199; https://github.com/xuhuisheng/lemon/issues/199
CVE: CVE-2020-20600
Published: 2021-12-22
Description: MetInfo 7.0 beta contains a stored cross-site scripting (XSS) vulnerability in the $name parameter of admin/?n=column&c=index&a=doAddColumn.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/alixiaowei/cve_test/issues/2; https://github.com/alixiaowei/cve_test/issues/2
CVE: CVE-2020-20601
Published: 2021-12-22
Description: An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://blog.riskivy.com/thinkcmf-%e6%a1%86%e6%9e%b6%e4%b8%8a%e7%9a%84%e4%bb%bb%e6%84%8f%e5%86%85%e5%ae%b9%e5%8c%85%e5%90%ab%e6%bc%8f%e6%b4%9e/; https://blog.riskivy.com/thinkcmf-%e6%a1%86%e6%9e%b6%e4%b8%8a%e7%9a%84%e4%bb%bb%e6%84%8f%e5%86%85%e5%ae%b9%e5%8c%85%e5%90%ab%e6%bc%8f%e6%b4%9e/
CVE: CVE-2020-20605
Published: 2021-12-22
Description: Blog CMS v1.0 contains a cross-site scripting (XSS) vulnerability in the /controller/CommentAdminController.java component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xuzijia/blog/issues/4; https://github.com/xuzijia/blog/issues/4
CVE: CVE-2021-38005
Published: 2021-12-23
Description: Use after free in loader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/1241091; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-38006
Published: 2021-12-23
Description: Use after free in storage foundation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/1240593; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-38007
Published: 2021-12-23
Description: Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/1254189; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-38008
Published: 2021-12-23
Description: Use after free in media in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/1263620; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-38009
Published: 2021-12-23
Description: Inappropriate implementation in cache in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-203
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/1260649; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-38010
Published: 2021-12-23
Description: Inappropriate implementation in service workers in Google Chrome prior to 96.0.4664.45 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/1264477; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-38011
Published: 2021-12-23
Description: Use after free in storage foundation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/1268274; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-38012
Published: 2021-12-23
Description: Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/1262791; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-38013
Published: 2021-12-23
Description: Heap buffer overflow in fingerprint recognition in Google Chrome on ChromeOS prior to 96.0.4664.45 allowed a remote attacker who had compromised a WebUI renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/1242392; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-38014
Published: 2021-12-23
Description: Out of bounds write in Swiftshader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/1248567; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-38015
Published: 2021-12-23
Description: Inappropriate implementation in input in Google Chrome prior to 96.0.4664.45 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/957553; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-38016
Published: 2021-12-23
Description: Insufficient policy enforcement in background fetch in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/1244289; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-38017
Published: 2021-12-23
Description: Insufficient policy enforcement in iframe sandbox in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/1256822; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-38018
Published: 2021-12-23
Description: Inappropriate implementation in navigation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/1197889; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-38019
Published: 2021-12-23
Description: Insufficient policy enforcement in CORS in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-670
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/1251179; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-38020
Published: 2021-12-23
Description: Insufficient policy enforcement in contacts picker in Google Chrome on Android prior to 96.0.4664.45 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/1259694; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-38021
Published: 2021-12-23
Description: Inappropriate implementation in referrer in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/1233375; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-38022
Published: 2021-12-23
Description: Inappropriate implementation in WebAuthentication in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html; https://crbug.com/1248862; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-4052
Published: 2021-12-23
Description: Use after free in web apps in Google Chrome prior to 96.0.4664.93 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1267661; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-4053
Published: 2021-12-23
Description: Use after free in UI in Google Chrome on Linux prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1267791; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-4054
Published: 2021-12-23
Description: Incorrect security UI in autofill in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1239760; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-4055
Published: 2021-12-23
Description: Heap buffer overflow in extensions in Google Chrome prior to 96.0.4664.93 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1266510; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-4056
Published: 2021-12-23
Description: Type confusion in loader in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1260939; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-4057
Published: 2021-12-23
Description: Use after free in file API in Google Chrome prior to 96.0.4664.93 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://packetstormsecurity.com/files/165486/Chrome-storage-BlobURLStoreImpl-Revoke-Heap-Use-After-Free.html; https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1262183
CVE: CVE-2021-4058
Published: 2021-12-23
Description: Heap buffer overflow in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1267496; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-4059
Published: 2021-12-23
Description: Insufficient data validation in loader in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1270990; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-4061
Published: 2021-12-23
Description: Type confusion in V8 in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1271456; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-4062
Published: 2021-12-23
Description: Heap buffer overflow in BFCache in Google Chrome prior to 96.0.4664.93 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1272403; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-4063
Published: 2021-12-23
Description: Use after free in developer tools in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1273176; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-4064
Published: 2021-12-23
Description: Use after free in screen capture in Google Chrome on ChromeOS prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1273197; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-4065
Published: 2021-12-23
Description: Use after free in autofill in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1273674; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-4066
Published: 2021-12-23
Description: Integer underflow in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-191
References: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1274499; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-4067
Published: 2021-12-23
Description: Use after free in window manager in Google Chrome on ChromeOS prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1274641; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-4068
Published: 2021-12-23
Description: Insufficient data validation in new tab page in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-116
References: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1265197; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
CVE: CVE-2021-4078
Published: 2021-12-23
Description: Type confusion in V8 in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1268738; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2021-4079
Published: 2021-12-23
Description: Out of bounds write in WebRTC in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via crafted WebRTC packets.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html; https://crbug.com/1265806; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2021-20049
Published: 2021-12-23
Description: A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-204, CWE-203
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0030; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0030
CVE: CVE-2021-20050
Published: 2021-12-23
Description: An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0031; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0031
CVE: CVE-2021-45462
Published: 2021-12-23
Description: In Open5GS 2.4.0, a crafted packet from UE can crash SGW-U/UPF.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1284
References: https://github.com/open5gs/open5gs/commit/a0f2535cb5a29bba6dbbccdb90c74ccd770cc700; https://www.trendmicro.com/en_us/research/23/i/attacks-on-5g-infrastructure-from-users-devices.html; https://github.com/open5gs/open5gs/commit/a0f2535cb5a29bba6dbbccdb90c74ccd770cc700