deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-6310
Published: 2019-11-22
Description: Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://www.openwall.com/lists/oss-security/2014/09/11/6; http://www.securityfocus.com/bid/69727; https://lists.nongnu.org/archive/html/chicken-users/2014-08/msg00055.html
CVE: CVE-2014-6311
Published: 2019-11-22
Description: generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330
References: http://www.openwall.com/lists/oss-security/2014/09/11/5; http://www.openwall.com/lists/oss-security/2014/09/12/6; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=760709
CVE: CVE-2019-16763
Published: 2019-11-22
Description: In Pannellum from 2.5.0 through 2.5.4 URLs were not sanitized for data URIs (or vbscript:), allowing for potential XSS attacks. Such an attack would require a user to click on a hot spot to execute and would require an attacker-provided configuration. The most plausible potential attack would be if pannellum.htm was hosted on a domain that shared cookies with the targeted site's user authentication; an &lt;iframe&gt; could then be embedded on the attacker's site using pannellum.htm from the targeted site, which would allow the attacker to potentially access information from the targeted site as the authenticated user (or worse if the targeted site did not have adequate CSRF protections) if the user clicked on a hot spot in the attacker's embedded panorama viewer. This was patched in version 2.5.5.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/mpetroff/pannellum/commit/cc2f3d99953de59db908e0c6efd1c2c17f7c6914; https://github.com/mpetroff/pannellum/security/advisories/GHSA-m52x-29pq-w3vv; https://github.com/mpetroff/pannellum/commit/cc2f3d99953de59db908e0c6efd1c2c17f7c6914
CVE: CVE-2019-19240
Published: 2019-11-22
Description: Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. The GoAhead WebsRedirect uses a static host buffer that has a limited length and can overflow. This can cause a copy of the Host header to fail, leaving that buffer uninitialized, which may leak uninitialized data in a response.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787, CWE-908
References: https://github.com/embedthis/goahead/issues/289; https://github.com/embedthis/goahead/issues/290; https://github.com/embedthis/goahead/releases/tag/v5.0.1
CVE: CVE-2019-3654
Published: 2019-11-22
Description: Authentication Bypass vulnerability in the Microsoft Windows client in McAfee Client Proxy (MCP) prior to 3.0.0 allows local user to bypass scanning of web traffic and gain access to blocked sites for a short period of time via generating an authorization key on the client which should only be generated by the network administrator.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10305; https://kc.mcafee.com/corporate/index?page=content&id=SB10305
CVE: CVE-2019-13566
Published: 2019-11-22
Description: An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. A buffer overflow allows attackers to cause a denial of service and possibly execute arbitrary code via an IP address with a long hostname.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/ros/ros_comm/issues/1735; https://github.com/ros/ros_comm/issues/1752; https://github.com/ros/ros_comm/pull/1771
CVE: CVE-2019-18622
Published: 2019-11-22
Description: An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BA4DGF7KTQS6WA2DRNJSW66L43WB7LRV/
CVE: CVE-2019-15593
Published: 2019-11-22
Description: GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Comments.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://hackerone.com/reports/557154; https://hackerone.com/reports/557154
CVE: CVE-2019-16285
Published: 2019-11-22
Description: If a local user has been configured and logged in, an unauthenticated attacker with physical access may be able to extract sensitive information onto a local drive.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/156895/HP-ThinPro-6.x-7.x-Information-Disclosure.html; http://seclists.org/fulldisclosure/2020/Mar/30; https://support.hp.com/us-en/document/c06509350
CVE: CVE-2019-16286
Published: 2019-11-22
Description: An attacker may be able to bypass the OS application filter meant to restrict applications that can be executed by changing browser preferences to launch a separate process that in turn can execute arbitrary commands.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://packetstormsecurity.com/files/156898/HP-ThinPro-6.x-7.x-Filter-Bypass.html; http://seclists.org/fulldisclosure/2020/Mar/37; https://support.hp.com/us-en/document/c06509350
CVE: CVE-2019-16287
Published: 2019-11-22
Description: In HP ThinPro Linux 6.2, 6.2.1, 7.0 and 7.1, an attacker may be able to leverage the application filter bypass vulnerability to gain privileged access to create a file on the local file system whose presence puts the device in Administrative Mode, which will allow the attacker to executed commands with elevated privileges.
CVSS Score: 6.8 (MEDIUM)
References: http://packetstormsecurity.com/files/156899/HP-ThinPro-6.x-7.x-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2020/Mar/38; https://support.hp.com/us-en/document/c06509350
CVE: CVE-2019-18909
Published: 2019-11-22
Description: The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with root privileges.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/156907/HP-ThinPro-6.x-7.x-Citrix-Command-Injection.html; http://seclists.org/fulldisclosure/2020/Mar/39; https://support.hp.com/us-en/document/c06509350
CVE: CVE-2019-18910
Published: 2019-11-22
Description: The Citrix Receiver wrapper function does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with local user privileges.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: http://packetstormsecurity.com/files/156909/HP-ThinPro-6.x-7.x-Privileged-Command-Injection.html; http://seclists.org/fulldisclosure/2020/Mar/40; https://support.hp.com/us-en/document/c06509350
CVE: CVE-2019-11291
Published: 2019-11-22
Description: Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://access.redhat.com/errata/RHSA-2020:0553; https://pivotal.io/security/cve-2019-11291; https://access.redhat.com/errata/RHSA-2020:0553
CVE: CVE-2019-11287
Published: 2019-11-23
Description: Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-134
References: https://access.redhat.com/errata/RHSA-2020:0078; https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-11287-DoS%20via%20Heap%20Overflow-RabbitMQ%20Web%20Management%20Plugin; https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html
CVE: CVE-2019-10174
Published: 2019-11-25
Description: A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-470, CWE-470
References: https://access.redhat.com/errata/RHSA-2020:0481; https://access.redhat.com/errata/RHSA-2020:0727; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10174
CVE: CVE-2019-10214
Published: 2019-11-25
Description: The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-522, CWE-522
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10214
CVE: CVE-2019-14815
Published: 2019-11-25
Description: A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marvell Wifi Driver.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://access.redhat.com/errata/RHSA-2020:0174; https://access.redhat.com/errata/RHSA-2020:0328; https://access.redhat.com/errata/RHSA-2020:0339
CVE: CVE-2019-14891
Published: 2019-11-25
Description: A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can result in container management (conmon) processes being killed if a workload process triggers an out-of-memory (OOM) condition for the cgroup. An attacker could abuse this flaw to get host network access on an cri-o host.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-460, CWE-754
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14891; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14891
CVE: CVE-2019-14822
Published: 2019-11-25
Description: A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is using the graphical interface, change the input method engine, or modify other input related configurations of the victim user.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://bugzilla.redhat.com/show_bug.cgi?id=1717958; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14822; https://usn.ubuntu.com/4134-3/
CVE: CVE-2012-5578
Published: 2019-11-25
Description: Python keyring has insecure permissions on new databases allowing world-readable files to be created
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-276
References: http://www.openwall.com/lists/oss-security/2012/11/27/4; https://access.redhat.com/security/cve/cve-2012-5578; https://bugs.launchpad.net/ubuntu/+source/python-keyring/+bug/1031465
CVE: CVE-2012-5518
Published: 2019-11-25
Description: vdsm: certificate generation upon node creation allowing vdsm to start and serve requests from anyone who has a matching key (and certificate)
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2012/11/11/3; https://access.redhat.com/security/cve/cve-2012-5518; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5518
CVE: CVE-2012-5521
Published: 2019-11-25
Description: quagga (ospf6d) 0.99.21 has a DoS flaw in the way the ospf6d daemon performs routes removal
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: http://www.openwall.com/lists/oss-security/2012/11/13/14; http://www.securityfocus.com/bid/56530; https://access.redhat.com/security/cve/cve-2012-5521
CVE: CVE-2012-5527
Published: 2019-11-25
Description: Claws Mail vCalendar plugin: credentials exposed on interface
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2012/11/28/10; http://www.openwall.com/lists/oss-security/2012/11/28/8; http://www.openwall.com/lists/oss-security/2012/11/28/9
CVE: CVE-2012-5535
Published: 2019-11-25
Description: gnome-system-log polkit policy allows arbitrary files on the system to be read
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094059.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094181.html; https://access.redhat.com/security/cve/cve-2012-5535
CVE: CVE-2012-5582
Published: 2019-11-25
Description: opendnssec misuses libcurl API
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2012/11/28/12; http://www.openwall.com/lists/oss-security/2012/11/29/3; http://www.openwall.com/lists/oss-security/2012/11/29/6
CVE: CVE-2012-5617
Published: 2019-11-25
Description: gksu-polkit: permissive PolicyKit policy configuration file allows privilege escalation
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113182.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113218.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099739.html
CVE: CVE-2012-5630
Published: 2019-11-25
Description: libuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-367
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102068.html; https://access.redhat.com/security/cve/cve-2012-5630; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5630
CVE: CVE-2019-10207
Published: 2019-11-25
Description: A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and kernel 5.x.x. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the system to crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10207; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10207
CVE: CVE-2019-18675
Published: 2019-11-25
Description: The Linux kernel through 5.3.13 has a start_offset+size Integer Overflow in cpia2_remap_buffer in drivers/media/usb/cpia2/cpia2_core.c because cpia2 has its own mmap implementation. This allows local users (with /dev/video0 access) to obtain read and write permissions on kernel physical pages, which can possibly result in a privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://deshal3v.github.io/blog/kernel-research/mmap_exploitation; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=be83bbf806822b1b89e0a0f23cd87cddc409e429; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/media/usb/cpia2/cpia2_core.c
CVE: CVE-2012-5631
Published: 2019-11-25
Description: ipa 3.0 does not properly check server identity before sending credential containing cookies
CVSS Score: 8.8 (HIGH)
CWE: CWE-565
References: http://www.securityfocus.com/bid/56919; https://access.redhat.com/security/cve/cve-2012-5631; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5631
CVE: CVE-2012-5640
Published: 2019-11-25
Description: thttpd has a local DoS vulnerability via specially-crafted .htpasswd files
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2012/12/15/1; https://access.redhat.com/security/cve/cve-2012-5640; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5640
CVE: CVE-2012-5644
Published: 2019-11-25
Description: libuser has information disclosure when moving user's home directory
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102068.html; https://access.redhat.com/security/cve/cve-2012-5644; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5644
CVE: CVE-2019-10213
Published: 2019-11-25
Description: OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-117, CWE-532
References: https://access.redhat.com/errata/RHSA-2019:4082; https://access.redhat.com/errata/RHSA-2019:4088; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10213
CVE: CVE-2019-13659
Published: 2019-11-25
Description: IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/868846; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-13660
Published: 2019-11-25
Description: UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page.
CVSS Score: 5.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/882363; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-13661
Published: 2019-11-25
Description: UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/882812; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-13662
Published: 2019-11-25
Description: Insufficient policy enforcement in navigations in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/967780; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-13663
Published: 2019-11-25
Description: IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/863661; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-13664
Published: 2019-11-25
Description: Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/915538; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-13665
Published: 2019-11-25
Description: Insufficient filtering in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass multiple file download protection via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/959640; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-13666
Published: 2019-11-25
Description: Information leak in storage in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 7.4 (HIGH)
CWE: CWE-203
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/960305; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-13667
Published: 2019-11-25
Description: Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/973056; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-13668
Published: 2019-11-25
Description: Insufficient policy enforcement in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 7.4 (HIGH)
CWE: CWE-281
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/986393; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-13669
Published: 2019-11-25
Description: Incorrect data validation in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/968451; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-13670
Published: 2019-11-25
Description: Insufficient data validation in JavaScript in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/980891; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-13671
Published: 2019-11-25
Description: UI spoofing in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof security UI via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/696454; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-13673
Published: 2019-11-25
Description: Insufficient data validation in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 7.4 (HIGH)
CWE: CWE-862
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/997925; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-13674
Published: 2019-11-25
Description: IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/896533; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html