deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-3956
Published: 2020-05-20
Description: VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An authenticated actor may be able to send malicious traffic to VMware Cloud Director which may lead to arbitrary remote code execution. This vulnerability can be exploited through the HTML5- and Flex-based UIs, the API Explorer interface and API access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-917
References: http://packetstormsecurity.com/files/157909/vCloud-Director-9.7.0.15498291-Remote-Code-Execution.html; https://citadelo.com/en/blog/full-infrastructure-takeover-of-vmware-cloud-director-CVE-2020-3956/; https://github.com/aaronsvk/CVE-2020-3956
CVE: CVE-2020-5753
Published: 2020-05-20
Description: Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to ICE Candidate handling before call is answered or declined.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-670
References: https://www.tenable.com/security/research/tra-2020-33; https://www.tenable.com/security/research/tra-2020-33
CVE: CVE-2020-13239
Published: 2020-05-20
Description: The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.dubget.com/stored-xss-via-file-upload.html; https://www.dubget.com/stored-xss-via-file-upload.html
CVE: CVE-2020-13240
Published: 2020-05-20
Description: The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-276, CWE-668
References: https://www.dubget.com/stored-xss-via-file-upload.html; https://www.dubget.com/stored-xss-via-file-upload.html
CVE: CVE-2020-11078
Published: 2020-05-20
Description: In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-93, CWE-74
References: https://github.com/httplib2/httplib2/commit/a1457cc31f3206cf691d11d2bf34e98865873e9e; https://github.com/httplib2/httplib2/security/advisories/GHSA-gg84-qgv9-w4pq; https://lists.apache.org/thread.html/r23711190c2e98152cb6f216b95090d5eeb978543bb7e0bad22ce47fc%40%3Cissues.beam.apache.org%3E
CVE: CVE-2020-13246
Published: 2020-05-20
Description: An issue was discovered in Gitea through 1.11.5. An attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another.
CVSS Score: 7.5 (HIGH)
CWE: CWE-667
References: https://github.com/go-gitea/gitea/issues/10549; https://github.com/go-gitea/gitea/pull/11438; https://www.youtube.com/watch?v=DmVgADSVS88
CVE: CVE-2020-13241
Published: 2020-05-20
Description: Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file extension (used with the Add Image option on the Edit User screen) corresponds to an image file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: https://gist.github.com/virendratiwari03/0af29841fdf27207eb3abc8f28d326f3; https://gist.github.com/virendratiwari03/0af29841fdf27207eb3abc8f28d326f3
CVE: CVE-2020-13249
Published: 2020-05-20
Description: libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00064.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00054.html; https://github.com/mariadb-corporation/mariadb-connector-c/commit/2759b87d72926b7c9b5426437a7c8dd15ff57945
CVE: CVE-2020-9484
Published: 2020-05-20
Description: When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
CVSS Score: 7.0 (HIGH)
CWE: CWE-502
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00057.html; http://packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.html; http://seclists.org/fulldisclosure/2020/Jun/6
CVE: CVE-2020-5364
Published: 2020-05-20
Description: Dell EMC Isilon OneFS versions 8.2.2 and earlier contain an SNMPv2 vulnerability. The SNMPv2 services is enabled, by default, with a pre-configured community string. This community string allows read-only access to many aspects of the Isilon cluster, some of which are considered sensitive and can foster additional access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201, CWE-200
References: https://www.dell.com/support/security/en-us/details/543775/DSA-2020-124-Dell-EMC-Isilon-OneFS-Security-Update-for-Multiple-Vulnerabilities; https://www.dell.com/support/security/en-us/details/543775/DSA-2020-124-Dell-EMC-Isilon-OneFS-Security-Update-for-Multiple-Vulnerabilities
CVE: CVE-2020-5365
Published: 2020-05-20
Description: Dell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability. The pre-configured support account, remotesupport, is bundled in the Dell EMC Isilon OneFS installation. This account is used for diagnostics and other support functions. Although the default password is different for every cluster, it is predictable.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-341, CWE-330
References: https://www.dell.com/support/security/en-us/details/543775/DSA-2020-124-Dell-EMC-Isilon-OneFS-Security-Update-for-Multiple-Vulnerabilities; https://www.dell.com/support/security/en-us/details/543775/DSA-2020-124-Dell-EMC-Isilon-OneFS-Security-Update-for-Multiple-Vulnerabilities
CVE: CVE-2020-12647
Published: 2020-05-21
Description: Unisys ALGOL Compiler 58.1 before 58.1a.15, 59.1 before 59.1a.9, and 60.0 before 60.0a.5 can emit invalid code sequences under rare circumstances related to syntax. The resulting code could, for example, trigger a system fault or adversely affect confidentiality, integrity, and availability.
CVSS Score: 8.8 (HIGH)
References: https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=55; https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=55
CVE: CVE-2020-13252
Published: 2020-05-21
Description: Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.php request) and then visiting the include/views/graphs/graphStatus/displayServiceStatus.php page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://engindemirbilek.github.io/centreon-19.10-rce; https://github.com/EnginDemirbilek/EnginDemirbilek.github.io/blob/master/centreon-19.10-rce.html; https://github.com/centreon/centreon/compare/19.04.13...19.04.15
CVE: CVE-2020-6457
Published: 2020-05-21
Description: Use after free in speech recognizer in Google Chrome prior to 81.0.4044.113 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_15.html; https://crbug.com/1067851; https://www.debian.org/security/2020/dsa-4714
CVE: CVE-2020-6458
Published: 2020-05-21
Description: Out of bounds read and write in PDFium in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-787
References: https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_21.html; https://crbug.com/1067270; https://www.debian.org/security/2020/dsa-4714
CVE: CVE-2020-6459
Published: 2020-05-21
Description: Use after free in payments in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_21.html; https://crbug.com/1065298; https://www.debian.org/security/2020/dsa-4714
CVE: CVE-2020-6460
Published: 2020-05-21
Description: Insufficient data validation in URL formatting in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to perform domain spoofing via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_21.html; https://crbug.com/1063566; https://www.debian.org/security/2020/dsa-4714
CVE: CVE-2020-6461
Published: 2020-05-21
Description: Use after free in storage in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_27.html; https://crbug.com/1072983; https://security.gentoo.org/glsa/202005-13
CVE: CVE-2020-6462
Published: 2020-05-21
Description: Use after free in task scheduling in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_27.html; https://crbug.com/1064891; https://security.gentoo.org/glsa/202005-13
CVE: CVE-2020-6463
Published: 2020-05-21
Description: Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00008.html
CVE: CVE-2020-6464
Published: 2020-05-21
Description: Type confusion in Blink in Google Chrome prior to 81.0.4044.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-843
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00056.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00000.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop.html
CVE: CVE-2020-6465
Published: 2020-05-21
Description: Use after free in reader mode in Google Chrome on Android prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6466
Published: 2020-05-21
Description: Use after free in media in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6467
Published: 2020-05-21
Description: Use after free in WebRTC in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6468
Published: 2020-05-21
Description: Type confusion in V8 in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-843
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6469
Published: 2020-05-21
Description: Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6470
Published: 2020-05-21
Description: Insufficient validation of untrusted input in clipboard in Google Chrome prior to 83.0.4103.61 allowed a local attacker to inject arbitrary scripts or HTML (UXSS) via crafted clipboard contents.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6471
Published: 2020-05-21
Description: Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6472
Published: 2020-05-21
Description: Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory or disk via a crafted Chrome Extension.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6473
Published: 2020-05-21
Description: Insufficient policy enforcement in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-203
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6474
Published: 2020-05-21
Description: Use after free in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6475
Published: 2020-05-21
Description: Incorrect implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6476
Published: 2020-05-21
Description: Insufficient policy enforcement in tab strip in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6477
Published: 2020-05-21
Description: Inappropriate implementation in installer in Google Chrome on OS X prior to 83.0.4103.61 allowed a local attacker to perform privilege escalation via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6478
Published: 2020-05-21
Description: Inappropriate implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6479
Published: 2020-05-21
Description: Inappropriate implementation in sharing in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6480
Published: 2020-05-21
Description: Insufficient policy enforcement in enterprise in Google Chrome prior to 83.0.4103.61 allowed a local attacker to bypass navigation restrictions via UI actions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6481
Published: 2020-05-21
Description: Insufficient policy enforcement in URL formatting in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to perform domain spoofing via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6482
Published: 2020-05-21
Description: Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6483
Published: 2020-05-21
Description: Insufficient policy enforcement in payments in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6484
Published: 2020-05-21
Description: Insufficient data validation in ChromeDriver in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6485
Published: 2020-05-21
Description: Insufficient data validation in media router in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6486
Published: 2020-05-21
Description: Insufficient policy enforcement in navigations in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6487
Published: 2020-05-21
Description: Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6488
Published: 2020-05-21
Description: Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html