deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-16016
Published: 2021-01-08
Description: Inappropriate implementation in base in Google Chrome prior to 86.0.4240.193 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_9.html; https://crbug.com/1146679; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_9.html
CVE: CVE-2020-16017
Published: 2021-01-08
Description: Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html; https://crbug.com/1146709; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html
CVE: CVE-2020-16018
Published: 2021-01-08
Description: Use after free in payments in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1136078; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16019
Published: 2021-01-08
Description: Inappropriate implementation in filesystem in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process to bypass noexec restrictions via a malicious file.
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1139408; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16020
Published: 2021-01-08
Description: Inappropriate implementation in cryptohome in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process to bypass discretionary access control via a malicious file.
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1139411; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16021
Published: 2021-01-08
Description: Race in image burner in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process to perform OS-level privilege escalation via a malicious file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1139414; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16022
Published: 2021-01-08
Description: Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially bypass firewall controls via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1145680; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16023
Published: 2021-01-08
Description: Use after free in WebCodecs in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1146761; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16024
Published: 2021-01-08
Description: Heap buffer overflow in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-787
References: http://packetstormsecurity.com/files/161353/Chrome-SkBitmapOperations-UnPreMultiply-Heap-Buffer-Overflow.html; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1147430
CVE: CVE-2020-16025
Published: 2021-01-08
Description: Heap buffer overflow in clipboard in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-787
References: http://packetstormsecurity.com/files/161354/Chrome-ClipboardWin-WriteBitmap-Heap-Buffer-Overflow.html; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1147431
CVE: CVE-2020-16026
Published: 2021-01-08
Description: Use after free in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1139153; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16027
Published: 2021-01-08
Description: Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from the user's disk via a crafted Chrome Extension.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1116444; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16028
Published: 2021-01-08
Description: Heap buffer overflow in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1138446; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16029
Published: 2021-01-08
Description: Inappropriate implementation in PDFium in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to bypass navigation restrictions via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1134338; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16030
Published: 2021-01-08
Description: Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1141350; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16031
Published: 2021-01-08
Description: Insufficient data validation in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1133183; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16032
Published: 2021-01-08
Description: Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1136714; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16033
Published: 2021-01-08
Description: Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof security UI via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1143057; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16034
Published: 2021-01-08
Description: Inappropriate implementation in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a local attacker to bypass policy restrictions via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1137362; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16035
Published: 2021-01-08
Description: Insufficient data validation in cros-disks in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process to bypass noexec restrictions via a malicious file.
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1139409; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16036
Published: 2021-01-08
Description: Inappropriate implementation in cookies in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to bypass cookie restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/830808; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16037
Published: 2021-01-08
Description: Use after free in clipboard in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-desktop.html; https://crbug.com/1142331; https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-desktop.html
CVE: CVE-2020-16038
Published: 2021-01-08
Description: Use after free in media in Google Chrome on OS X prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-desktop.html; https://crbug.com/1138683; https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-desktop.html
CVE: CVE-2020-16039
Published: 2021-01-08
Description: Use after free in extensions in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-desktop.html; https://crbug.com/1149177; https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-desktop.html
CVE: CVE-2020-16040
Published: 2021-01-08
Description: Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-190, CWE-787
References: http://packetstormsecurity.com/files/162087/Google-Chrome-86.0.4240-V8-Remote-Code-Execution.html; http://packetstormsecurity.com/files/162106/Google-Chrome-86.0.4240-V8-Remote-Code-Execution.html; http://packetstormsecurity.com/files/162144/Google-Chrome-SimplfiedLowering-Integer-Overflow.html
CVE: CVE-2020-16041
Published: 2021-01-08
Description: Out of bounds read in networking in Google Chrome prior to 87.0.4280.88 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: http://packetstormsecurity.com/files/161581/Chrome-DataElement-Out-Of-Bounds-Read.html; https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-desktop.html; https://crbug.com/1151865
CVE: CVE-2020-16042
Published: 2021-01-08
Description: Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-908
References: https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-desktop.html; https://crbug.com/1151890; https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-desktop.html
CVE: CVE-2020-16043
Published: 2021-01-08
Description: Insufficient data validation in networking in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to bypass discretionary access control via malicious network traffic.
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html; https://crbug.com/1148309; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWIJKZTZTG6G475OR6PP4WPQBVM6PS/
CVE: CVE-2020-26186
Published: 2021-01-08
Description: Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite vulnerability. A local attacker with access to system memory may exploit this vulnerability by overwriting the RuntimeServices structure to execute arbitrary code in System Management Mode (SMM).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-642, CWE-668
References: https://www.dell.com/support/kbdoc/en-us/000180645/dsa-2020-247-dell-client-platform-security-update-for-uefi-bios-runtimeservices-overwrite-vulnerability; https://www.dell.com/support/kbdoc/en-us/000180645/dsa-2020-247-dell-client-platform-security-update-for-uefi-bios-runtimeservices-overwrite-vulnerability
CVE: CVE-2020-5017
Published: 2021-01-08
Description: IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow a local user to obtain access to information beyond their intended role and permissions. IBM X-Force ID: 193653.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/193653; https://www.ibm.com/support/pages/node/6398754; https://exchange.xforce.ibmcloud.com/vulnerabilities/193653
CVE: CVE-2020-5018
Published: 2021-01-08
Description: IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may include sensitive information in its URLs increasing the risk of such information being caputured by an attacker. IBM X-Force ID: 193654.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/193654; https://www.ibm.com/support/pages/node/6398754; https://exchange.xforce.ibmcloud.com/vulnerabilities/193654
CVE: CVE-2020-5019
Published: 2021-01-08
Description: IBM Spectrum Protect Plus 10.1.0 through 10.1.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 193655.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/193655; https://www.ibm.com/support/pages/node/6398754; https://exchange.xforce.ibmcloud.com/vulnerabilities/193655
CVE: CVE-2020-5020
Published: 2021-01-08
Description: IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 193656.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/193656; https://www.ibm.com/support/pages/node/6398754; https://exchange.xforce.ibmcloud.com/vulnerabilities/193656
CVE: CVE-2020-5021
Published: 2021-01-08
Description: IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impersonate another user on the system. IBM X-Force ID: 193657.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-384
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/193657; https://www.ibm.com/support/pages/node/6398754; https://exchange.xforce.ibmcloud.com/vulnerabilities/193657
CVE: CVE-2020-5022
Published: 2021-01-08
Description: IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which can result in an attacker obtaining information they are not authorized to access. IBM X-Force ID: 193658.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-862
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/193658; https://www.ibm.com/support/pages/node/6398754; https://exchange.xforce.ibmcloud.com/vulnerabilities/193658
CVE: CVE-2021-21106
Published: 2021-01-08
Description: Use after free in autofill in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html; https://crbug.com/1148749; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWIJKZTZTG6G475OR6PP4WPQBVM6PS/
CVE: CVE-2021-21107
Published: 2021-01-08
Description: Use after free in drag and drop in Google Chrome on Linux prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html; https://crbug.com/1153595; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWIJKZTZTG6G475OR6PP4WPQBVM6PS/
CVE: CVE-2021-21108
Published: 2021-01-08
Description: Use after free in media in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html; https://crbug.com/1155426; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWIJKZTZTG6G475OR6PP4WPQBVM6PS/
CVE: CVE-2021-21109
Published: 2021-01-08
Description: Use after free in payments in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html; https://crbug.com/1152334; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWIJKZTZTG6G475OR6PP4WPQBVM6PS/
CVE: CVE-2021-21110
Published: 2021-01-08
Description: Use after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html; https://crbug.com/1152451; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWIJKZTZTG6G475OR6PP4WPQBVM6PS/
CVE: CVE-2021-21111
Published: 2021-01-08
Description: Insufficient policy enforcement in WebUI in Google Chrome prior to 87.0.4280.141 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-1021
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html; https://crbug.com/1149125; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWIJKZTZTG6G475OR6PP4WPQBVM6PS/
CVE: CVE-2021-21112
Published: 2021-01-08
Description: Use after free in Blink in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html; https://crbug.com/1151298; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWIJKZTZTG6G475OR6PP4WPQBVM6PS/
CVE: CVE-2021-21113
Published: 2021-01-08
Description: Heap buffer overflow in Skia in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html; https://crbug.com/1155178; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWIJKZTZTG6G475OR6PP4WPQBVM6PS/
CVE: CVE-2021-21114
Published: 2021-01-08
Description: Use after free in audio in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html; https://crbug.com/1150065; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWIJKZTZTG6G475OR6PP4WPQBVM6PS/
CVE: CVE-2021-21115
Published: 2021-01-08
Description: User after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html; https://crbug.com/1157814; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWIJKZTZTG6G475OR6PP4WPQBVM6PS/
CVE: CVE-2021-21116
Published: 2021-01-08
Description: Heap buffer overflow in audio in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html; https://crbug.com/1151069; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWIJKZTZTG6G475OR6PP4WPQBVM6PS/
CVE: CVE-2020-4487
Published: 2021-01-08
Description: IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 181862.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181862; https://www.ibm.com/support/pages/node/6398742; https://exchange.xforce.ibmcloud.com/vulnerabilities/181862