deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-24340
Published: 2021-06-07
Description: The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19c; https://www.wordfence.com/blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/; https://wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19c
CVE: CVE-2021-24342
Published: 2021-06-07
Description: The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/415ca763-fe65-48cb-acd3-b375a400217e; https://wpscan.com/vulnerability/415ca763-fe65-48cb-acd3-b375a400217e
CVE: CVE-2021-24343
Published: 2021-06-07
Description: The iFlyChat WordPress plugin before 4.7.0 does not sanitise its APP ID setting before outputting it back in the page, leading to an authenticated Stored Cross-Site Scripting issue
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/d6c72d90-e321-47b9-957a-6fea7c944293; https://wpscan.com/vulnerability/d6c72d90-e321-47b9-957a-6fea7c944293
CVE: CVE-2021-24344
Published: 2021-06-07
Description: The Easy Preloader WordPress plugin through 1.0.0 does not sanitise its setting fields, leading to authenticated (admin+) Stored Cross-Site scripting issues
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/6d6c1d46-5c3d-4d56-9728-2f94064132aa; https://wpscan.com/vulnerability/6d6c1d46-5c3d-4d56-9728-2f94064132aa
CVE: CVE-2020-36385
Published: 2021-06-07
Description: An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f5449e74802c1112dea984aec8af7a33c4516af1; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-29099
Published: 2021-06-07
Description: A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (not customer datasets). Web Services that use file based data sources (file Geodatabase or Shape Files or tile cached services) are unaffected by this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/security-advisory-e21-03-server-sql/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/security-advisory-e21-03-server-sql/
CVE: CVE-2021-33904
Published: 2021-06-07
Description: In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. NOTE: The vendor states "there are configurable security flags and we are unable to reproduce them with the available information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/163093/Accela-Civic-Platorm-21.1-Cross-Site-Scripting.html; https://gist.github.com/0xx7/3d934939d7122fe23db11bc48eda9d21; http://packetstormsecurity.com/files/163093/Accela-Civic-Platorm-21.1-Cross-Site-Scripting.html
CVE: CVE-2021-22222
Published: 2021-06-07
Description: Infinite loop in DVB-S2-BB dissector in Wireshark 3.4.0 to 3.4.5 allows denial of service via packet injection or crafted capture file
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22222.json; https://gitlab.com/wireshark/wireshark/-/merge_requests/3130; https://security.gentoo.org/glsa/202107-21
CVE: CVE-2020-5008
Published: 2021-06-07
Description: IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 193033.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-922
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/193033; https://www.ibm.com/support/pages/node/6459681; https://exchange.xforce.ibmcloud.com/vulnerabilities/193033
CVE: CVE-2021-20517
Published: 2021-06-07
Description: IBM WebSphere Application Server Network Deployment 8.5 and 9.0 could allow a remote authenticated attacker to traverse directories. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to read and delete arbitrary files on the system. IBM X-Force ID: 198435.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198435; https://www.ibm.com/support/pages/node/6456955; https://exchange.xforce.ibmcloud.com/vulnerabilities/198435
CVE: CVE-2021-20698
Published: 2021-06-07
Description: Sharp NEC Displays (UN462A R1.300 and prior to it, UN462VA R1.300 and prior to it, UN492S R1.300 and prior to it, UN492VS R1.300 and prior to it, UN552A R1.300 and prior to it, UN552S R1.300 and prior to it, UN552VS R1.300 and prior to it, UN552 R1.300 and prior to it, UN552V R1.300 and prior to it, UX552S R1.300 and prior to it, UX552 R1.300 and prior to it, V864Q R2.000 and prior to it, C861Q R2.000 and prior to it, P754Q R2.000 and prior to it, V754Q R2.000 and prior to it, C751Q R2.000 and prior to it, V984Q R2.000 and prior to it, C981Q R2.000 and prior to it, P654Q R2.000 and prior to it, V654Q R2.000 and prior to it, C651Q R2.000 and prior to it, V554Q R2.000 and prior to it, P404 R3.200 and prior to it, P484 R3.200 and prior to it, P554 R3.200 and prior to it, V404 R3.200 and prior to it, V484 R3.200 and prior to it, V554 R3.200 and prior to it, V404-T R3.200 and prior to it, V484-T R3.200 and prior to it, V554-T R3.200 and prior to it, C501 R2.000 and prior to it, C551 R2.000 and prior to it, C431 R2.000 and prior to it) allows an attacker to obtain root privileges and execute remote code by sending unintended parameters that contain specific characters in http request.
CVSS Score: 9.8 (CRITICAL)
References: https://www.sharp-nec-displays.com/global/support/info/A5-1_vulnerability.html; https://www.sharp-nec-displays.com/global/support/info/A5-1_vulnerability.html
CVE: CVE-2021-20699
Published: 2021-06-07
Description: Sharp NEC Displays ((UN462A R1.300 and prior to it, UN462VA R1.300 and prior to it, UN492S R1.300 and prior to it, UN492VS R1.300 and prior to it, UN552A R1.300 and prior to it, UN552S R1.300 and prior to it, UN552VS R1.300 and prior to it, UN552 R1.300 and prior to it, UN552V R1.300 and prior to it, UX552S R1.300 and prior to it, UX552 R1.300 and prior to it, V864Q R2.000 and prior to it, C861Q R2.000 and prior to it, P754Q R2.000 and prior to it, V754Q R2.000 and prior to it, C751Q R2.000 and prior to it, V984Q R2.000 and prior to it, C981Q R2.000 and prior to it, P654Q R2.000 and prior to it, V654Q R2.000 and prior to it, C651Q R2.000 and prior to it, V554Q R2.000 and prior to it, P404 R3.200 and prior to it, P484 R3.200 and prior to it, P554 R3.200 and prior to it, V404 R3.200 and prior to it, V484 R3.200 and prior to it, V554 R3.200 and prior to it, V404-T R3.200 and prior to it, V484-T R3.200 and prior to it, V554-T R3.200 and prior to it, C501 R2.000 and prior to it, C551 R2.000 and prior to it, C431 R2.000 and prior to it) allows an attacker a buffer overflow and to execute remote code by sending long parameters that contains specific characters in http request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-120
References: https://sharp-displays.jp.sharp/global/support/info/A5-1_vulnerability.html; https://www.sharp-nec-displays.com/global/support/info/A5-1_vulnerability.html
CVE: CVE-2020-1719
Published: 2021-06-07
Description: A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before wildfly 20.0.0.Final are affected.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-270
References: https://bugzilla.redhat.com/show_bug.cgi?id=1796617; https://bugzilla.redhat.com/show_bug.cgi?id=1796617
CVE: CVE-2020-18264
Published: 2021-06-07
Description: Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=act_edit_member".
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/github123abc123?tab=projects; https://github.com/github123abc123?tab=projects
CVE: CVE-2020-18265
Published: 2021-06-07
Description: Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=act_add_member".
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/github123abc123/bird/issues/1; https://github.com/github123abc123/bird/issues/1
CVE: CVE-2020-18268
Published: 2021-06-07
Description: Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/zblogcn/zblogphp/issues/209; https://github.com/zblogcn/zblogphp/issues/216; https://github.com/zblogcn/zblogphp/issues/209
CVE: CVE-2021-29621
Published: 2021-06-07
Description: Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version 3.3.0 or higher to resolve.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://github.com/dpgaspar/Flask-AppBuilder/commit/780bd0e8fbf2d36ada52edb769477e0a4edae580; https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-434h-p4gx-jm89; https://lists.apache.org/thread.html/r466759f377651f0a690475d5a52564d0e786e82c08d5a5730a4f8352%40%3Cannounce.apache.org%3E
CVE: CVE-2021-33896
Published: 2021-06-07
Description: Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via URI-encoded path separators.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2021/06/07/2; https://dino.im/blog/; https://dino.im/security/cve-2021-33896/
CVE: CVE-2018-25015
Published: 2021-06-07
Description: An issue was discovered in the Linux kernel before 4.14.16. There is a use-after-free in net/sctp/socket.c for a held lock after a peel off, aka CID-a0ff660058b8.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.16; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a0ff660058b88d12625a783ce9e5c1371c87951f; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-25045
Published: 2021-06-07
Description: An issue was discovered in the Linux kernel before 5.0.19. The XFRM subsystem has a use-after-free, related to an xfrm_state_fini panic, aka CID-dbb2483b2a46.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.19; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dbb2483b2a46fbaf833cfb5deb5ed9cace9c7399; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-1690
Published: 2021-06-07
Description: An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a container from privilege escalation. A non-root attacker in one or more Red Hat OpenStack (RHOSP) containers could send messages to the dbus. With access to the dbus, the attacker could start or stop services, possibly causing a denial of service. Versions before openstack-selinux 0.8.24 are affected.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://bugzilla.redhat.com/show_bug.cgi?id=1789640; https://bugzilla.redhat.com/show_bug.cgi?id=1789640
CVE: CVE-2020-1742
Published: 2021-06-07
Description: An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. Versions before kubernetes-nmstate-handler-container-v2.3.0-30 are affected.
CVSS Score: 7.0 (HIGH)
CWE: CWE-266, CWE-732
References: https://bugzilla.redhat.com/show_bug.cgi?id=1803608; https://bugzilla.redhat.com/show_bug.cgi?id=1803608
CVE: CVE-2020-36386
Published: 2021-06-07
Description: An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.1; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=51c19bf3d5cfaa66571e4b88ba2a6f[PII_REDACTED]; https://sites.google.com/view/syzscope/kasan-slab-out-of-bounds-read-in-hci_extended_inquiry_result_evt
CVE: CVE-2020-36387
Published: 2021-06-07
Description: An issue was discovered in the Linux kernel before 5.8.2. fs/io_uring.c has a use-after-free related to io_async_task_func and ctx reference holding, aka CID-6d816e088c35.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.2; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d816e088c359866f9867057e04f244c608c42fe; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-30521
Published: 2021-06-07
Description: Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1208721; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30522
Published: 2021-06-07
Description: Use after free in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1176218; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30523
Published: 2021-06-07
Description: Use after free in WebRTC in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1187797; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30524
Published: 2021-06-07
Description: Use after free in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1197146; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30525
Published: 2021-06-07
Description: Use after free in TabGroups in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1197888; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30526
Published: 2021-06-07
Description: Out of bounds write in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1198717; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30527
Published: 2021-06-07
Description: Use after free in WebUI in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1199198; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30528
Published: 2021-06-07
Description: Use after free in WebAuthentication in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker who had compromised the renderer process of a user who had saved a credit card in their Google account to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://packetstormsecurity.com/files/172844/Chrome-Sandbox-Escape.html; https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1206329
CVE: CVE-2021-30529
Published: 2021-06-07
Description: Use after free in Bookmarks in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1195278; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30530
Published: 2021-06-07
Description: Out of bounds memory access in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1201033; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30531
Published: 2021-06-07
Description: Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1115628; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30532
Published: 2021-06-07
Description: Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1117687; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30533
Published: 2021-06-07
Description: Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1145553; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30534
Published: 2021-06-07
Description: Insufficient policy enforcement in iFrameSandbox in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1151507; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30535
Published: 2021-06-07
Description: Double free in ICU in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-415
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1194899; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30536
Published: 2021-06-07
Description: Out of bounds read in V8 in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1194358; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30537
Published: 2021-06-07
Description: Insufficient policy enforcement in cookies in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass cookie policy via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/830101; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30538
Published: 2021-06-07
Description: Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1115045; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30539
Published: 2021-06-07
Description: Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/971231; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/