deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-4125
Published: 2020-07-20
Description: Using HCL Marketing Operations 9.1.2.4, 10.1.x, 11.1.0.x, a malicious attacker could download files from the RHEL environment by doing some modification in the link, giving the attacker access to confidential information.
CVSS Score: 8.1 (HIGH)
CWE: CWE-494
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080941; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080941
CVE: CVE-2018-21036
Published: 2020-07-21
Description: Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle an empty pathname in a WebSocket request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2020/07/19/1; https://github.com/balderdashy/sails-hook-sockets/commit/0533a4864b1920fd8fbb5287bc0889193c5faf44; https://github.com/balderdashy/sails-hook-sockets/commit/ff02114eaec090ee51db48435cc32d451662606e
CVE: CVE-2020-12432
Published: 2020-07-21
Description: The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtain an API access token, which can be accomplished if the attacker is able to upload a .docx or .odt file. The associated API endpoints for exploitation are /wopi/files and /wopi/getAccessToken.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/d7x/CVE-2020-12432; https://www.youtube.com/watch?v=_tkRnSr6yc0; https://github.com/d7x/CVE-2020-12432
CVE: CVE-2020-12499
Published: 2020-07-21
Description: In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files.
CVSS Score: 8.2 (HIGH)
CWE: CWE-22, CWE-22
References: https://cert.vde.com/en-us/advisories/vde-2020-025; https://cert.vde.com/en-us/advisories/vde-2020-025
CVE: CVE-2020-15866
Published: 2020-07-21
Description: mruby through 2.1.2-rc has a heap-based buffer overflow in the mrb_yield_with_class function in vm.c because of incorrect VM stack handling. It can be triggered via the stack_copy function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/mruby/mruby/issues/5042; https://lists.debian.org/debian-lts-announce/2022/05/msg00006.html; https://github.com/mruby/mruby/issues/5042
CVE: CVE-2020-15859
Published: 2020-07-21
Description: QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.
CVSS Score: 3.3 (LOW)
CWE: CWE-416
References: https://bugs.launchpad.net/qemu/+bug/1886362; https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html; https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE: CVE-2016-7063
Published: 2020-07-21
Description: A flaw was found in pritunl-client before version 1.0.1116.6. Arbitrary write to user specified path may lead to privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/pritunl/pritunl-client-electron/releases/tag/1.0.1116.6; https://github.com/pritunl/pritunl-client-electron/releases/tag/1.0.1116.6%2C; https://lf.lc/CVE-2016-7063.txt
CVE: CVE-2016-7064
Published: 2020-07-21
Description: A flaw was found in pritunl-client before version 1.0.1116.6. A lack of signature verification leads to sensitive information leakage
CVSS Score: 7.5 (HIGH)
CWE: CWE-347, CWE-347
References: https://github.com/pritunl/pritunl-client-electron/releases/tag/1.0.1116.6; https://lf.lc/CVE-2016-7064.txt; https://github.com/pritunl/pritunl-client-electron/releases/tag/1.0.1116.6
CVE: CVE-2020-15873
Published: 2020-07-21
Description: In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php device_id POST parameter to ajax_form.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://community.librenms.org/c/announcements; https://github.com/librenms/librenms/commit/8f3a29cde5bbd8608f9b42923a7d7e2598bcac4e; https://github.com/librenms/librenms/compare/1.65...1.65.1
CVE: CVE-2020-15877
Published: 2020-07-21
Description: An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' => 'admin'" instead of "'middleware' => ['can:admin']" in routes/web.php.
CVSS Score: 8.8 (HIGH)
References: https://community.librenms.org/c/announcements; https://github.com/librenms/librenms/commit/e5bb6d80bc308fc56b9a01ffb76c[PII_REDACTED]3c; https://github.com/librenms/librenms/compare/1.65...1.65.1
CVE: CVE-2020-15879
Published: 2020-07-21
Description: Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses (0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16).
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/bitwarden/server/pull/827; https://github.com/bitwarden/server/pull/827
CVE: CVE-2015-5238
Published: 2020-07-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-3796. Reason: This candidate is a reservation duplicate of CVE-2015-3796. Notes: All CVE users should reference CVE-2015-3796 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-14063
Published: 2020-07-21
Description: A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript via the tccj-content parameter. This is displayed in the page footer of every front-end page and executed in the browser of visitors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/tc-custom-javascript/#developers; https://www.wordfence.com/blog/2020/07/high-severity-vulnerability-patched-in-tc-custom-javascript/; https://wordpress.org/plugins/tc-custom-javascript/#developers
CVE: CVE-2020-15102
Published: 2020-07-21
Description: In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configuration. The problem is fixed in 2.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://github.com/PrestaShop/dashproducts/commit/f0799c13628a9b9ca6ca75c085b083d924a8ea7e; https://github.com/PrestaShop/dashproducts/security/advisories/GHSA-6292-4qpg-hvfg; https://github.com/PrestaShop/dashproducts/commit/f0799c13628a9b9ca6ca75c085b083d924a8ea7e
CVE: CVE-2020-15722
Published: 2020-07-21
Description: In version 12.1.0.1004 and below of 360 Total Security,when TPI calls the browser process, there exists a local privilege escalation vulnerability. An attacker who could exploit DLL hijacking could execute arbitrary code on the Local system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://security.360.cn/News/news/id/232; https://security.360.cn/News/news/id/232
CVE: CVE-2020-15723
Published: 2020-07-21
Description: In the version 12.1.0.1004 and below of 360 Total Security, when the main process of 360 Total Security calls GameChrome.exe, there exists a local privilege escalation vulnerability. An attacker who could exploit DLL hijacking to bypass the hips could execute arbitrary code on the Local system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://security.360.cn/News/news/id/232; https://security.360.cn/News/news/id/232
CVE: CVE-2020-15724
Published: 2020-07-21
Description: In the version 12.1.0.1005 and below of 360 Total Security, when the Gamefolde calls GameChrome.exe, there exists a local privilege escalation vulnerability. An attacker who could exploit DLL hijacking to bypass the hips could execute arbitrary code on the Local system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://security.360.cn/News/news/id/232; https://security.360.cn/News/news/id/232
CVE: CVE-2020-15888
Published: 2020-07-21
Description: Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-416, CWE-787
References: http://lua-users.org/lists/lua-l/2020-07/msg00053.html; http://lua-users.org/lists/lua-l/2020-07/msg00054.html; http://lua-users.org/lists/lua-l/2020-07/msg00071.html
CVE: CVE-2020-15889
Published: 2020-07-21
Description: Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://lua-users.org/lists/lua-l/2020-07/msg00078.html; http://lua-users.org/lists/lua-l/2020-12/msg00157.html; https://github.com/lua/lua/commit/127e7a6c8942b362aa3c6627f44d660a4fb75312
CVE: CVE-2020-15890
Published: 2020-07-21
Description: LuaJit through 2.1.0-beta3 has an out-of-bounds read because __gc handler frame traversal is mishandled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/LuaJIT/LuaJIT/issues/601; https://lists.debian.org/debian-lts-announce/2020/07/msg00026.html; https://usn.ubuntu.com/4501-1/
CVE: CVE-2020-12774
Published: 2020-07-22
Description: D-Link DSL-7740C does not properly validate user input, which allows an authenticated LAN user to inject arbitrary command.
CVSS Score: 8.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.twcert.org.tw/tw/cp-132-3802-27204-1.html; https://www.twcert.org.tw/tw/cp-132-3802-27204-1.html
CVE: CVE-2019-18618
Published: 2020-07-22
Description: Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash (all versions prior to 2019-11-15) allows a local administrator or physical attacker to compromise the confidentiality of sensor data via injection of an unverified partition table.
CVSS Score: 6.0 (MEDIUM)
References: https://support.hp.com/us-en/document/c06696474; https://support.lenovo.com/us/en/product_security/LEN-31372; https://www.synaptics.com/company/blog/
CVE: CVE-2019-18619
Published: 2020-07-22
Description: Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) allows a local user to execute arbitrary code in the enclave (that can compromise confidentiality of enclave data) via APIs that accept invalid pointers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-763
References: https://support.hp.com/hk-en/document/c06696568; https://support.lenovo.com/us/en/product_security/LEN-31372; https://www.synaptics.com/company/blog/
CVE: CVE-2020-8559
Published: 2020-07-22
Description: The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/kubernetes/kubernetes/issues/92914; https://groups.google.com/d/msg/kubernetes-security-announce/JAIGG5yNROs/19nHQ5wkBwAJ; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-16244
Published: 2020-07-22
Description: OMERO.server before 5.6.1 allows attackers to bypass the security filters and access hidden objects via a crafted query.
CVSS Score: 9.8 (CRITICAL)
References: https://www.openmicroscopy.org/security/advisories/2019-SV5/; https://www.openmicroscopy.org/security/advisories/2019-SV5/
CVE: CVE-2020-6505
Published: 2020-07-22
Description: Use after free in speech in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop_15.html; https://crbug.com/1081350; https://security.gentoo.org/glsa/202007-08
CVE: CVE-2020-6506
Published: 2020-07-22
Description: Insufficient policy enforcement in WebView in Google Chrome on Android prior to 83.0.4103.106 allowed a remote attacker to bypass site isolation via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop_15.html; https://crbug.com/1083819; https://lists.apache.org/thread.html/r1ab80f8591d5c[PII_REDACTED]e3945dad1c897513630aabec556883275%40%3Cissues.cordova.apache.org%3E
CVE: CVE-2020-6507
Published: 2020-07-22
Description: Out of bounds write in V8 in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-787
References: http://packetstormsecurity.com/files/162088/Google-Chrome-81.0.4044-V8-Remote-Code-Execution.html; http://packetstormsecurity.com/files/162105/Google-Chrome-81.0.4044-V8-Remote-Code-Execution.html; https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop_15.html
CVE: CVE-2020-6509
Published: 2020-07-22
Description: Use after free in extensions in Google Chrome prior to 83.0.4103.116 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00040.html; https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop_22.html; https://crbug.com/1092308
CVE: CVE-2020-6510
Published: 2020-07-22
Description: Heap buffer overflow in background fetch in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6511
Published: 2020-07-22
Description: Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-209
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6512
Published: 2020-07-22
Description: Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-843
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6513
Published: 2020-07-22
Description: Heap buffer overflow in PDFium in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6514
Published: 2020-07-22
Description: Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap corruption via a crafted SCTP stream.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00008.html
CVE: CVE-2020-6515
Published: 2020-07-22
Description: Use after free in tab strip in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6516
Published: 2020-07-22
Description: Policy bypass in CORS in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6517
Published: 2020-07-22
Description: Heap buffer overflow in history in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6518
Published: 2020-07-22
Description: Use after free in developer tools in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had convinced the user to use developer tools to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6519
Published: 2020-07-22
Description: Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6520
Published: 2020-07-22
Description: Buffer overflow in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6521
Published: 2020-07-22
Description: Side-channel information leakage in autofill in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6522
Published: 2020-07-22
Description: Inappropriate implementation in external protocol handlers in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6523
Published: 2020-07-22
Description: Out of bounds write in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6524
Published: 2020-07-22
Description: Heap buffer overflow in WebAudio in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6525
Published: 2020-07-22
Description: Heap buffer overflow in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6526
Published: 2020-07-22
Description: Inappropriate implementation in iframe sandbox in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6527
Published: 2020-07-22
Description: Insufficient policy enforcement in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6528
Published: 2020-07-22
Description: Incorrect security UI in basic auth in Google Chrome on iOS prior to 84.0.4147.89 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6529
Published: 2020-07-22
Description: Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to leak cross-origin data via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-295
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6530
Published: 2020-07-22
Description: Out of bounds memory access in developer tools in Google Chrome prior to 84.0.4147.89 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html