deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-1793
Published: 2019-12-10
Description: openstack-utils openstack-db has insecure password creation
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://access.redhat.com/security/cve/cve-2013-1793; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1793; https://access.redhat.com/security/cve/cve-2013-1793
CVE: CVE-2013-2095
Published: 2019-12-10
Description: rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injection
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://access.redhat.com/security/cve/cve-2013-2095; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2095; https://access.redhat.com/security/cve/cve-2013-2095
CVE: CVE-2014-3656
Published: 2019-12-10
Description: JBoss KeyCloak: XSS in login-status-iframe.html
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/security/cve/cve-2014-3656; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3656; https://access.redhat.com/security/cve/cve-2014-3656
CVE: CVE-2013-2159
Published: 2019-12-10
Description: Monkey HTTP Daemon: broken user name authentication
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2013/06/07/4; http://www.securityfocus.com/bid/60415; https://exchange.xforce.ibmcloud.com/vulnerabilities/85138
CVE: CVE-2013-2166
Published: 2019-12-10
Description: python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-326
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113944.html; http://rhn.redhat.com/errata/RHSA-2013-0992.html; http://www.openwall.com/lists/oss-security/2013/06/19/5
CVE: CVE-2013-2167
Published: 2019-12-10
Description: python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-345
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113944.html; http://rhn.redhat.com/errata/RHSA-2013-0992.html; http://www.openwall.com/lists/oss-security/2013/06/19/5
CVE: CVE-2013-2183
Published: 2019-12-10
Description: Monkey HTTP Daemon has local security bypass
CVSS Score: 7.1 (HIGH)
CWE: CWE-668
References: http://www.openwall.com/lists/oss-security/2013/06/14/12; http://www.openwall.com/lists/oss-security/2013/06/14/13; https://security-tracker.debian.org/tracker/CVE-2013-2183
CVE: CVE-2013-4120
Published: 2019-12-10
Description: Katello has a Denial of Service vulnerability in API OAuth authentication
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://access.redhat.com/security/cve/cve-2013-4120; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4120; https://access.redhat.com/security/cve/cve-2013-4120
CVE: CVE-2013-4133
Published: 2019-12-10
Description: kde-workspace before 4.10.5 has a memory leak in plasma desktop
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: http://lists.opensuse.org/opensuse-updates/2013-08/msg00002.html; http://www.openwall.com/lists/oss-security/2013/07/16/4; http://www.securityfocus.com/bid/61201
CVE: CVE-2013-4184
Published: 2019-12-10
Description: Perl module Data::UUID from CPAN version 1.219 vulnerable to symlink attacks
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2013/07/31/4; http://www.securityfocus.com/bid/61534; https://access.redhat.com/security/cve/cve-2013-4184
CVE: CVE-2[PII_REDACTED]
Published: 2019-12-10
Description: yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.openwall.com/lists/oss-security/2016/07/18/6; https://github.com/klacke/yaws/commit/9d8fb070e782c95821c90d0ca7372fc6d7316c78#diff-54053c47eb173a90c26ed19bd9d106c1; https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2[PII_REDACTED].json
CVE: CVE-2019-19251
Published: 2019-12-10
Description: The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS. Although there is an Enable SSL option, it is disabled by default, and cleartext requests are made as soon as the app starts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319, CWE-1188
References: https://getsatisfaction.com/lastfm/topics/why-doesnt-the-macos-client-enable-ssl-by-default-c1nh5k1s054ak; https://getsatisfaction.com/lastfm/topics/why-doesnt-the-macos-client-enable-ssl-by-default-c1nh5k1s054ak
CVE: CVE-2019-4095
Published: 2019-12-10
Description: IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158015.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/158015; https://www.ibm.com/support/pages/node/1126605; https://exchange.xforce.ibmcloud.com/vulnerabilities/158015
CVE: CVE-2019-4244
Published: 2019-12-10
Description: IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to gain unauthorized information and unrestricted control over Zookeeper installations due to missing authentication. IBM X-Force ID: 159518.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159518; https://www.ibm.com/support/pages/node/1127523; https://exchange.xforce.ibmcloud.com/vulnerabilities/159518
CVE: CVE-2019-4521
Published: 2019-12-10
Description: Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 165179.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/165179; https://www.ibm.com/support/pages/node/1126605; https://exchange.xforce.ibmcloud.com/vulnerabilities/165179
CVE: CVE-2019-4663
Published: 2019-12-10
Description: IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 171245.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171245; https://www.ibm.com/support/pages/node/1127367; https://exchange.xforce.ibmcloud.com/vulnerabilities/171245
CVE: CVE-2013-1689
Published: 2019-12-10
Description: Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash), related to event handling with frames.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://bugzilla.mozilla.org/show_bug.cgi?id=817219; https://security-tracker.debian.org/tracker/CVE-2013-1689; https://bugzilla.mozilla.org/show_bug.cgi?id=817219
CVE: CVE-2[PII_REDACTED]
Published: 2019-12-10
Description: inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.openwall.com/lists/oss-security/2016/07/18/6; https://bugs.erlang.org/browse/ERL-198; https://httpoxy.org/
CVE: CVE-2019-6183
Published: 2019-12-10
Description: A denial of service vulnerability has been reported in Lenovo Energy Management Driver for Windows 10 versions prior to 15.11.29.7 that could cause systems to experience a blue screen error. Lenovo Energy Management is a client utility. Lenovo XClarity Energy Manager is not affected.
CVSS Score: 7.5 (HIGH)
References: https://support.lenovo.com/solutions/LEN-27682; https://support.lenovo.com/solutions/LEN-27682
CVE: CVE-2019-6192
Published: 2019-12-10
Description: A potential vulnerability has been reported in Lenovo Power Management Driver versions prior to 1.67.17.48 leading to a buffer overflow which could cause a denial of service.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-120
References: http://packetstormsecurity.com/files/155656/Lenovo-Power-Management-Driver-Buffer-Overflow.html; https://support.lenovo.com/solutions/LEN-29334; http://packetstormsecurity.com/files/155656/Lenovo-Power-Management-Driver-Buffer-Overflow.html
CVE: CVE-2012-1577
Published: 2019-12-10
Description: lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-335
References: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libc/stdlib/random.c#rev1.16; http://www.openwall.com/lists/oss-security/2012/03/23/14; https://github.com/ensc/dietlibc/blob/master/CHANGES
CVE: CVE-2012-5620
Published: 2019-12-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2019-19702
Published: 2019-12-10
Description: The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality, such as by referencing the /dev/random file within XML documents that are emailed to the address in the rua field of the DMARC records of a domain.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://github.com/modoboa/modoboa-dmarc/issues/38; https://github.com/modoboa/modoboa-dmarc/issues/38
CVE: CVE-2019-19703
Published: 2019-12-10
Description: In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/ktorio/ktor/issues/1467; https://github.com/ktorio/ktor/issues/1467
CVE: CVE-2019-13672
Published: 2019-12-10
Description: Incorrect security UI in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page on iOS.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/965067; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-17270
Published: 2019-12-10
Description: Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command={COMMAND}" page and parameter, where {COMMAND} will be executed and returning the results to the client. Affects Yachtcontrol webservers disclosed via Dutch GPRS/4G mobile IP-ranges. IP addresses vary due to DHCP client leasing of telco's.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/155582/Yachtcontrol-2019-10-06-Remote-Code-Execution.html; https://www.exploit-db.com/exploits/47760; http://packetstormsecurity.com/files/155582/Yachtcontrol-2019-10-06-Remote-Code-Execution.html
CVE: CVE-2019-5841
Published: 2019-12-10
Description: Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html; https://crbug.com/969588; https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html
CVE: CVE-2019-5843
Published: 2019-12-10
Description: Out of bounds memory access in JavaScript in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html; https://crbug.com/939316; https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html
CVE: CVE-2019-13725
Published: 2019-12-10
Description: Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13726
Published: 2019-12-10
Description: Buffer overflow in password manager in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13727
Published: 2019-12-10
Description: Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-281
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13728
Published: 2019-12-10
Description: Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13729
Published: 2019-12-10
Description: Use-after-free in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13730
Published: 2019-12-10
Description: Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-843
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13732
Published: 2019-12-10
Description: Use-after-free in WebAudio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13734
Published: 2019-12-10
Description: Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13735
Published: 2019-12-10
Description: Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13736
Published: 2019-12-10
Description: Integer overflow in PDFium in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13737
Published: 2019-12-10
Description: Insufficient policy enforcement in autocomplete in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13738
Published: 2019-12-10
Description: Insufficient policy enforcement in navigation in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass site isolation via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13739
Published: 2019-12-10
Description: Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13740
Published: 2019-12-10
Description: Incorrect security UI in sharing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13741
Published: 2019-12-10
Description: Insufficient validation of untrusted input in Blink in Google Chrome prior to 79.0.3945.79 allowed a local attacker to bypass same origin policy via crafted clipboard content.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13742
Published: 2019-12-10
Description: Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13743
Published: 2019-12-10
Description: Incorrect security UI in external protocol handling in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof security UI via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13744
Published: 2019-12-10
Description: Insufficient policy enforcement in cookies in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13745
Published: 2019-12-10
Description: Insufficient policy enforcement in audio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13746
Published: 2019-12-10
Description: Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13747
Published: 2019-12-10
Description: Uninitialized data in rendering in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-908
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13748
Published: 2019-12-10
Description: Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13749
Published: 2019-12-10
Description: Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13750
Published: 2019-12-10
Description: Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13751
Published: 2019-12-10
Description: Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-908
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238