deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-13452
Published: 2021-01-07
Description: In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg) potentially allow an attacker to overwrite the file, which can lead to denial of service or code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: http://packetstormsecurity.com/files/160744/Gotenberg-6.2.0-Traversal-Code-Execution-Insecure-Permissions.html; https://github.com/thecodingmachine/gotenberg/issues/199; http://packetstormsecurity.com/files/160744/Gotenberg-6.2.0-Traversal-Code-Execution-Insecure-Permissions.html
CVE: CVE-2020-36048
Published: 2021-01-08
Description: Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://blog.caller.xyz/socketio-engineio-dos/; https://github.com/bcaller/kill-engine-io; https://github.com/socketio/engine.io/commit/734f9d[PII_REDACTED]c41219e69eb58318e0b2ac6b
CVE: CVE-2020-36049
Published: 2021-01-08
Description: socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://blog.caller.xyz/socketio-engineio-dos/; https://github.com/bcaller/kill-engine-io; https://github.com/socketio/socket.io-parser/commit/dcb942d24db97162ad16a67c2a0cf30875342d55
CVE: CVE-2021-1051
Published: 2021-01-08
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which a local user can get elevated privileges to modify display configuration data, which may result in denial of service of the display.
CVSS Score: 8.4 (HIGH)
CWE: CWE-269
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5142; https://nvidia.custhelp.com/app/answers/detail/a_id/5142
CVE: CVE-2021-1052
Published: 2021-01-08
Description: NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape or IOCTL in which user-mode clients can access legacy privileged APIs, which may lead to denial of service, escalation of privileges, and information disclosure.
CVSS Score: 7.8 (HIGH)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5142; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5142
CVE: CVE-2021-1053
Published: 2021-01-08
Description: NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape or IOCTL in which improper validation of a user pointer may lead to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5142; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5142
CVE: CVE-2021-1054
Published: 2021-01-08
Description: NVIDIA GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action, which may lead to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5142; https://nvidia.custhelp.com/app/answers/detail/a_id/5142
CVE: CVE-2021-1055
Published: 2021-01-08
Description: NVIDIA GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which improper access control may lead to denial of service and information disclosure.
CVSS Score: 5.3 (MEDIUM)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5142; https://nvidia.custhelp.com/app/answers/detail/a_id/5142
CVE: CVE-2021-1056
Published: 2021-01-08
Description: NVIDIA GPU Display Driver for Linux, all versions, contains a vulnerability in the kernel mode layer (nvidia.ko) in which it does not completely honor operating system file system permissions to provide GPU device-level isolation, which may lead to denial of service or information disclosure.
CVSS Score: 7.1 (HIGH)
CWE: CWE-276
References: https://lists.debian.org/debian-lts-announce/2022/01/msg00013.html; https://nvidia.custhelp.com/app/answers/detail/a_id/5142; https://security.gentoo.org/glsa/202310-02
CVE: CVE-2020-24577
Published: 2021-01-08
Description: An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The One Touch application discloses sensitive information, such as the hashed admin login password and the Internet provider connection username and cleartext password, in the application's response body for a /tmp/var/passwd or /tmp/home/wan_stat URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28241
CVE: CVE-2020-25950
Published: 2021-01-08
Description: Advanced Webhost Billing System 3.7.0 is affected by Cross Site Request Forgery (CSRF) attacks that can delete a contact from the My Additional Contact page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/49369; https://www.exploit-db.com/exploits/49369
CVE: CVE-2021-3025
Published: 2021-01-08
Description: Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir parameter in a sortBy=popular action to the GETindex() method in applications/downloads/api/files.php).
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/160830/IPS-Community-Suite-4.5.4-SQL-Injection.html; https://invisioncommunity.com/release-notes/; http://packetstormsecurity.com/files/160830/IPS-Community-Suite-4.5.4-SQL-Injection.html
CVE: CVE-2020-28468
Published: 2021-01-08
Description: This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code execution.
CVSS Score: 8.1 (HIGH)
CWE: CWE-74
References: https://github.com/Gallopsled/pwntools/issues/1427; https://github.com/Gallopsled/pwntools/pull/1732; https://snyk.io/vuln/SNYK-PYTHON-PWNTOOLS-1047345
CVE: CVE-2020-7784
Published: 2021-01-08
Description: This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js. The vulnerability is demonstrated with the following PoC:
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://snyk.io/vuln/SNYK-JS-TSPROCESSPROMISES-1048334; https://snyk.io/vuln/SNYK-JS-TSPROCESSPROMISES-1048334
CVE: CVE-2020-7794
Published: 2021-01-08
Description: This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function install(requestedModule).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://snyk.io/vuln/SNYK-JS-BUNS-1050389; https://snyk.io/vuln/SNYK-JS-BUNS-1050389
CVE: CVE-2020-4606
Published: 2021-01-08
Description: IBM Security Verify Privilege Manager 10.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A local attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 184883.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184883; https://www.ibm.com/support/pages/node/6398602; https://exchange.xforce.ibmcloud.com/vulnerabilities/184883
CVE: CVE-2020-4663
Published: 2021-01-08
Description: IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186234.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186234; https://www.ibm.com/support/pages/node/6398724; https://exchange.xforce.ibmcloud.com/vulnerabilities/186234
CVE: CVE-2020-4664
Published: 2021-01-08
Description: IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186235.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186235; https://www.ibm.com/support/pages/node/6398724; https://exchange.xforce.ibmcloud.com/vulnerabilities/186235
CVE: CVE-2020-4666
Published: 2021-01-08
Description: IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186281.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186281; https://www.ibm.com/support/pages/node/6398724; https://exchange.xforce.ibmcloud.com/vulnerabilities/186281
CVE: CVE-2020-4667
Published: 2021-01-08
Description: IBM Engineering Requirements Quality Assistant On-Premises could allow an authenticated user to obtain sensitive information due to improper input validation. IBM X-Force ID: 186282.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186282; https://www.ibm.com/support/pages/node/6398724; https://exchange.xforce.ibmcloud.com/vulnerabilities/186282
CVE: CVE-2021-1057
Published: 2021-01-08
Description: NVIDIA Virtual GPU Manager NVIDIA vGPU manager contains a vulnerability in the vGPU plugin in which it allows guests to allocate some resources for which the guest is not authorized, which may lead to integrity and confidentiality loss, denial of service, or information disclosure. This affects vGPU version 8.x (prior to 8.6) and version 11.0 (prior to 11.3).
CVSS Score: 7.8 (HIGH)
CWE: CWE-770
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5142; https://nvidia.custhelp.com/app/answers/detail/a_id/5142
CVE: CVE-2021-1058
Published: 2021-01-08
Description: NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and vGPU plugin, in which an input data size is not validated, which may lead to tampering of data or denial of service. This affects vGPU version 8.x (prior to 8.6) and version 11.0 (prior to 11.3).
CVSS Score: 7.1 (HIGH)
CWE: CWE-1284
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5142; https://nvidia.custhelp.com/app/answers/detail/a_id/5142
CVE: CVE-2021-1059
Published: 2021-01-08
Description: NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input index is not validated, which may lead to integer overflow, which in turn may cause tampering of data, information disclosure, or denial of service. This affects vGPU version 8.x (prior to 8.6) and version 11.0 (prior to 11.3).
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5142; https://nvidia.custhelp.com/app/answers/detail/a_id/5142
CVE: CVE-2021-1060
Published: 2021-01-08
Description: NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and vGPU plugin, in which an input index is not validated, which may lead to tampering of data or denial of service. This affects vGPU version 8.x (prior to 8.6) and version 11.0 (prior to 11.3).
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5142; https://nvidia.custhelp.com/app/answers/detail/a_id/5142
CVE: CVE-2021-1061
Published: 2021-01-08
Description: NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which a race condition may cause the vGPU plugin to continue using a previously validated resource that has since changed, which may lead to denial of service or information disclosure. This affects vGPU version 8.x (prior to 8.6) and version 11.0 (prior to 11.3).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-362
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5142; https://nvidia.custhelp.com/app/answers/detail/a_id/5142
CVE: CVE-2021-1062
Published: 2021-01-08
Description: NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input data length is not validated, which may lead to tampering of data or denial of service. This affects vGPU version 8.x (prior to 8.6) and version 11.0 (prior to 11.3).
CVSS Score: 7.1 (HIGH)
CWE: CWE-1284
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5142; https://nvidia.custhelp.com/app/answers/detail/a_id/5142
CVE: CVE-2021-1063
Published: 2021-01-08
Description: NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input offset is not validated, which may lead to a buffer overread, which in turn may cause tampering of data, information disclosure, or denial of service. This affects vGPU version 8.x (prior to 8.6) and version 11.0 (prior to 11.3).
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5142; https://nvidia.custhelp.com/app/answers/detail/a_id/5142
CVE: CVE-2021-1064
Published: 2021-01-08
Description: NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which it obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer, which may lead to information disclosure or denial of service. This affects vGPU version 8.x (prior to 8.6) and version 11.0 (prior to 11.3).
CVSS Score: 7.1 (HIGH)
CWE: CWE-476
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5142; https://nvidia.custhelp.com/app/answers/detail/a_id/5142
CVE: CVE-2021-1065
Published: 2021-01-08
Description: NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which input data is not validated, which may lead to tampering of data or denial of service. This affects vGPU version 8.x (prior to 8.6) and version 11.0 (prior to 11.3).
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5142; https://nvidia.custhelp.com/app/answers/detail/a_id/5142
CVE: CVE-2021-1066
Published: 2021-01-08
Description: NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which input data is not validated, which may lead to unexpected consumption of resources, which in turn may lead to denial of service. This affects vGPU version 8.x (prior to 8.6) and version 11.0 (prior to 11.3).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5142; https://nvidia.custhelp.com/app/answers/detail/a_id/5142
CVE: CVE-2021-3111
Published: 2021-01-08
Description: The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/161600/Concrete5-8.5.4-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/161997/Concrete5-8.5.4-Cross-Site-Scripting.html; https://documentation.concrete5.org/developers/introduction/version-history
CVE: CVE-2020-27260
Published: 2021-01-08
Description: Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 HL7 v2.x injection vulnerabilities exist in the affected products that allow physically proximate attackers with a connected barcode reader to inject HL7 v2.x segments into specific HL7 v2.x messages via multiple expected parameters.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74, CWE-74
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-007-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-007-01
CVE: CVE-2020-27262
Published: 2021-01-08
Description: Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 A stored cross-site scripting (XSS) vulnerability exists in the affected products that allow an attacker to inject arbitrary web script or HTML via the filename parameter to multiple update endpoints of the administrative web interface.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-007-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-007-01
CVE: CVE-2020-5804
Published: 2021-01-08
Description: Marvell QConvergeConsole GUI <= 5.5.0.74 is affected by a path traversal vulnerability. The deleteEventLogFile method of the GWTTestServiceImpl class lacks proper validation of a user-supplied path prior to using it in file deletion operations. An authenticated, remote attacker can leverage this vulnerability to delete arbitrary remote files as SYSTEM or root.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://www.tenable.com/security/research/tra-2021-01; https://www.tenable.com/security/research/tra-2021-01
CVE: CVE-2020-5805
Published: 2021-01-08
Description: In Marvell QConvergeConsole GUI <= 5.5.0.74, credentials are stored in cleartext in tomcat-users.xml. OS-level users on the QCC host who are not authorized to use QCC may use the plaintext credentials to login to QCC.
CVSS Score: 8.8 (HIGH)
CWE: CWE-312
References: https://www.tenable.com/security/research/tra-2021-01; https://www.tenable.com/security/research/tra-2021-01
CVE: CVE-2020-8584
Published: 2021-01-08
Description: Element OS versions prior to 1.8P1 and 12.2 are susceptible to a vulnerability that could allow an unauthenticated remote attacker to perform arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-35131
Published: 2021-01-08
Description: Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/agentejo/cockpit/commits/next/lib/MongoLite/Database.php; https://github.com/agentejo/cockpit/releases/tag/0.6.1; https://www.exploit-db.com/exploits/49390
CVE: CVE-2020-17502
Published: 2021-01-08
Description: Barco TransForm N before 3.8 allows Command Injection (issue 2 of 4). The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users of the administration panel to perform authenticated remote code execution. An issue exists in split_card_cmd.php in which the http parameters xmodules, ymodules and savelocking are not properly handled. The NDN-210 is part of Barco TransForm N solution and includes the patch from TransForm N version 3.8 onwards.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.barco.com/en/support/cms; https://www.barco.com/en/support/knowledge-base/kb11589; https://www.barco.com/en/support/transform-n-management-server
CVE: CVE-2020-17503
Published: 2021-01-08
Description: The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in split_card_cmd.php in which the http parameter "locking" is not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.barco.com/en/support/cms; https://www.barco.com/en/support/knowledge-base/kb11589; https://www.barco.com/en/support/transform-n-management-server
CVE: CVE-2020-17504
Published: 2021-01-08
Description: The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters "x_modules" and "y_modules" are not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.barco.com/en/support/cms; https://www.barco.com/en/support/knowledge-base/kb11589; https://www.barco.com/en/support/transform-n-management-server
CVE: CVE-2020-25678
Published: 2021-01-08
Description: A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-312
References: https://bugzilla.redhat.com/show_bug.cgi?id=1892109; https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQTBKVXVYP7GPQNZ5VASOIJHMLK7727M/
CVE: CVE-2020-26664
Published: 2021-01-08
Description: A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://videolan.com; http://vlc.com; https://gist.githubusercontent.com/henices/db11664dd45b9f322f8514d182aef5ea/raw/d56940c8bf211992bf4f3309a85bb2b69383e511/CVE-2020-26664.txt
CVE: CVE-2020-28208
Published: 2021-01-08
Description: An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: http://packetstormsecurity.com/files/160845/Rocket.Chat-3.7.1-Email-Address-Enumeration.html; http://seclists.org/fulldisclosure/2021/Jan/32; http://seclists.org/fulldisclosure/2021/Jan/43
CVE: CVE-2020-16012
Published: 2021-01-08
Description: Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1088224; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16013
Published: 2021-01-08
Description: Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html; https://crbug.com/1147206; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html
CVE: CVE-2020-16014
Published: 2021-01-08
Description: Use after free in PPAPI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1146675; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
CVE: CVE-2020-16015
Published: 2021-01-08
Description: Insufficient data validation in WASM in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-787, CWE-843
References: https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html; https://crbug.com/1146673; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html