rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-13598 
LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port_3480/data_request because the "No unsafe lua allowed" code block is skipped.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-14T17:22:04.000Z
CVE-2019-13599 
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by comparing response times.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T18:51:45.000Z
CVE-2019-13602 
An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-14T21:00:27.000Z
CVE-2019-13603 
An issue was discovered in the HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader Windows Biometric Framework driver 5.0.0.5. It has a statically coded initialization vector to encrypt a user's fingerprint image, resulting in weak encryption of that. This, in combination with retrieving an encrypted fingerprint image and encryption key (through another vulnerability), allows an attacker to obtain a user's fingerprint image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-16T16:52:31.000Z
CVE-2019-13604 
There is a short key vulnerability in HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader v24. The key for obfuscating the fingerprint image is vulnerable to brute-force attacks. This allows an attacker to recover the key and decrypt that image using the key. Successful exploitation causes a sensitive biometric information leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-15T13:47:12.000Z
CVE-2019-13605 
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowledge of a valid username. The attacker must defeat an encoding that is not equivalent to base64, and thus this is different from CVE-2019-13360.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-16T16:46:07.000Z
CVE-2019-13607 
The Opera Mini application through 16.0.14 for iOS has a UXSS vulnerability that can be triggered by performing navigation to a javascript: URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-18T14:42:59.000Z
CVE-2019-13608 
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T18:33:18.000Z
CVE-2019-13611 
An issue was discovered in python-engineio through 3.8.2. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to a server by using a victim's credentials, because the Origin header is not restricted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-15T23:17:14.000Z
CVE-2019-13612 
MDaemon Email Server 19 through 20.0.1 skips SpamAssassin checks by default for e-mail messages larger than 2 MB (and limits checks to 10 MB even with special configuration), which is arguably inconsistent with currently popular message sizes. This might interfere with risk management for malicious e-mail, if a customer deploys a server with sufficient resources to scan large messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-16T12:24:48.000Z
CVE-2019-13613 
CMD_FTEST_CONFIG in the TP-Link Device Debug protocol in TP-Link Wireless Router Archer Router version 1.0.0 Build 20180502 rel.45702 (EU) and earlier is prone to a stack-based buffer overflow, which allows a remote attacker to achieve code execution or denial of service by sending a crafted payload to the listening server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T16:58:51.000Z
CVE-2019-13614 
CMD_SET_CONFIG_COUNTRY in the TP-Link Device Debug protocol in TP-Link Archer C1200 1.0.0 Build 20180502 rel.45702 and earlier is prone to a stack-based buffer overflow, which allows a remote attacker to achieve code execution or denial of service by sending a crafted payload to the listening server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T17:06:21.000Z
CVE-2019-13615 
libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-16T16:06:34.000Z
CVE-2019-13616 
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-16T00:00:00.000Z
CVE-2019-13617 
njs through 0.3.3, used in NGINX, has a heap-based buffer over-read in nxt_vsprintf in nxt/nxt_sprintf.c during error handling, as demonstrated by an njs_regexp_literal call that leads to an njs_parser_lexer_error call and then an njs_parser_scope_error call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-16T16:07:00.000Z
CVE-2019-13618 
In GPAC before 0.8.0, isomedia/isom_read.c in libgpac.a has a heap-based buffer over-read, as demonstrated by a crash in gf_m2ts_sync in media_tools/mpegts.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-16T16:07:17.000Z
CVE-2019-13619 
In Wireshark 3.0.0 to 3.0.2, 2.6.0 to 2.6.9, and 2.4.0 to 2.4.15, the ASN.1 BER dissector and related dissectors could crash. This was addressed in epan/asn1.c by properly restricting buffer increments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T19:18:03.000Z
CVE-2019-13623 
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its filename. This allows attackers to overwrite arbitrary files in scenarios where an intermediate analysis result is archived for sharing with other persons. To achieve arbitrary code execution, one approach is to overwrite some critical Ghidra modules, e.g., the decompile module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T02:07:04.000Z
CVE-2019-13624 
In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within strings that can be used in a shell command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T02:15:54.000Z
CVE-2019-13625 
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T02:38:32.000Z
CVE-2019-13626 
SDL (Simple DirectMedia Layer) 2.x through 2.0.9 has a heap-based buffer over-read in Fill_IMA_ADPCM_block, caused by an integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T00:00:00.000Z
CVE-2019-13627 
It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-25T14:44:45.000Z
CVE-2019-13628 
wolfSSL and wolfCrypt 4.0.0 and earlier (when configured without --enable-fpecc, --enable-sp, or --enable-sp-math) contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to precisely measure the duration of signature operations, to infer information about the nonces used and potentially mount a lattice attack to recover the private key used. The issue occurs because ecc.c scalar multiplication might leak the bit length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-03T13:20:44.000Z
CVE-2019-13629 
MatrixSSL 4.2.1 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or a remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because crypto/pubkey/ecc_math.c scalar multiplication leaks the bit length of the scalar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-03T13:23:25.000Z
CVE-2019-13631 
In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T18:11:34.000Z
CVE-2019-13633 
Blinger.io v.1.0.2519 is vulnerable to Blind/Persistent XSS. An attacker can send arbitrary JavaScript code via a built-in communication channel, such as Telegram, WhatsApp, Viber, Skype, Facebook, Vkontakte, or Odnoklassniki. This is mishandled within the administration panel for conversations/all, conversations/inbox, conversations/unassigned, and conversations/closed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-19T19:17:28.000Z
CVE-2019-13635 
The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T12:20:44.000Z
CVE-2019-13636 
In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T20:04:00.000Z
CVE-2019-13637 
In LogMeIn join.me before 3.16.0.5505, an attacker could execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used by the application URI that is defined in Windows. An attacker could exploit this vulnerability by convincing a targeted user to follow a malicious link. Successful exploitation could cause the application to load libraries from the directory targeted by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileges of the targeted user if the attacker can place a crafted library in a directory that is accessible to the vulnerable system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T20:17:52.000Z
CVE-2019-13638 
GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-26T12:22:43.000Z
CVE-2019-13640 
In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T21:07:47.000Z
CVE-2019-13643 
Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack begins by storing a new stream message containing an XSS payload. The stored payload can then be triggered by clicking a malicious link on the Notifications page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-18T02:17:12.000Z
CVE-2019-13644 
Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a transaction, and is executed on the tags/show/$tag_number$ tag summary page. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-18T02:17:24.000Z
CVE-2019-13645 
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript code is executed during attachments/edit/$file_id$ attachment editing. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-18T02:17:33.000Z
CVE-2019-13646 
Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-18T02:17:40.000Z
CVE-2019-13647 
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$file_id$ attachment viewing. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-18T02:17:49.000Z
CVE-2019-13648 
In the Linux kernel through 5.2.1 on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-19T12:53:01.000Z
CVE-2019-13649 
TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow externalPort OS Command Injection (issue 1 of 5).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-24T14:54:24.000Z
CVE-2019-13650 
TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow internalPort OS Command Injection (issue 2 of 5).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-24T14:55:55.000Z
CVE-2019-13651 
TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow portMappingProtocol OS Command Injection (issue 3 of 5).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-24T14:56:49.000Z
CVE-2019-13652 
TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow serviceName OS Command Injection (issue 4 of 5).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-24T14:58:05.000Z
CVE-2019-13653 
TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow triggerPort OS Command Injection (issue 5 of 5).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-24T14:58:55.000Z
CVE-2019-13655 
Imgix through 2019-06-19 allows remote attackers to cause a denial of service (resource consumption) by manipulating a small JPEG file to specify dimensions of 64250x64250 pixels, which is mishandled during an attempt to load the 'whole image' into memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-29T18:43:24.000Z
CVE-2019-13656 
An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.3.5, 11.3.6 allows a remote attacker to execute arbitrary code.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: CA Technologies
product: Client Automation
vendor: CA Technologies
product: Workload Automation AE
Published: 2019-09-06T14:44:42.000Z
CVE-2019-13657 
CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: CA Technologies, A Broadcom Company
product: CA Performance Management
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2019-10-17T18:45:16.512Z
CVE-2019-13658 
CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: CA Technologies, a Broadcom Company
product: CA Network Flow Analysis
vendor: CA Technologies, a Broadcom Company
product: CA Network Flow Analysis
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2019-10-02T16:14:53.392Z
CVE-2019-13659 
IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:53.000Z
CVE-2019-13660 
UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:53.000Z
CVE-2019-13661 
UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:53.000Z
CVE-2019-13662 
Insufficient policy enforcement in navigations in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:53.000Z
CVE-2019-13663 
IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:53.000Z
CVE-2019-13664 
Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:53.000Z
CVE-2019-13665 
Insufficient filtering in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass multiple file download protection via a crafted HTML page.
Problem types: description: Policy bypass
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:53.000Z
CVE-2019-13666 
Information leak in storage in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Problem types: description: Side-channel information leakage
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:53.000Z
CVE-2019-13667 
Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:53.000Z
CVE-2019-13668 
Insufficient policy enforcement in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:53.000Z
CVE-2019-13669 
Incorrect data validation in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:53.000Z
CVE-2019-13670 
Insufficient data validation in JavaScript in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:53.000Z
CVE-2019-13671 
UI spoofing in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof security UI via a crafted HTML page.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:53.000Z
CVE-2019-13672 
Incorrect security UI in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page on iOS.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2019-12-10T20:45:20.000Z
CVE-2019-13673 
Insufficient data validation in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:53.000Z
CVE-2019-13674 
IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:53.000Z
CVE-2019-13675 
Insufficient data validation in extensions in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to disable extensions via a crafted HTML page.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:53.000Z
CVE-2019-13676 
Insufficient policy enforcement in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:53.000Z