Lucene search

K

Veracode Vulnerability DatabaseVERACODE:28707

HistoryDec 21, 2020 - 7:50 p.m.

Cross-Site Scripting (XSS)

2020-12-2119:50:20

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

10

chromium

xss

vulnerability

webui

data validation

remote attacker

renderer process

injection

scripts

html

privileged page

malicious page

EPSS

0.002

Percentile

62.1%

chromium is vulnerable to cross-site scripting. Insufficient data validation in WebUI allows a remote attacker, who has compromised the renderer process, to inject scripts or HTML into a privileged page via a malicious HTML page.

References

lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html

lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html

lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html

lists.opensuse.org/opensuse-security-announce/2020-09/msg00041.html

chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html

crbug.com/1073409

lists.fedoraproject.org/archives/list/[email protected]/message/MTRPPTKZ2RKVH2XGQCWNFZ7FOGQ5LLCA/

lists.fedoraproject.org/archives/list/[email protected]/message/MYIDWCHG24ZTFD4P42D4A4WWPPA74BCG/

security-tracker.debian.org/tracker/CVE-2020-6535

security.gentoo.org/glsa/202007-08

security.gentoo.org/glsa/202101-30

www.debian.org/security/2021/dsa-4824

EPSS

0.002

Percentile

62.1%

Related for VERACODE:28707

prion1 redhatcve1 debiancve1 ubuntucve1 cve1 cvelist1 nvd1 openvas8 nessus14 suse6 fedora2 freebsd1 kaspersky1 chrome1 gentoo2 redhat1 debian1 osv3 mscve1