CVE-2021-22917

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Brave Browser Desktop between versions 1.17 and 1.20 is vulnerable to information disclosure by way of DNS requests in Tor windows not flowing through Tor if adblocking was enabled.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	https://github.com/brave/brave-core	Fixed in 1.20

References

https://hackerone.com/reports/1077022Third Party Advisory
https://hackerone.com/reports/1077022Third Party Advisory

Timeline

Published: Jul 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-229185.3Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. CVE-2021-229197.5A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway)CVE-2021-22928.1Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Document Management). Suppo CVE-2021-229206.5A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway)CVE-2021-229217.8Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platform CVE-2021-229226.5When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML CVE-2021-229235.3When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, CVE-2021-229243.7libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to err CVE-2021-229255.3curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=con CVE-2021-229267.5libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` optio CVE-2021-229278.1A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow a CVE-2021-229287.8A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has eit