CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2020-6495 – chromium-browser: Insufficient policy enforcement in developer tools
https://notcve.org/view.php?id=CVE-2020-6495
03 Jun 2020 — Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.97 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. Una aplicación insuficiente de la política en developer tools en Google Chrome versiones anteriores a 83.0.4103.97, permitió a un atacante que convenció a un usuario de instalar una extensión maliciosa potencialmente llevar a cabo un escape del sandbox por medio de una Chrome... • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html • CWE-276: Incorrect Default Permissions •
CVSS: 8.8EPSS: 1%CPEs: 6EXPL: 0CVE-2020-6496 – chromium-browser: Use after free in payments
https://notcve.org/view.php?id=CVE-2020-6496
03 Jun 2020 — Use after free in payments in Google Chrome on MacOS prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. El uso de la memoria previamente liberada en payments en Google Chrome en MacOS versiones anteriores a 83.0.4103.97, permitió a un atacante remoto poder llevar a cabo un escape del sandbox por medio de una página HTML diseñada Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which could result in the arbitrar... • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html • CWE-416: Use After Free •
CVSS: 9.6EPSS: 0%CPEs: 5EXPL: 0CVE-2020-6493 – chromium-browser: Use after free in WebAuthentication
https://notcve.org/view.php?id=CVE-2020-6493
03 Jun 2020 — Use after free in WebAuthentication in Google Chrome prior to 83.0.4103.97 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Un uso de la memoria previamente liberada en WebAuthentication en Google Chrome versiones anteriores a 83.0.4103.97, permitió a un atacante remoto que había comprometido el proceso del renderizador para potencialmente llevar a cabo un escape del sandbox por medio de una página HTML diseñada Multiple vuln... • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 0CVE-2020-6494 – chromium-browser: Incorrect security UI in payments
https://notcve.org/view.php?id=CVE-2020-6494
03 Jun 2020 — Incorrect security UI in payments in Google Chrome on Android prior to 83.0.4103.97 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. Una Interfaz de Usuario de seguridad incorrecta en payments en Google Chrome en Android versiones anteriores a 83.0.4103.97, permitió a un atacante remoto falsificar el contenido del Omnibox (barra de URL) por medio de una página HTML diseñada Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of w... • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html •
CVSS: 8.2EPSS: 73%CPEs: 7EXPL: 5CVE-2020-13379 – Grafana 7.0.1 - Denial of Service (PoC)
https://notcve.org/view.php?id=CVE-2020-13379
03 Jun 2020 — The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault. La funcionalidad avatar en Grafana versiones 3.0.1 hasta 7.0.1, presenta un problema de Control de A... • https://packetstorm.news/files/id/158320 • CWE-476: NULL Pointer Dereference CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.9EPSS: 0%CPEs: 5EXPL: 1CVE-2020-13614
https://notcve.org/view.php?id=CVE-2020-13614
26 May 2020 — An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification. Se detectó un problema en el archivo ssl.c en Axel versiones anteriores a 2.17.8. La implementación TLS carece de verificación del nombre de host. • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00006.html • CWE-295: Improper Certificate Validation •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2020-6491 – chromium-browser: Incorrect security UI in site information
https://notcve.org/view.php?id=CVE-2020-6491
21 May 2020 — Insufficient data validation in site information in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted domain name. Una comprobación insuficiente de datos en site information en Google Chrome versiones anteriores a la versión 83.0.4103.61, permitió a un atacante remoto falsificar la Interfaz de Usuario de seguridad por medio de un nombre de dominio especialmente diseñado. Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which ... • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2020-6490 – chromium-browser: Insufficient data validation in loader
https://notcve.org/view.php?id=CVE-2020-6490
21 May 2020 — Insufficient data validation in loader in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had been able to write to disk to leak cross-origin data via a crafted HTML page. Una comprobación insuficiente de datos en loader en Google Chrome versiones anteriores a la versión 83.0.4103.61, permitió a un atacante remoto que había sido capaz de escribir en el disco filtrar datos de tipo cross-origin por medio de una página HTML especialmente diseñada. Multiple vulnerabilities have been found in C... • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 1CVE-2020-6489 – chromium-browser: Inappropriate implementation in developer tools
https://notcve.org/view.php?id=CVE-2020-6489
21 May 2020 — Inappropriate implementation in developer tools in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had convinced the user to take certain actions in developer tools to obtain potentially sensitive information from disk via a crafted HTML page. Una implementación inapropiada en developer tools en Google Chrome versiones anteriores a la versión 83.0.4103.61, permitió a un atacante remoto que había convencido al usuario de tomar determinadas acciones en developer tools para obtener informació... • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2020-6487 – chromium-browser: Insufficient policy enforcement in downloads
https://notcve.org/view.php?id=CVE-2020-6487
21 May 2020 — Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Una aplicación insuficiente de políticas en downloads en Google Chrome versiones anteriores a 83.0.4103.61, permitió a un atacante remoto omitir unas restricciones de navegación por medio de una página HTML especialmente diseñada. Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which could result in the a... • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html • CWE-276: Incorrect Default Permissions •