CVSS: 6.5EPSS: 0%CPEs: 16EXPL: 0CVE-2017-11305 – flash-plugin: unintended reset of global settings preference file vulnerability (APSB17-42)
https://notcve.org/view.php?id=CVE-2017-11305
A regression affecting Adobe Flash Player version 27.0.0.187 (and earlier versions) causes the unintended reset of the global settings preference file when a user clears browser data. Una regresión que afecta a Adobe Flash Player en su versión 27.0.0.187 (y anteriores) provoca el restablecimiento accidental del archivo de preferencias de configuraciones globales cuando un usuario borra los datos del navegador. • http://www.securityfocus.com/bid/102139 http://www.securitytracker.com/id/1039986 https://access.redhat.com/errata/RHSA-2018:0081 https://helpx.adobe.com/security/products/flash-player/apsb17-42.html https://access.redhat.com/security/cve/CVE-2017-11305 https://bugzilla.redhat.com/show_bug.cgi?id=1525508 •
CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2017-15097 – postgresql: Start scripts permit database administrator to modify root-owned files
https://notcve.org/view.php?id=CVE-2017-15097
Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL. An attacker with access to the postgres user account could use these flaws to obtain root access on the server machine. Se encontraron vulnerabilidades de escalado de privilegios en los scripts de inicialización de Red Hat de PostgreSQL. Un atacante con acceso a la cuenta de usuario de postgres podría usar estas vulnerabilidades para obtener acceso root en la máquina del servidor. • http://www.securitytracker.com/id/1039983 https://access.redhat.com/errata/RHSA-2017:3402 https://access.redhat.com/errata/RHSA-2017:3403 https://access.redhat.com/errata/RHSA-2017:3404 https://access.redhat.com/errata/RHSA-2017:3405 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15097 https://access.redhat.com/security/cve/CVE-2017-15097 https://bugzilla.redhat.com/show_bug.cgi?id=1508985 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2017-15416 – chromium-browser: out of bounds read in blink
https://notcve.org/view.php?id=CVE-2017-15416
Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka a Blink out-of-bounds read. Desbordamiento de búfer basado en memoria dinámica (heap) en Blob API en Google Chrome en versiones anteriores a la 63.0.3239.84 permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante una página HTML manipulada. Esto también se conoce como lectura Blink fuera de límites. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/779314 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2017/dsa-4064 https://access.redhat.com/security/cve/CVE-2017-15416 https://bugzilla.redhat.com/show_bug.cgi?id=1523131 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-15424 – chromium-browser: url spoof in omnibox
https://notcve.org/view.php?id=CVE-2017-15424
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. Una aplicación de políticas insuficiente en Omnibox en Google Chrome en versiones anteriores a la 63.0.3239.84 permitía que un atacante remoto suplantase dominios mediante homogramas IDN en un nombre de dominio manipulado. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/756226 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2017/dsa-4064 https://access.redhat.com/security/cve/CVE-2017-15424 https://bugzilla.redhat.com/show_bug.cgi?id=1523138 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2017-15427 – chromium-browser: insufficient blocking of javascript in omnibox
https://notcve.org/view.php?id=CVE-2017-15427
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar. Una aplicación de políticas insuficiente en Omnibox en Google Chrome en versiones anteriores a la 63.0.3239.84 permitía que un usuario creado mediante ingeniería social emplee Cross-Site Scripting (XSS) contra sí mismo arrastrando y soltando una URL javascript: en la barra de direcciones. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/768910 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2017/dsa-4064 https://access.redhat.com/security/cve/CVE-2017-15427 https://bugzilla.redhat.com/show_bug.cgi?id=1523141 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •