CVSS: 8.1EPSS: 82%CPEs: 6EXPL: 2CVE-2018-20346 – Apple Security Advisory 2019-1-22-3
https://notcve.org/view.php?id=CVE-2018-20346
21 Dec 2018 — SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan. SQLite anterior a la versión 3.25.3, cuando la extensión FTS3 está habilitada, encuentra un desbordamiento de enteros (y el desbordamiento del búfer result... • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00040.html • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.8EPSS: 2%CPEs: 5EXPL: 0CVE-2018-18340 – chromium-browser: Use after free in MediaRecorder
https://notcve.org/view.php?id=CVE-2018-18340
11 Dec 2018 — Incorrect object lifecycle in MediaRecorder in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. El ciclo de vida de un objecto incorrecto en MediaRecorder en Google Chrome, en versiones anteriores a la 71.0.3578.80, permite que un atacante remoto explote la corrupción de la memoria dinámica (heap) mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version... • http://www.securityfocus.com/bid/106084 • CWE-416: Use After Free CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-18355 – chromium-browser: Insufficient policy enforcement in URL Formatter
https://notcve.org/view.php?id=CVE-2018-18355
11 Dec 2018 — Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. El manejo incorrecto de caracteres confundibles en URL Formatter en Google Chrome en versiones anteriores a la 71.0.3578.80 permitía que un atacante remoto suplantase el contenido de Omnibox (barra de direcciones) mediante un nombre de dominio manipulado. Chromium is an open-source web browser, powered by WebKi... • http://www.securityfocus.com/bid/106084 •
CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 0CVE-2018-18347 – chromium-browser: Inappropriate implementation in Navigation
https://notcve.org/view.php?id=CVE-2018-18347
11 Dec 2018 — Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to trick a user into executing javascript in an arbitrary origin via a crafted HTML page. El manejo incorrecto de sesiones de navegación fallidas con URL inválidas en Navigation en Google Chrome en versiones anteriores a la 71.0.3578.80 permitía a un atacante remoto engañar a un usuario para que ejecutase código JavaScript en un origen arbitrario mediante una página HTML ... • http://www.securityfocus.com/bid/106084 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-18350 – chromium-browser: Insufficient policy enforcement in Blink
https://notcve.org/view.php?id=CVE-2018-18350
11 Dec 2018 — Incorrect handling of CSP enforcement during navigations in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass content security policy via a crafted HTML page. El manejo incorrecto de la aplicación de la política de seguridad de contenido (CSP) durante la navegación en Blink en Google Chrome en versiones anteriores a la 71.0.3578.80 permitía que un atacante remoto omitiese la política de seguridad de contenido (CSP) mediante una página HTML manipulada. Chromium is an open-sourc... • http://www.securityfocus.com/bid/106084 •
CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 0CVE-2018-18336 – chromium-browser: Use after free in PDFium
https://notcve.org/view.php?id=CVE-2018-18336
11 Dec 2018 — Incorrect object lifecycle in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. El ciclo de vida de un objecto incorrecto en PDFium en Google Chrome, en versiones anteriores a la 71.0.3578.80, permite que un atacante remoto explote la corrupción de la memoria dinámica (heap) mediante un archivo PDF manipulado. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 71.0.3578.80. I... • http://www.securityfocus.com/bid/106084 • CWE-416: Use After Free CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-18349 – chromium-browser: Insufficient policy enforcement in Blink
https://notcve.org/view.php?id=CVE-2018-18349
11 Dec 2018 — Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension. Se permitía de manera incorrecta la navegación remota de tramas en Blink en Google Chrome en versiones anteriores a 71.0.3578.80, lo que permitía que un atacante convenciera a un usuario para que instalase una extensión maliciosa y así acceder a a... • http://www.securityfocus.com/bid/106084 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 8.8EPSS: 2%CPEs: 5EXPL: 0CVE-2018-18338 – chromium-browser: Heap buffer overflow in Canvas
https://notcve.org/view.php?id=CVE-2018-18338
11 Dec 2018 — Incorrect, thread-unsafe use of SkImage in Canvas in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. El uso incorrecto con hilos no seguros de SkImage en Canvas en Google Chrome en versiones anteriores a la 71.0.3578.80 permitía a un atacante remoto explotar la corrupción de la memoria dinámica (heap) mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to ve... • http://www.securityfocus.com/bid/106084 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 2%CPEs: 17EXPL: 0CVE-2018-18356 – mozilla: Use after free in Skia
https://notcve.org/view.php?id=CVE-2018-18356
11 Dec 2018 — An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un desbordamiento de enteros en el manejo de rutas conduce a un uso de memoria previamente liberada en Skia en Google Chrome en versiones anteriores a la 71.0.3578.80 permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante una página HTML manipulada. Multiple security ... • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00043.html • CWE-190: Integer Overflow or Wraparound CWE-416: Use After Free CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 2%CPEs: 5EXPL: 0CVE-2018-18337 – chromium-browser: Use after free in Blink
https://notcve.org/view.php?id=CVE-2018-18337
11 Dec 2018 — Incorrect handling of stylesheets leading to a use after free in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Manejo incorrecto de hojas de estilo que provoca un uso de memoria previamente liberada en Blink en Google Chrome en versiones anteriores a la 71.0.3578.80 permitía a un atacante remoto explotar la corrupción de la memoria dinámica (heap) Chromium is an open-source web browser, powered by WebKit. This update up... • http://www.securityfocus.com/bid/106084 • CWE-416: Use After Free CWE-787: Out-of-bounds Write •