CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2018-16084 – chromium-browser: User confirmation bypass in external protocol handling
https://notcve.org/view.php?id=CVE-2018-16084
09 Sep 2018 — The default selected dialog button in CustomHandlers in Google Chrome prior to 69.0.3497.81 allowed a remote attacker who convinced the user to perform certain operations to open external programs via a crafted HTML page. El botón de diálogo seleccionado por defecto en CustomHandlers en Google Chrome, en versiones anteriores a la 69.0.3497.81, permitía que un atacante remoto, que hubiese convencido a un usuario para que realizase ciertas operaciones, abriese programas externos mediante una página HTML manip... • http://www.securityfocus.com/bid/105215 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 11%CPEs: 4EXPL: 2CVE-2018-16071 – WebRTC - VP9 Processing Use-After-Free
https://notcve.org/view.php?id=CVE-2018-16071
09 Sep 2018 — A use after free in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. Uso de memoria previamente liberada en WebRTC en Google Chrome en versiones anteriores a la 69.0.3497.81 permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante un archivo de vídeo manipulado. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 69.0.3497.81. Issu... • https://packetstorm.news/files/id/149459 • CWE-416: Use After Free CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 3%CPEs: 5EXPL: 0CVE-2018-16066 – chromium-browser: Out of bounds read in Blink
https://notcve.org/view.php?id=CVE-2018-16066
09 Sep 2018 — A use after free in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un uso de memoria previamente liberada en Blink en Google Chrome en versiones anteriores a la 69.0.3497.81 permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 69.0.3497.81. Issues a... • http://www.securityfocus.com/bid/105215 • CWE-416: Use After Free CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-16073 – chromium-browser: Site Isolation bypass after tab restore
https://notcve.org/view.php?id=CVE-2018-16073
09 Sep 2018 — Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass site isolation via a crafted HTML page. La aplicación insuficiente de políticas en el aislamiento del sitio en Google Chrome antes de 69.0.3497.81 permitió a un atacante remoto omitir el aislamiento del sitio a través de una página HTML diseñada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 69.0.3497.81. Issues addressed include b... • https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html • CWE-285: Improper Authorization •
CVSS: 9.6EPSS: 1%CPEs: 5EXPL: 0CVE-2018-16068 – chromium-browser: Out of bounds write in Mojo
https://notcve.org/view.php?id=CVE-2018-16068
09 Sep 2018 — Missing validation in Mojo in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Falta de validación en Mojo en Google Chrome en versiones anteriores a la 69.0.3497.81 permitía que un atacante remoto realizase un escape del sandbox mediante una página HTML manipulada. Chrome has missing validation in the deserialization routines for both DataPipeConsumerDispatcher and DataPipeProducerDispatcher, which take from the incoming message ... • http://www.securityfocus.com/bid/105215 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-16080 – chromium-browser: URL spoof in full screen mode
https://notcve.org/view.php?id=CVE-2018-16080
09 Sep 2018 — A missing check for popup window handling in Fullscreen in Google Chrome on macOS prior to 69.0.3497.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. La falta de comprobaciones para la gestión de ventanas desplegables en Fullscreen en Google Chrome, en versiones anteriores a la 69.0.3497.81, en macOS permitía que un atacante remoto suplantase el contenido de Omnibox (barra de direcciones) mediante una página HTML manipulada. Chromium is an open-source web ... • http://www.securityfocus.com/bid/105215 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-16075 – chromium-browser: Local file access in Blink
https://notcve.org/view.php?id=CVE-2018-16075
09 Sep 2018 — Insufficient file type enforcement in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain local file data via a crafted HTML page. La aplicación insuficiente del tipo de archivo en Blink en Google Chrome antes de 69.0.3497.81 permitió a un atacante remoto obtener datos de archivos locales a través de una página HTML creada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 69.0.3497.81. Issues addressed include buffer overflow, b... • https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-16069 – chromium-browser: Out of bounds read in SwiftShader
https://notcve.org/view.php?id=CVE-2018-16069
09 Sep 2018 — Unintended floating-point error accumulation in SwiftShader in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page. La acumulación involuntaria de errores de punto flotante en SwiftShader en Google Chrome antes del 69.0.3497.81 permitió a un atacante remoto filtrar datos de cross-origin través de una página HTML creada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 69.0.3497.81. Issues addressed... • https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-16077 – chromium-browser: Content security policy bypass in Blink
https://notcve.org/view.php?id=CVE-2018-16077
09 Sep 2018 — Object lifecycle issue in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass content security policy via a crafted HTML page. El problema del ciclo de vida de los objetos en Blink en Google Chrome antes de 69.0.3497.81 permitió a un atacante remoto eludir la política de seguridad de contenido a través de una página HTML diseñada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 69.0.3497.81. Issues addressed include buffer over... • https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html • CWE-285: Improper Authorization •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-16078 – chromium-browser: Credit card information leak in Autofill
https://notcve.org/view.php?id=CVE-2018-16078
09 Sep 2018 — Unsafe handling of credit card details in Autofill in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. La gestión incorrecta de los detalles de la tarjeta de crédito en Autofill en Google Chrome, en versiones anteriores a la 69.0.3497.81, permitían que un atacante remoto pudiese obtener información potencialmente sensible del la memoria del proceso mediante una página HTML manipulada. Chromium is an open-so... • http://www.securityfocus.com/bid/105215 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •