Page 173 of 3355 results (0.009 seconds)

CVSS: 8.8EPSS: 8%CPEs: 6EXPL: 0

CVE-2018-6090 – chromium-browser: Heap buffer overflow in Skia

https://notcve.org/view.php?id=CVE-2018-6090

24 Apr 2018 — An integer overflow that lead to a heap buffer-overflow in Skia in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Un desbordamiento de enteros que conduce a un desbordamiento de búfer basado en memoria dinámica (heap) en Skia en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto ejecutase código arbitrario dentro de un sandbox mediante una página HTML manipulada. Chromium is an open-so... • http://www.securityfocus.com/bid/103917 • CWE-190: Integer Overflow or Wraparound •

CVSS: 8.8EPSS: 1%CPEs: 6EXPL: 0

CVE-2018-6091 – chromium-browser: Incorrect handling of plug-ins by Service Worker

https://notcve.org/view.php?id=CVE-2018-6091

24 Apr 2018 — Service Workers can intercept any request made by an or tag in Fetch API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Los trabajadores del servicio (Service Workers) pueden interceptar cualquier petición realizada por las etiquetas o en la API Fetch en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitían que un atacante remoto filtrase datos cross-origin mediante una página HTML manipulada. Chromium is a... • http://www.securityfocus.com/bid/103917 • CWE-19: Data Processing Errors •
CVSS: 8.8EPSS: 30%CPEs: 6EXPL: 2

CVE-2018-6092 – Google Chrome - Integer Overflow when Processing WebAssembly Locals

https://notcve.org/view.php?id=CVE-2018-6092

24 Apr 2018 — An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Un desbordamiento de enteros en sistemas de 32 bits en WebAssembly en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto ejecutase código arbitrario dentro de un sandbox mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrade... • https://packetstorm.news/files/id/148090 • CWE-190: Integer Overflow or Wraparound •

CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0

CVE-2018-6093 – chromium-browser: Same origin bypass in Service Worker

https://notcve.org/view.php?id=CVE-2018-6093

24 Apr 2018 — Insufficient origin checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Comprobación de origen insuficiente en Blink en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto filtrase los datos cross-origin mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 66.0.3359.117. Issues addressed include buffer over... • http://www.securityfocus.com/bid/103917 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 8.8EPSS: 1%CPEs: 6EXPL: 0

CVE-2018-6094 – chromium-browser: Exploit hardening regression in Oilpan

https://notcve.org/view.php?id=CVE-2018-6094

24 Apr 2018 — Inline metadata in GarbageCollection in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Los metadatos inline en GarbageCollection en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 66.0.3359.117... • http://www.securityfocus.com/bid/103917 • CWE-787: Out-of-bounds Write •

CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0

CVE-2018-6095 – chromium-browser: Lack of meaningful user interaction requirement before file upload

https://notcve.org/view.php?id=CVE-2018-6095

24 Apr 2018 — Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read local files via a crafted HTML page. La eliminación incorrecta del selector de archivos en los eventos del teclado en Blink en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto leyese archivos locales mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to ... • http://www.securityfocus.com/bid/103917 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0

CVE-2018-6096 – chromium-browser: Fullscreen UI spoof

https://notcve.org/view.php?id=CVE-2018-6096

24 Apr 2018 — A JavaScript focused window could overlap the fullscreen notification in Fullscreen in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obscure the full screen warning via a crafted HTML page. Una ventana centrada con JavaScript podría superponerse a la notificación de pantalla completa en Fullscreen en Google Chrome, en versiones anteriores a la 66.0.3359.117, lo que permitía que un atacante remoto ocultase la advertencia de pantalla completa mediante una página HTML manipulada. Chromium i... • http://www.securityfocus.com/bid/103917 • CWE-20: Improper Input Validation •

CVSS: 6.5EPSS: 1%CPEs: 7EXPL: 0

CVE-2018-6097 – chromium-browser: Fullscreen UI spoof

https://notcve.org/view.php?id=CVE-2018-6097

24 Apr 2018 — Incorrect handling of asynchronous methods in Fullscreen in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to enter full screen without showing a warning via a crafted HTML page. La gestión incorrecta de los métodos asíncronos en Fullscreen en Google Chrome, en versiones anteriores a la 66.0.3359.117 para macOS, permitía que un atacante remoto pudiese entrar en modo de pantalla completa sin mostrar un aviso mediante una página HTML manipulada. Chromium is an open-source web browser,... • http://www.securityfocus.com/bid/103917 • CWE-19: Data Processing Errors •

CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0

CVE-2018-6098 – chromium-browser: URL spoof in Omnibox

https://notcve.org/view.php?id=CVE-2018-6098

24 Apr 2018 — Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. Aplicación insuficiente de caracteres confundibles en URL Formatter en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto suplantase dominios mediante homogramas IDN mediante un nombre de dominio manipulado. Chromium is an open-source web browser, powered by WebKit. This ... • http://www.securityfocus.com/bid/103917 •

CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0

CVE-2018-6099 – chromium-browser: CORS bypass in ServiceWorker

https://notcve.org/view.php?id=CVE-2018-6099

24 Apr 2018 — A lack of CORS checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page. La falta de comprobación de CORS en Blink en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto filtrase datos cross-origin limitados mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 66.0.3359.117. Issues addressed include buffe... • http://www.securityfocus.com/bid/103917 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •