CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2011-2845
https://notcve.org/view.php?id=CVE-2011-2845
Google Chrome before 15.0.874.102 does not properly handle history data, which allows user-assisted remote attackers to spoof the URL bar via unspecified vectors. Google Chrome antes de v15.0.874.102 no maneja adecuadamente los datos del historial, lo que permite a atacantes remotos asistidos por el usuario falsificar la barra de URL a través de vectores no especificados. • http://code.google.com/p/chromium/issues/detail?id=86758 http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html http://support.apple.com/kb/HT5400 http://support.apple.com/kb/HT5503 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13044 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 7%CPEs: 4EXPL: 0CVE-2011-3888
https://notcve.org/view.php?id=CVE-2011-3888
Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to editing operations in conjunction with an unknown plug-in. Vulnerabilidad de tipo "usar después de liberar" (use-after-free) en Google Chrome en versiones anteriores a la 15.0.874.102. Permite a atacantes remotos asistidos por el usuario provocar una denegación de servicio o posiblemente tener otro impacto sin especificar a través de vectores relacionados con operaciones de edicion junto con complementos ("plug-ins") desconocidos. • http://code.google.com/p/chromium/issues/detail?id=99138 http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html http://secunia.com/advisories/48274 http://secunia.com/advisories/48288 http://secunia.com/advisories/48377 http://www.securitytracker.com/id • CWE-416: Use After Free •
CVSS: 7.5EPSS: 11%CPEs: 4EXPL: 0CVE-2011-3885
https://notcve.org/view.php?id=CVE-2011-3885
Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to stale Cascading Style Sheets (CSS) token-sequence data. Vulnerabilidad de tipo "usar después de liberar" ("use-after-free") en Google Chrome en versiones anteriores a la 15.0.874.102 permite a atacantes remotos provocar una denegación de servicio o posiblemente realizar otras acciones sin especificar a través de vectores relacionados con los datos token-sequence de las hojas de estilo (CSS). • http://code.google.com/p/chromium/issues/detail?id=100059 http://code.google.com/p/chromium/issues/detail?id=97599 http://code.google.com/p/chromium/issues/detail?id=98064 http://code.google.com/p/chromium/issues/detail?id=98556 http://code.google.com/p/chromium/issues/detail? • CWE-416: Use After Free •
CVSS: 5.0EPSS: 0%CPEs: 99EXPL: 0CVE-2011-3242
https://notcve.org/view.php?id=CVE-2011-3242
The Private Browsing feature in Apple Safari before 5.1.1 on Mac OS X does not properly recognize the Always value of the Block Cookies setting, which makes it easier for remote web servers to track users via a cookie. La característica de navegación privada en Apple Safari antes de v5.1.1 en Mac OS X no reconoce adecuadamente el valor "Always" de la caracteristica "Block Cookies", lo que hace más sencillo para servidores remotos localizar a usuarios a través de una cookie. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00004.html http://osvdb.org/76391 http://support.apple.com/kb/HT5000 https://exchange.xforce.ibmcloud.com/vulnerabilities/70569 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 0%CPEs: 97EXPL: 0CVE-2011-3229 – Apple Safari Directory Traversal
https://notcve.org/view.php?id=CVE-2011-3229
Directory traversal vulnerability in Apple Safari before 5.1.1 allows remote attackers to execute arbitrary JavaScript code, in a Safari Extensions context, via a crafted safari-extension: URL. Vulnerabilidad de salto de directorio en Apple Safari antes de v5.1.1 permite a atacantes remotos ejecutar código JavaScript de su elección en un contexto de extensiones de Safari a través de una extensión safari manipulada: URL. Apple Safari versions 5.0 and later on Mac OS and Windows are vulnerable to a directory traversal issue with the handling of "safari-extension://" URLs. Attackers can create malicious websites that trigger Safari to send files from the victim's system to the attacker. Arbitrary Javascript can be executed in the web context of the Safari extension. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00004.html http://osvdb.org/76388 http://support.apple.com/kb/HT5000 https://exchange.xforce.ibmcloud.com/vulnerabilities/70566 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-94: Improper Control of Generation of Code ('Code Injection') •