CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5181 – chromium-browser: universal xss in blink
https://notcve.org/view.php?id=CVE-2016-5181
18 Oct 2016 — Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted execution of v8 microtasks while the DOM was in an inconsistent state, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages. Blink en Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux; 54.0.2840.85 para Android permite la ejecución de microtareas v8 mientras la DOM está en un estado inconsistente, lo que permite a un atacante remo... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5187 – chromium-browser: url spoofing
https://notcve.org/view.php?id=CVE-2016-5187
18 Oct 2016 — Google Chrome prior to 54.0.2840.85 for Android incorrectly handled rapid transition into and out of full screen mode, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages. Google Chrome en versiones previas a 54.0.2840.85 para Android maneja incorrectamente transición rápida de entrada y salida del modo de pantalla completa, lo que permite a un atacante remoto suplantar los contenidos de la Omnibox (barra de URL) a través de páginas HTML manipuladas. It was ... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5188 – chromium-browser: ui spoofing
https://notcve.org/view.php?id=CVE-2016-5188
18 Oct 2016 — Multiple issues in Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux allow a remote attacker to spoof various parts of browser UI via crafted HTML pages. Múltiples problemas en Blink en Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux permiten a un atacante remoto suplantar varias partes de la interfaz de usuario del navegador a través de páginas HTML manipuladas. It was discovered that a long running unload handler could cause an incognito profile to be reu... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5192 – chromium-browser: cross-origin bypass in blink
https://notcve.org/view.php?id=CVE-2016-5192
18 Oct 2016 — Blink in Google Chrome prior to 54.0.2840.59 for Windows missed a CORS check on redirect in TextTrackLoader, which allowed a remote attacker to bypass cross-origin restrictions via crafted HTML pages. Blink en Google Chrome en versiones previas a 54.0.2840.59 para Windows falla una comprobación CORS en redirect en TextTrackLoader, lo que permite a un atacante remoto eludir restricciones de origen cruzado a través de páginas HTML manipuladas. It was discovered that a long running unload handler could cause a... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5183 – chromium-browser: use after free in pdfium
https://notcve.org/view.php?id=CVE-2016-5183
18 Oct 2016 — A heap use after free in PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android allows a remote attacker to potentially exploit heap corruption via crafted PDF files. Un uso después de liberación de memoria en PDFium en Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux; 54.0.2840.85 para Android permite a un atacante remoto explotar potencialmente una corrupción de memoria a través de archivos PDF manipulados. Chromium is an open-source ... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-416: Use After Free •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5186 – chromium-browser: out of bounds read in devtools
https://notcve.org/view.php?id=CVE-2016-5186
18 Oct 2016 — Devtools in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled objects after a tab crash, which allowed a remote attacker to perform an out of bounds memory read via crafted PDF files. Devtools en Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux; 54.0.2840.85 para Android maneja incorrectamente objetos después de una caída de pestaña, lo que permite a un atacante remoto llevar a cabo una lectura de memoria fuera de límites... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-125: Out-of-bounds Read •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5185 – chromium-browser: use after free in blink
https://notcve.org/view.php?id=CVE-2016-5185
18 Oct 2016 — Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly allowed reentrance of FrameView::updateLifecyclePhasesInternal(), which allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages. Blink en Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux; 54.0.2840.85 para Android incorrectamente permite la reentrada de FrameView::updateLifecyclePhasesInternal(), lo que permite a un atacante remoto llevar ... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-416: Use After Free •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5190 – chromium-browser: use after free in internals
https://notcve.org/view.php?id=CVE-2016-5190
18 Oct 2016 — Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles during shutdown, which allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages. Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux; 54.0.2840.85 para Android maneja incorrectamente los ciclos de vida de objetos durante el apagado, lo que permite a un atacante remoto llevar a cabo una lectura de memoria fuera de límites a tra... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-416: Use After Free •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5191 – chromium-browser: universal xss in bookmarks
https://notcve.org/view.php?id=CVE-2016-5191
18 Oct 2016 — Bookmark handling in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation of supplied data, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages, as demonstrated by an interpretation conflict between userinfo and scheme in an http://javascript:payload@example.com URL. El manejo de etiquetas en Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux; 54.0.2840.85 para Android tien... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5189 – chromium-browser: url spoofing
https://notcve.org/view.php?id=CVE-2016-5189
18 Oct 2016 — Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted navigation to blob URLs with non-canonical origins, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages. Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux; 54.0.2840.85 para Android permite la navegación para borrar URLs con orígenes irregulares, lo que permite a un atacante remoto suplantar contenidos de la Omnibox (barra de URL) a t... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-284: Improper Access Control •