CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2016-1672 – chromium-browser: cross-origin bypass in extension bindings
https://notcve.org/view.php?id=CVE-2016-1672
01 Jun 2016 — The ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the extension bindings in Google Chrome before 51.0.2704.63 mishandles properties, which allows remote attackers to conduct bindings-interception attacks and bypass the Same Origin Policy via unspecified vectors. La función ModuleSystem::RequireForJsInner en extensions/renderer/module_system.cc en las extensiones vinculantes en Google Chrome en versiones anteriores a 51.0.2704.63 no maneja correctamente las propiedades, ... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-254: 7PK - Security Features CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 1%CPEs: 11EXPL: 0CVE-2016-1673 – chromium-browser: cross-origin bypass in blink
https://notcve.org/view.php?id=CVE-2016-1673
01 Jun 2016 — Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy via unspecified vectors. Blink, como es usado en Google Chrome en versiones anteriores a 51.0.2704.63 permite a atacantes remotos eludir la Same Origin Policy a través de vectores no especificados. An unspecified security issue was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. An i... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html •
CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2016-1674 – chromium-browser: cross-origin bypass in extensions
https://notcve.org/view.php?id=CVE-2016-1674
01 Jun 2016 — The extensions subsystem in Google Chrome before 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified vectors. El subsistema de extensiones en Google Chrome en versiones anteriores a 51.0.2704.63 permite a atacantes remotos eludir la Same Origin Policy a través de vectores no especificados. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 51.0.2704.63. Security Fix: Multiple flaws were found in the processing of malformed we... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html •
CVSS: 8.8EPSS: 1%CPEs: 11EXPL: 0CVE-2016-1675 – chromium-browser: cross-origin bypass in blink
https://notcve.org/view.php?id=CVE-2016-1675
01 Jun 2016 — Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy by leveraging the mishandling of Document reattachment during destruction, related to FrameLoader.cpp and LocalFrame.cpp. Blink, tal como se utiliza en Google Chrome en versiones anteriores a 51.0.2704.63, permite a atacantes remotos eludir la Same Origin Policy aprovechando el manejo incorrecto de la reinserción de documentos durante la destrucción, relacionado con FrameLoader.cpp y LocalFrame.cpp.... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2016-1676 – chromium-browser: cross-origin bypass in extension bindings
https://notcve.org/view.php?id=CVE-2016-1676
01 Jun 2016 — extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.63 does not properly use prototypes, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors. extensions/renderer/resources/binding.js en las extensiones vinculantes en Google Chrome en versiones anteriores a 51.0.2704.63 no utiliza adecuadamente prototipos, lo que permite a atacantes remotos eludir la Same Origin Policy a través de vectores no especificados. Chromium is an ope... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-284: Improper Access Control •
CVSS: 6.5EPSS: 0%CPEs: 12EXPL: 0CVE-2016-1677 – chromium-browser: type confusion in v8
https://notcve.org/view.php?id=CVE-2016-1677
01 Jun 2016 — uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain sensitive information by calling the decodeURI function and leveraging "type confusion." uri.js en Google V8 en versiones anteriores a 5.1.281.26, como es usado en Google Chrome en versiones anteriores a 51.0.2704.63, usa un tipo de matriz incorrecto, lo que permite a atacantes remotos obtener información sensible llamando a la función decodeURI y aprovec... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 1%CPEs: 12EXPL: 0CVE-2016-1678 – chromium-browser: heap overflow in v8
https://notcve.org/view.php?id=CVE-2016-1678
01 Jun 2016 — objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JavaScript code. objects.cc en Google V8 en versiones anteriores a 5.0.71.32, como es usado en Google Chrome en versiones anteriores a 51.0.2704.63, no restringe adecuadamente el empeoramiento descuidado, lo que permite a atacantes re... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 2%CPEs: 11EXPL: 0CVE-2016-1679 – chromium-browser: heap use-after-free in v8 bindings
https://notcve.org/view.php?id=CVE-2016-1679
01 Jun 2016 — The ToV8Value function in content/child/v8_value_converter_impl.cc in the V8 bindings in Google Chrome before 51.0.2704.63 does not properly restrict use of getters and setters, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code. La función ToV8Value en content/child/v8_value_converter_impl.cc en los vínculos V8 en Google Chrome en versiones anteriores a 51.0.2704.63 no restringe adecuadamente el uso de captadores... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html •
CVSS: 8.8EPSS: 2%CPEs: 11EXPL: 0CVE-2016-1680 – chromium-browser: heap use-after-free in skia
https://notcve.org/view.php?id=CVE-2016-1680
01 Jun 2016 — Use-after-free vulnerability in ports/SkFontHost_FreeType.cpp in Skia, as used in Google Chrome before 51.0.2704.63, allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via unknown vectors. Vulnerabilidad de uso después de liberación de memoria en ports/SkFontHost_FreeType.cpp en Skia, como es usado en Google Chrome en versiones anteriores a 51.0.2704.63, permite a atacantes remotos provocar una denegación del servicio (corrupción de la mem... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2016-1681 – chromium-browser: heap overflow in pdfium
https://notcve.org/view.php?id=CVE-2016-1681
01 Jun 2016 — Heap-based buffer overflow in the opj_j2k_read_SPCod_SPCoc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 51.0.2704.63, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document. Desbordamiento de buffer basado en memoria dinámica en la función opj_j2k_read_SPCod_SPCoc en OpenJPEG, como es usado en PDFium en Google Chrome en versiones anteriores a 51.0.2704.63, permite a atacantes remotos provocar una denegación de ser... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •