CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6784 – chromium-browser: Escaping issue in saved pages
https://notcve.org/view.php?id=CVE-2015-6784
03 Dec 2015 — The page serializer in Google Chrome before 47.0.2526.73 mishandles Mark of the Web (MOTW) comments for URLs containing a "--" sequence, which might allow remote attackers to inject HTML via a crafted URL, as demonstrated by an initial http://example.com?-- substring. El serializador de página en Google Chrome en versiones anteriores a 47.0.2526.73 no maneja correctamente los comentarios Mark de la Web (MOTW) para URLs que contienen una secuencia '--', lo que puede permitir a atacantes remotos inyectar HTML... • http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6785 – chromium-browser: Wildcard matching issue in CSP
https://notcve.org/view.php?id=CVE-2015-6785
03 Dec 2015 — The CSPSource::hostMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Google Chrome before 47.0.2526.73 accepts an x.y hostname as a match for a *.x.y pattern, which might allow remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging a policy that was intended to be specific to subdomains. La función CSPSource::hostMatches en WebKit/Source/core/frame/csp/CSPSource.cpp en la implementación de la Co... • http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6786 – chromium-browser: Scheme bypass in CSP
https://notcve.org/view.php?id=CVE-2015-6786
03 Dec 2015 — The CSPSourceList::matches function in WebKit/Source/core/frame/csp/CSPSourceList.cpp in the Content Security Policy (CSP) implementation in Google Chrome before 47.0.2526.73 accepts a blob:, data:, or filesystem: URL as a match for a * pattern, which allows remote attackers to bypass intended scheme restrictions in opportunistic circumstances by leveraging a policy that relies on this pattern. La función CSPSourceList::matches en WebKit/Source/core/frame/csp/CSPSourceList.cpp en la implementación de la Con... • http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2015-1302 – chromium-browser: information leak in PDF viewer
https://notcve.org/view.php?id=CVE-2015-1302
11 Nov 2015 — The PDF viewer in Google Chrome before 46.0.2490.86 does not properly restrict scripting messages and API exposure, which allows remote attackers to bypass the Same Origin Policy via an unintended embedder or unintended plugin loading, related to pdf.js and out_of_process_instance.cc. El visor PDF en Google Chrome en versiones anteriores a 46.0.2490.86 no restringe adecuadamente mensajes de programación de secuencias de comandos y la exposición de la API, lo que permite a atacantes remotos eludir la Same Or... • http://googlechromereleases.blogspot.com/2015/11/stable-channel-update.html • CWE-20: Improper Input Validation CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2015-7834
https://notcve.org/view.php?id=CVE-2015-7834
15 Oct 2015 — Multiple unspecified vulnerabilities in Google V8 before 4.6.85.23, as used in Google Chrome before 46.0.2490.71, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google V8 en versiones anteriores a 4.6.85.23, como se utiliza en Google Chrome en versiones anteriores a 46.0.2490.71, permite a atacantes provocar una denegación de servicio o posiblemente tener otro impacto a través de vectores desconocidos. • http://googlechromereleases.blogspot.com/2015/10/stable-channel-update.html •
CVSS: 7.8EPSS: 1%CPEs: 1EXPL: 0CVE-2015-6755 – chromium-browser: cross-origin bypass in Blink
https://notcve.org/view.php?id=CVE-2015-6755
15 Oct 2015 — The ContainerNode::parserInsertBefore function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 46.0.2490.71, proceeds with a DOM tree insertion in certain cases where a parent node no longer contains a child node, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code. La función ContainerNode::parserInsertBefore en core/dom/ContainerNode.cpp en Blink, como se utiliza en Google Chrome en versiones anteriores a 46.0.2490.71, procede con una inserció... • http://googlechromereleases.blogspot.com/2015/10/stable-channel-update.html • CWE-264: Permissions, Privileges, and Access Controls CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 8.8EPSS: 2%CPEs: 1EXPL: 0CVE-2015-6756 – chromium-browser: use-after-free in PDFium
https://notcve.org/view.php?id=CVE-2015-6756
15 Oct 2015 — Use-after-free vulnerability in the CPDFSDK_PageView implementation in fpdfsdk/src/fsdk_mgr.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging mishandling of a focused annotation in a PDF document. Vulnerabilidad de uso después de liberación de memoria en la implementación CPDFSDK_PageView en fpdfsdk/src/fsdk_mgr.cpp en PDFium, como se utiliza en Google Chrome en ve... • http://googlechromereleases.blogspot.com/2015/10/stable-channel-update.html • CWE-416: Use After Free •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2015-6757 – chromium-browser: Use-after-free in ServiceWorker
https://notcve.org/view.php?id=CVE-2015-6757
15 Oct 2015 — Use-after-free vulnerability in content/browser/service_worker/embedded_worker_instance.cc in the ServiceWorker implementation in Google Chrome before 46.0.2490.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging object destruction in a callback. Vulnerabilidad de uso después de liberación de memoria en content/browser/service_worker/embedded_worker_instance.cc en la implementación ServiceWorker en Google Chrome en versiones anteriores a 46.0.2490.... • http://googlechromereleases.blogspot.com/2015/10/stable-channel-update.html • CWE-416: Use After Free •
CVSS: 8.8EPSS: 2%CPEs: 1EXPL: 0CVE-2015-6758 – chromium-browser: Bad-cast in PDFium
https://notcve.org/view.php?id=CVE-2015-6758
15 Oct 2015 — The CPDF_Document::GetPage function in fpdfapi/fpdf_parser/fpdf_parser_document.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, does not properly perform a cast of a dictionary object, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document. La función CPDF_Document::GetPage en fpdfapi/fpdf_parser/fpdf_parser_document.cpp en PDFium, como se utiliza en Google Chrome en versiones anteriores a 46.0.2490.71, no lleva a cabo cor... • http://googlechromereleases.blogspot.com/2015/10/stable-channel-update.html • CWE-17: DEPRECATED: Code CWE-704: Incorrect Type Conversion or Cast •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6759 – chromium-browser: Information leakage in LocalStorage
https://notcve.org/view.php?id=CVE-2015-6759
15 Oct 2015 — The shouldTreatAsUniqueOrigin function in platform/weborigin/SecurityOrigin.cpp in Blink, as used in Google Chrome before 46.0.2490.71, does not ensure that the origin of a LocalStorage resource is considered unique, which allows remote attackers to obtain sensitive information via vectors involving a blob: URL. La función shouldTreatAsUniqueOrigin en platform/weborigin/SecurityOrigin.cpp en Blink, como se utiliza en Google Chrome en versiones anteriores a 46.0.2490.71, no asegura que el origen de un recurs... • http://googlechromereleases.blogspot.com/2015/10/stable-channel-update.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •