CVSS: 6.8EPSS: 0%CPEs: 8EXPL: 0CVE-2015-1286 – chromium-browser: UXSS in blink.
https://notcve.org/view.php?id=CVE-2015-1286
23 Jul 2015 — Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler.cc in Google Chrome before 44.0.2403.89 allows remote attackers to inject arbitrary web script or HTML by leveraging the lack of a certain V8 context restriction, aka a Blink "Universal XSS (UXSS)." Vulnerabilidad de XSS en la función V8ContextNativeHandler::GetModuleSystem en extensions/renderer/v8_context_native_handler.cc en Google Chrome en versiones anteriore... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2015-1287 – chromium-browser: SOP bypass with CSS in unspecified
https://notcve.org/view.php?id=CVE-2015-1287
23 Jul 2015 — Blink, as used in Google Chrome before 44.0.2403.89, enables a quirks-mode exception that limits the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to core/fetch/CSSStyleSheetResource.cpp. Vulnerabilidad en Blink implementado en Google Chrome en versiones anteriores a la 44.0.2403.89, habilita una excepción en el quirks-mode que limita los casos en los que un ... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-17: DEPRECATED: Code •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2015-1288 – chromium-browser: Spell checking dictionaries fetched over HTTP in unspecified
https://notcve.org/view.php?id=CVE-2015-1288
23 Jul 2015 — The Spellcheck API implementation in Google Chrome before 44.0.2403.89 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file, a related issue to CVE-2015-1263. Vulnerabilidad en la implementación de Spellcheck API en Google Chrome en versiones anteriores a la 44.0.2403.89, no usa una sesión HTTPS para la descarga de un diccionario Hunspell, lo cual pe... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-17: DEPRECATED: Code •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2015-1289 – chromium-browser: Various fixes from internal audits, fuzzing and other initiatives
https://notcve.org/view.php?id=CVE-2015-1289
23 Jul 2015 — Multiple unspecified vulnerabilities in Google Chrome before 44.0.2403.89 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google Chrome en versiones anteriores a la 44.0.2403.89, permite a atacantes causar una denegación de servicio o posiblemente tener otro impacto no especificado a través de vectores desconocidos. • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1266 – chromium-browser: Scheme validation error in WebUI
https://notcve.org/view.php?id=CVE-2015-1266
25 Jun 2015 — content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated with a WebUI SiteInstance, which allows remote attackers to bypass intended access restrictions via a similar URL, as demonstrated by use of http://gpu when there is a WebUI class for handling chrome://gpu requests. content/browser/webui/content_web_ui_controller_factory.cc en Google Chrome anterior a 43.0.2357.130 no considera corr... • http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.html • CWE-254: 7PK - Security Features •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1267 – chromium-browser: Cross-origin bypass in Blink
https://notcve.org/view.php?id=CVE-2015-1267
25 Jun 2015 — Blink, as used in Google Chrome before 43.0.2357.130, does not properly restrict the creation context during creation of a DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that uses a Blink public API, related to WebArrayBufferConverter.cpp, WebBlob.cpp, WebDOMError.cpp, and WebDOMFileSystem.cpp. Blink, utilizado en Google Chrome anterior a 43.0.2357.130, no restringe correctamente el contexto de la creación durante la creación de un envoltorio DOM, lo ... • http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.html • CWE-254: 7PK - Security Features •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1268 – chromium-browser: Cross-origin bypass in Blink
https://notcve.org/view.php?id=CVE-2015-1268
25 Jun 2015 — bindings/scripts/v8_types.py in Blink, as used in Google Chrome before 43.0.2357.130, does not properly select a creation context for a return value's DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code, as demonstrated by use of a data: URL. bindings/scripts/v8_types.py en Blink, utilizado en Google Chrome anterior a 43.0.2357.130, no selecciona correctamente un contexto de la creación para el envoltorio DOM de un valor de retorno, lo que permite a atacan... • http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.html • CWE-254: 7PK - Security Features •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1269 – chromium-browser: Normalization error in HSTS/HPKP preload list
https://notcve.org/view.php?id=CVE-2015-1269
25 Jun 2015 — The DecodeHSTSPreloadRaw function in net/http/transport_security_state.cc in Google Chrome before 43.0.2357.130 does not properly canonicalize DNS hostnames before making comparisons to HSTS or HPKP preload entries, which allows remote attackers to bypass intended access restrictions via a string that (1) ends in a . (dot) character or (2) is not entirely lowercase. La función DecodeHSTSPreloadRaw en net/http/transport_security_state.cc en Google Chrome anterior a 43.0.2357.130 no canonicaliza correctamente... • http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.html • CWE-254: 7PK - Security Features •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2015-3910
https://notcve.org/view.php?id=CVE-2015-3910
20 May 2015 — Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google V8 anterior a 4.3.61.21, utilizado en Google Chrome anterior a 43.0.2357.65, permiten a atacantes causar una denegación de servicio o posiblemente tener otro impacto a través de vectores desconocidos. • http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html •
CVSS: 9.1EPSS: 2%CPEs: 2EXPL: 0CVE-2015-1252 – chromium-browser: Sandbox escape in Chrome.
https://notcve.org/view.php?id=CVE-2015-1252
20 May 2015 — common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions. common/partial_circular_buffer.cc en Google Chrome anterior a 43.0.2357.65 no maneja correctamente los envoltorios, lo que pe... • http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •