CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1267 – chromium-browser: Cross-origin bypass in Blink
https://notcve.org/view.php?id=CVE-2015-1267
25 Jun 2015 — Blink, as used in Google Chrome before 43.0.2357.130, does not properly restrict the creation context during creation of a DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that uses a Blink public API, related to WebArrayBufferConverter.cpp, WebBlob.cpp, WebDOMError.cpp, and WebDOMFileSystem.cpp. Blink, utilizado en Google Chrome anterior a 43.0.2357.130, no restringe correctamente el contexto de la creación durante la creación de un envoltorio DOM, lo ... • http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.html • CWE-254: 7PK - Security Features •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2015-1261 – chromium-browser: URL bar spoofing in unspecified component
https://notcve.org/view.php?id=CVE-2015-1261
20 May 2015 — android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or deliver misleading popup content via crafted text. android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java en Google Chrome anterior a 43.0.2357.65 en Android no restringe correctamente el uso de el identificador de frag... • http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 2%CPEs: 2EXPL: 1CVE-2015-1265 – Google Chrome 43.0 - Certificate MIME Handling Integer Overflow
https://notcve.org/view.php?id=CVE-2015-1265
20 May 2015 — Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google Chrome anterior a 43.0.2357.65 permiten a atacantes causar una denegación de servicio o posiblemente tener otro impacto a través de vectores desconocidos. Several security issues were discovered in the DOM implementation in Blink. If a user were tricked in to opening a specially crafted ... • https://www.exploit-db.com/exploits/37766 •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2015-1264 – chromium-browser: Cross-site scripting in bookmarks.
https://notcve.org/view.php?id=CVE-2015-1264
20 May 2015 — Cross-site scripting (XSS) vulnerability in Google Chrome before 43.0.2357.65 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted data that is improperly handled by the Bookmarks feature. Vulnerabilidad de XSS en Google Chrome anterior a 43.0.2357.65 permite a atacantes remotos asistidos por usuario inyectar secuencias de comandos web arbitrarios o HTMl a través de datos manipulados que son manejados incorrectamente por la característica de favoritos (Bookmarks). Chromiu... • http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2015-1254 – chromium-browser: Cross-origin bypass in Editing.
https://notcve.org/view.php?id=CVE-2015-1254
20 May 2015 — core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing. core/dom/Document.cpp en Blink, utilizado en Google Chrome anterior a 43.0.2357.65, habilita la herencia del atributo designMode, lo que permite a atacantes remotos evadir Same Origin Policy mediante el aprovechamiento de la disponibilidad de la edición. Several security iss... • http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.1EPSS: 2%CPEs: 2EXPL: 0CVE-2015-1252 – chromium-browser: Sandbox escape in Chrome.
https://notcve.org/view.php?id=CVE-2015-1252
20 May 2015 — common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions. common/partial_circular_buffer.cc en Google Chrome anterior a 43.0.2357.65 no maneja correctamente los envoltorios, lo que pe... • http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2015-3910 – Ubuntu Security Notice USN-2610-1
https://notcve.org/view.php?id=CVE-2015-3910
20 May 2015 — Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google V8 anterior a 4.3.61.21, utilizado en Google Chrome anterior a 43.0.2357.65, permiten a atacantes causar una denegación de servicio o posiblemente tener otro impacto a través de vectores desconocidos. Several security issues were discovered in the ... • http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html •
CVSS: 7.8EPSS: 6%CPEs: 2EXPL: 0CVE-2015-1256 – chromium-browser: Use-after-free in SVG.
https://notcve.org/view.php?id=CVE-2015-1256
20 May 2015 — Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that leverages improper handling of a shadow tree for a use element. Vulnerabilidad de uso después de liberación en la implementación SVG en Blink, utilizado en Google Chrome anterior a 43.0.2357.65, permite a atacantes remotos causar una denegación de servicio o posiblemente tener ... • http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2015-1263 – chromium-browser: insecure download of spellcheck dictionary in unspecified component
https://notcve.org/view.php?id=CVE-2015-1263
20 May 2015 — The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file. La implementación Spellcheck API en Google Chrome anterior a 43.0.2357.65 no utiliza una sesión HTTPS para descargar un diccionario Hunspell, lo que permite a atacantes man-in-the-middle entregar sugerencias de ortografía incor... • http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html • CWE-17: DEPRECATED: Code •
CVSS: 7.8EPSS: 2%CPEs: 2EXPL: 0CVE-2015-1257 – chromium-browser: Container-overflow in SVG.
https://notcve.org/view.php?id=CVE-2015-1257
20 May 2015 — platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (container overflow) or possibly have unspecified other impact via a crafted document. platform/graphics/filters/FEColorMatrix.cpp en la implementación SVG en Blink, utilizado en Google Chrome anterior a 43.0.2357.65, no maneja correctamente... • http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •