CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2015-1235 – chromium-browser: Cross-origin-bypass in HTML parser
https://notcve.org/view.php?id=CVE-2015-1235
17 Apr 2015 — The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in the HTML parser in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy via a crafted HTML document with an IFRAME element. La función ContainerNode::parserRemoveChild en core/dom/ContainerNode.cpp en el analizador sintáctico de HTML en Blink, utilizado en Google Chrome anterior a 42.0.2311.90, permite a atacantes remotos evadir Same Origin Policy a través de un documento H... • http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html • CWE-264: Permissions, Privileges, and Access Controls CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2015-1249 – chromium-browser: Various fixes from internal audits, fuzzing and other initiatives
https://notcve.org/view.php?id=CVE-2015-1249
17 Apr 2015 — Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.90 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google Chrome anterior a 42.0.2311.90 permiten a atacantes causar una denegación de servicio o posiblemente tener otro impacto a través de vectores desconocidos. Chromium is an open-source web browser, powered by WebKit. Several flaws were found in the processing of malformed web content. A web... • http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html • CWE-122: Heap-based Buffer Overflow •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2015-1248 – chromium-browser: SafeBrowsing bypass
https://notcve.org/view.php?id=CVE-2015-1248
17 Apr 2015 — The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the SafeBrowsing for Executable Files protection mechanism by creating a .exe file in a temporary filesystem and then referencing this file with a filesystem:http: URL. La API FileSystem en Google Chrome anterior a 40.0.2214.91 permite a atacantes remotos evadir el mecanismo de protección de la navegación segura para ficheros ejecutables (SafeBrowsing for Executable Files) mediante la creación de un fichero .exe en un ... • http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html • CWE-264: Permissions, Privileges, and Access Controls CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 1%CPEs: 2EXPL: 0CVE-2015-1245 – chromium-browser: Use-after-free in PDFium
https://notcve.org/view.php?id=CVE-2015-1245
17 Apr 2015 — Use-after-free vulnerability in the OpenPDFInReaderView::Update function in browser/ui/views/location_bar/open_pdf_in_reader_view.cc in Google Chrome before 41.0.2272.76 might allow user-assisted remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by triggering interaction with a PDFium "Open PDF in Reader" button that has an invalid tab association. Vulnerabilidad de uso después de liberación en la función OpenPDFInReaderView::Update en browser/u... • http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html • CWE-416: Use After Free •
CVSS: 8.8EPSS: 2%CPEs: 6EXPL: 0CVE-2015-1242 – chromium-browser: Type confusion in V8
https://notcve.org/view.php?id=CVE-2015-1242
17 Apr 2015 — The ReduceTransitionElementsKind function in hydrogen-check-elimination.cc in Google V8 before 4.2.77.8, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that leverages "type confusion" in the check-elimination optimization. La función ReduceTransitionElementsKind en hydrogen-check-elimination.cc en Google V8 anterior a 4.2.77.8, utilizado en Google Chrome anterior a 42.0.2311.90, permite ... • http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html • CWE-704: Incorrect Type Conversion or Cast •
CVSS: 7.8EPSS: 2%CPEs: 5EXPL: 0CVE-2015-1237 – chromium-browser: Use-after-free in IPC
https://notcve.org/view.php?id=CVE-2015-1237
17 Apr 2015 — Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in content/renderer/render_frame_impl.cc in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages during a detach operation. Vulnerabilidad de uso después de liberación en la función RenderFrameImpl::OnMessageReceived en content/renderer/render_frame_impl.cc en Google Chrome anterior a 42.0.2311.90 permite a ... • http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2015-1236 – chromium-browser: Cross-origin-bypass in Blink
https://notcve.org/view.php?id=CVE-2015-1236
17 Apr 2015 — The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a crafted web site containing a media element. La función MediaElementAudioSourceNode::process en modules/webaudio/MediaElementAudioSourceNode.cpp en la implementación Web Audio API en Blink, utilizado en Google Chro... • http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html • CWE-264: Permissions, Privileges, and Access Controls CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2015-1244 – chromium-browser: HSTS bypass in WebSockets
https://notcve.org/view.php?id=CVE-2015-1244
17 Apr 2015 — The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for WebSocket traffic. La función URLRequest::GetHSTSRedirect en url_request/url_request.cc en Google Chrome anterior a 42.0.2311.90 no remplaza el esquema wss cuando una política HSTS está activada, lo que facilita a a... • http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-305: Authentication Bypass by Primary Weakness •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2015-1247 – chromium-browser: Scheme issues in OpenSearch
https://notcve.org/view.php?id=CVE-2015-1247
17 Apr 2015 — The SearchEngineTabHelper::OnPageHasOSDD function in browser/ui/search_engines/search_engine_tab_helper.cc in Google Chrome before 42.0.2311.90 does not prevent use of a file: URL for an OpenSearch descriptor XML document, which might allow remote attackers to obtain sensitive information from local files via a crafted (1) http or (2) https web site. La función SearchEngineTabHelper::OnPageHasOSDD en browser/ui/search_engines/search_engine_tab_helper.cc en Google Chrome anterior a 42.0.2311.90 no previene e... • http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-305: Authentication Bypass by Primary Weakness •
CVSS: 7.8EPSS: 1%CPEs: 5EXPL: 0CVE-2015-1240 – chromium-browser: Out-of-bounds read in WebGL
https://notcve.org/view.php?id=CVE-2015-1240
17 Apr 2015 — gpu/blink/webgraphicscontext3d_impl.cc in the WebGL implementation in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WebGL program that triggers a state inconsistency. gpu/blink/webgraphicscontext3d_impl.cc en la implementación WebGL en Google Chrome anterior a 42.0.2311.90 permite a atacantes remotos causar una denegación de servicio (lectura fuera de rango) a través de un programa WebGL manipulado que provoca una inconsistencia de ... • http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •