CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2018-6151 – chromium-browser: Bad cast in DevTools
https://notcve.org/view.php?id=CVE-2018-6151
Bad cast in DevTools in Google Chrome on Win, Linux, Mac, Chrome OS prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted Chrome Extension. Una mala conversión en DevTools en Google Chrome, en versiones anteriores a la 66.0.3359.117 para Windows, Linux, Mac y Chrome OS, permitía que un atacante, que hubiese convencido a un usuario para que instale una extensión maliciosa, realizase una lectura de memoria fuera de límites mediante una extensión de Chrome manipulada. • http://www.securityfocus.com/bid/104887 https://access.redhat.com/errata/RHSA-2018:2282 https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html https://crbug.com/805905 https://security.gentoo.org/glsa/201808-01 https://www.debian.org/security/2018/dsa-4256 https://access.redhat.com/security/cve/CVE-2018-6151 https://bugzilla.redhat.com/show_bug.cgi?id=1608207 • CWE-125: Out-of-bounds Read •
CVSS: 8.8EPSS: 1%CPEs: 16EXPL: 0CVE-2018-5007 – Adobe Flash NetConnection Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-5007
Adobe Flash Player 30.0.0.113 and earlier versions have a Type Confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user. Adobe Flash Player, en versiones 30.0.0.113 y anteriores, tiene una vulnerabilidad de confusión de tipos. Su explotación con éxito podría permitir la ejecución arbitraria de código en el contexto del usuario actual. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash. • http://www.securityfocus.com/bid/104698 http://www.securitytracker.com/id/1041248 https://access.redhat.com/errata/RHSA-2018:2175 https://helpx.adobe.com/security/products/flash-player/apsb18-24.html https://access.redhat.com/security/cve/CVE-2018-5007 https://bugzilla.redhat.com/show_bug.cgi?id=1599810 • CWE-704: Incorrect Type Conversion or Cast •
CVSS: 7.5EPSS: 0%CPEs: 16EXPL: 0CVE-2018-5008 – flash-plugin: Information Disclosure vulnerability (APSB18-24)
https://notcve.org/view.php?id=CVE-2018-5008
Adobe Flash Player 30.0.0.113 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. Adobe Flash Player, en versiones 30.0.0.113 y anteriores, tiene una vulnerabilidad de lectura fuera de límites. Su explotación con éxito podría resultar en una divulgación de información. • http://www.securityfocus.com/bid/104698 http://www.securitytracker.com/id/1041248 https://access.redhat.com/errata/RHSA-2018:2175 https://helpx.adobe.com/security/products/flash-player/apsb18-24.html https://access.redhat.com/security/cve/CVE-2018-5008 https://bugzilla.redhat.com/show_bug.cgi?id=1599811 • CWE-125: Out-of-bounds Read •
CVSS: 10.0EPSS: 4%CPEs: 16EXPL: 0CVE-2018-5002 – Adobe Flash Player Stack-based Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2018-5002
Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user. Adobe Flash Player en versiones 29.0.0.171 y anteriores tiene una vulnerabilidad de desbordamiento de búfer basado en pila. Su explotación con éxito podría permitir la ejecución de código arbitrario en el contexto del usuario actual. Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution. • http://www.securityfocus.com/bid/104412 http://www.securitytracker.com/id/1041058 https://access.redhat.com/errata/RHSA-2018:1827 https://helpx.adobe.com/security/products/flash-player/apsb18-19.html https://security.gentoo.org/glsa/201806-02 https://access.redhat.com/security/cve/CVE-2018-5002 https://bugzilla.redhat.com/show_bug.cgi?id=1588501 • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-6147 – chromium-browser: Password fields not taking advantage of OS protections in Views
https://notcve.org/view.php?id=CVE-2018-6147
Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to obtain potentially sensitive information from process memory via a local process. La falta de un modo seguro de introducción de texto en Browser UI en Google Chrome, en versiones anteriores a la 67.0.3396.62, permitía que un atacante local pudiese obtener información potencialmente sensible del la memoria del proceso mediante un proceso local. • http://www.securityfocus.com/bid/104309 http://www.securitytracker.com/id/1041014 https://access.redhat.com/errata/RHSA-2018:1815 https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html https://crbug.com/818133 https://www.debian.org/security/2018/dsa-4237 https://access.redhat.com/security/cve/CVE-2018-6147 https://bugzilla.redhat.com/show_bug.cgi?id=1584058 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •