CVSS: 9.3EPSS: 2%CPEs: 8EXPL: 0CVE-2018-10897 – yum-utils: reposync: improper path validation may lead to directory traversal
https://notcve.org/view.php?id=CVE-2018-10897
30 Jul 2018 — A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believe... • http://www.securitytracker.com/id/1041594 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2018-6151 – chromium-browser: Bad cast in DevTools
https://notcve.org/view.php?id=CVE-2018-6151
27 Jul 2018 — Bad cast in DevTools in Google Chrome on Win, Linux, Mac, Chrome OS prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted Chrome Extension. Una mala conversión en DevTools en Google Chrome, en versiones anteriores a la 66.0.3359.117 para Windows, Linux, Mac y Chrome OS, permitía que un atacante, que hubiese convencido a un usuario para que instale una extensión maliciosa, realizase una lectura de memoria fuera d... • http://www.securityfocus.com/bid/104887 • CWE-125: Out-of-bounds Read •
CVSS: 9.6EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6152 – chromium-browser: Local file write in DevTools
https://notcve.org/view.php?id=CVE-2018-6152
27 Jul 2018 — The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page and user interaction. La implementación del backend Page.downloadBehavior marcaba incondicionalmente los archivos descargados como seguros, independientemente del tipo de archivo en Google Chrome, en versi... • http://www.securityfocus.com/bid/104887 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 0CVE-2018-6153 – chromium-browser: Stack buffer overflow in Skia
https://notcve.org/view.php?id=CVE-2018-6153
27 Jul 2018 — A precision error in Skia in Google Chrome prior to 68.0.3440.75 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. Un error de precisión en Skia en Google Chrome, en versiones anteriores a la 68.0.3440.75, permitía que un atacante remoto que hubiese comprometido el proceso renderer pudiese realizar una escritura de memoria fuera de límites mediante una página HTML manipulada. Chromium is an open-source web browser, powered by... • http://www.securityfocus.com/bid/104887 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-6158 – chromium-browser: Use after free in Blink
https://notcve.org/view.php?id=CVE-2018-6158
27 Jul 2018 — A race condition in Oilpan in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Una condición de carrera en Oilpan en Google Chrome, en versiones anteriores a la 68.0.3440.75, permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 68.0.3440.75. Issues addressed i... • http://www.securityfocus.com/bid/104887 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 8.8EPSS: 1%CPEs: 6EXPL: 0CVE-2018-6162 – chromium-browser: Heap buffer overflow in WebGL
https://notcve.org/view.php?id=CVE-2018-6162
27 Jul 2018 — Improper deserialization in WebGL in Google Chrome on Mac prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. La deserialización incorrecta en WebGL en Google Chrome, en versiones anteriores a la 68.0.3440.75 en Mac, permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 68.0.34... • http://www.securityfocus.com/bid/104887 • CWE-502: Deserialization of Untrusted Data CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-6163 – chromium-browser: URL spoof in Omnibox
https://notcve.org/view.php?id=CVE-2018-6163
27 Jul 2018 — Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. Aplicación insuficiente de caracteres confundibles en URL Formatter en Google Chrome, en versiones anteriores a la 68.0.3440.75, permitía que un atacante remoto suplantase dominios mediante homogramas IDN mediante un nombre de dominio manipulado. Chromium is an open-source web browser, powered by WebKit. This up... • http://www.securityfocus.com/bid/104887 •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-6164 – chromium-browser: Same origin policy bypass in ServiceWorker
https://notcve.org/view.php?id=CVE-2018-6164
27 Jul 2018 — Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Comprobación de origen insuficiente para el contenido CSS en Blink en Google Chrome, en versiones anteriores a la 68.0.3440.75, permitía que un atacante remoto filtrase los datos cross-origin mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 68.0.3440.75. I... • http://www.securityfocus.com/bid/104887 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-6165 – chromium-browser: URL spoof in Omnibox
https://notcve.org/view.php?id=CVE-2018-6165
27 Jul 2018 — Incorrect handling of reloads in Navigation in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. La gestión incorrecta de las recargas en Navigation en Google Chrome, en versiones anteriores a la 68.0.3440.75, permitía que un atacante remoto suplantase el contenido de Omnibox (barra de direcciones) mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to... • http://www.securityfocus.com/bid/104887 •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-6166 – chromium-browser: URL spoof in Omnibox
https://notcve.org/view.php?id=CVE-2018-6166
27 Jul 2018 — Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. Aplicación insuficiente de caracteres confundibles en URL Formatter en Google Chrome, en versiones anteriores a la 68.0.3440.75, permitía que un atacante remoto suplantase dominios mediante homogramas IDN mediante un nombre de dominio manipulado. Chromium is an open-source web browser, powered by WebKit. This up... • http://www.securityfocus.com/bid/104887 •