CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2019-5773 – chromium-browser: Insufficient data validation in IndexedDB
https://notcve.org/view.php?id=CVE-2019-5773
Insufficient origin validation in IndexedDB in Google Chrome prior to 72.0.3626.81 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. La validación de origen insuficiente en IndexedDB en Google Chrome, en versiones anteriores a la 72.0.3626.81, permitía a un atacante, que comprometió el proceso de renderización, omitir la política del mismo origen mediante una página HTML manipulada. • http://www.securityfocus.com/bid/106767 https://access.redhat.com/errata/RHSA-2019:0309 https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html https://crbug.com/917668 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JVFHYCJGMZQUKYSIE2BXE4NLEGFGUXU5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQOP53LXXPRGD4N5OBKGQTSMFXT32LF6 https://www.debian.org/security/2019/dsa-4395 https://access.redhat.com&# • CWE-346: Origin Validation Error •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2019-5778 – chromium-browser: Insufficient policy enforcement in Extensions
https://notcve.org/view.php?id=CVE-2019-5778
A missing case for handling special schemes in permission request checks in Extensions in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to install a malicious extension to bypass extension permission checks for privileged pages via a crafted Chrome Extension. La falta de un caso para la gestión de esquemas especiales en las comprobaciones de peticiones de permisos en Extensions en Google Chrome, en versiones anteriores a la 72.0.3626.81, permitía a un atacante, que convenció a un usuario para instalar una extensión maliciosa, omitir las comprobaciones de permisos de extensión para páginas privilegiadas mediante una extensión de Chrome manipulada. • http://www.securityfocus.com/bid/106767 https://access.redhat.com/errata/RHSA-2019:0309 https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html https://crbug.com/918470 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JVFHYCJGMZQUKYSIE2BXE4NLEGFGUXU5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQOP53LXXPRGD4N5OBKGQTSMFXT32LF6 https://www.debian.org/security/2019/dsa-4395 https://access.redhat.com&# • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-15428
https://notcve.org/view.php?id=CVE-2017-15428
Insufficient data validation in V8 builtins string generator could lead to out of bounds read and write access in V8 in Google Chrome prior to 62.0.3202.94 and allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Una validación de datos insuficiente en V8 builtins string generator podría provocar un acceso de lectura y escritura hasta V8 en Google Chome, en versiones anteriores a la 62.0.3202.94, permitió que un atacante remoto ejecutara código arbitrario en un sandbox mediante una página HTML manipulada. • https://github.com/w1ldb1t/CVE-2017-15428 https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop_13.html https://crbug.com/782145 • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-6117 – chromium-browser: Confusing autofill settings
https://notcve.org/view.php?id=CVE-2018-6117
Confusing settings in Autofill in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Las opciones confusas en Autofill en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitían que un atacante remoto pudiese obtener información potencialmente sensible del la memoria del proceso mediante una página HTML manipulada. • http://www.securityfocus.com/bid/103917 https://access.redhat.com/errata/RHSA-2018:1195 https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html https://crbug.com/822465 https://security.gentoo.org/glsa/201804-22 https://www.debian.org/security/2018/dsa-4182 https://access.redhat.com/security/cve/CVE-2018-6117 https://bugzilla.redhat.com/show_bug.cgi?id=1568797 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20071
https://notcve.org/view.php?id=CVE-2018-20071
Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to install a service worker for a domain that can host attacker controled files via a crafted HTML page. Las comprobaciones de origen poco estrictas durante la instalación de la aplicación de pagos JIT en Payments en Google Chrome, en versiones anteriores a la 70.0.3538.67, permitían que un atacante remoto instalase un trabajador del servicio para un dominio que puede alojar archivos controlados por el atacante mediante una página HTML manipulada. • https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html https://crbug.com/853937 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •