CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-17471 – chromium-browser: Security UI occlusion in full screen mode
https://notcve.org/view.php?id=CVE-2018-17471
Incorrect dialog placement in WebContents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page. La colocación incorrecta de diálogos en WebContents en Google Chrome en versiones anteriores a la 70.0.3538.67 permitía que un atacante remoto ocultase la advertencia total de pantalla mediante una página HTML manipulada. • http://www.securityfocus.com/bid/105666 https://access.redhat.com/errata/RHSA-2018:3004 https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html https://crbug.com/873080 https://security.gentoo.org/glsa/201811-10 https://www.debian.org/security/2018/dsa-4330 https://access.redhat.com/security/cve/CVE-2018-17471 https://bugzilla.redhat.com/show_bug.cgi?id=1640107 •
CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 0CVE-2018-17474 – chromium-browser: Use after free in Blink
https://notcve.org/view.php?id=CVE-2018-17474
Use after free in HTMLImportsController in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Uso de memoria previamente liberada en HTMLImportsController en Blink en Google Chrome en versiones anteriores a la 70.0.3538.67 permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante una página HTML manipulada. • http://www.securityfocus.com/bid/105666 https://access.redhat.com/errata/RHSA-2018:3004 https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html https://crbug.com/843151 https://security.gentoo.org/glsa/201811-10 https://www.debian.org/security/2018/dsa-4330 https://access.redhat.com/security/cve/CVE-2018-17474 https://bugzilla.redhat.com/show_bug.cgi?id=1640111 • CWE-416: Use After Free CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 97%CPEs: 5EXPL: 6CVE-2018-17463 – Google Chromium V8 Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-17463
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Anotación de efecto secundario en V8 en Google Chrome en versiones anteriores a la 70.0.3538.64 permitía que un atacante remoto ejecutase código arbitrario dentro de un sandbox mediante una página HTML manipulada. Google Chromium V8 Engine contains an unspecified vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. • https://www.exploit-db.com/exploits/48184 https://github.com/jhalon/CVE-2018-17463 https://github.com/kdmarti2/CVE-2018-17463 http://packetstormsecurity.com/files/156640/Google-Chrome-67-68-69-Object.create-Type-Confusion.html http://www.securityfocus.com/bid/105666 https://access.redhat.com/errata/RHSA-2018:3004 https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html https://crbug.com/888923 https://security.gentoo.org/glsa/201811-10 https://www.d •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-17459 – chromium-browser: URL Spoofing in Omnibox
https://notcve.org/view.php?id=CVE-2018-17459
Incorrect handling of clicks in the omnibox in Navigation in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. La gestión incorrecta de los clics en Omnibox (barra de direcciones) en Navigation en Google Chrome, en versiones anteriores a la 69.0.3497.92, permitía que un atacante remoto suplantase el contenido de Omnibox mediante una página HTML manipulada. • https://access.redhat.com/errata/RHSA-2018:2818 https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop_11.html https://crbug.com/880759 https://access.redhat.com/security/cve/CVE-2018-17459 https://bugzilla.redhat.com/show_bug.cgi?id=1628080 •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-17458 – chromium-browser: Function signature mismatch in WebAssembly
https://notcve.org/view.php?id=CVE-2018-17458
An improper update of the WebAssembly dispatch table in WebAssembly in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Una actualización incorrecta de la tabla "dispatch" de WebAssembly en WebAssembly en Google Chrome, en versiones anteriores a la 69.0.3497.92, permitía que un atacante remoto ejecutase código arbitrario dentro de un sandbox mediante una página HTML manipulada. • https://access.redhat.com/errata/RHSA-2018:2818 https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop_11.html https://crbug.com/875322 https://access.redhat.com/security/cve/CVE-2018-17458 https://bugzilla.redhat.com/show_bug.cgi?id=1628078 • CWE-129: Improper Validation of Array Index •