CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2018-16084 – chromium-browser: User confirmation bypass in external protocol handling
https://notcve.org/view.php?id=CVE-2018-16084
The default selected dialog button in CustomHandlers in Google Chrome prior to 69.0.3497.81 allowed a remote attacker who convinced the user to perform certain operations to open external programs via a crafted HTML page. El botón de diálogo seleccionado por defecto en CustomHandlers en Google Chrome, en versiones anteriores a la 69.0.3497.81, permitía que un atacante remoto, que hubiese convencido a un usuario para que realizase ciertas operaciones, abriese programas externos mediante una página HTML manipulada. • http://www.securityfocus.com/bid/105215 https://access.redhat.com/errata/RHSA-2018:2666 https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html https://crbug.com/865202 https://security.gentoo.org/glsa/201811-10 https://access.redhat.com/security/cve/CVE-2018-16084 https://bugzilla.redhat.com/show_bug.cgi?id=1625487 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-16085 – chromium-browser: Use after free in Memory Instrumentation
https://notcve.org/view.php?id=CVE-2018-16085
A use after free in ResourceCoordinator in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un uso de memoria previamente liberada en ResourceCoordinator en Google Chrome, en versiones anteriores a la 69.0.3497.81, permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante una página HTML manipulada. • http://www.securityfocus.com/bid/105215 https://access.redhat.com/errata/RHSA-2018:2666 https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html https://crbug.com/856578 https://security.gentoo.org/glsa/201811-10 https://access.redhat.com/security/cve/CVE-2018-16085 https://bugzilla.redhat.com/show_bug.cgi?id=1625488 • CWE-416: Use After Free CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-15406 – chromium-browser: stack overflow in v8
https://notcve.org/view.php?id=CVE-2017-15406
A stack buffer overflow in V8 in Google Chrome prior to 62.0.3202.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Un desbordamiento de búfer basado en pila en V8 en Google Chrome, en versiones anteriores a la 62.0.3202.75, permitía que un atacante remoto pudiese realizar una lectura de memoria fuera de límites mediante una página HTML manipulada. • https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html https://crbug.com/770450 https://access.redhat.com/security/cve/CVE-2017-15406 https://bugzilla.redhat.com/show_bug.cgi?id=1506942 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-15430
https://notcve.org/view.php?id=CVE-2017-15430
Insufficient data validation in Chromecast plugin in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. La insuficiente validación de datos en el plugin Chromecast en Google Chrome antes del 63.0.3239.84 permitió a un atacante remoto inyectar scripts arbitrarios o HTML (UXSS) a través de una página HTML diseñada. • https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/780484 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6160
https://notcve.org/view.php?id=CVE-2018-6160
JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. El manejo de alertas de JavaScript en Prompts en Google Chrome, en versiones anteriores a la 68.0.3440.75, permitía que un atacante remoto suplantase el contenido de Omnibox (barra de direcciones) mediante una página HTML manipulada. • http://www.securityfocus.com/bid/104887 https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html https://crbug.com/839822 https://security.gentoo.org/glsa/201808-01 • CWE-20: Improper Input Validation •