CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-15430
https://notcve.org/view.php?id=CVE-2017-15430
Insufficient data validation in Chromecast plugin in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. La insuficiente validación de datos en el plugin Chromecast en Google Chrome antes del 63.0.3239.84 permitió a un atacante remoto inyectar scripts arbitrarios o HTML (UXSS) a través de una página HTML diseñada. • https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/780484 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6160
https://notcve.org/view.php?id=CVE-2018-6160
JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. El manejo de alertas de JavaScript en Prompts en Google Chrome, en versiones anteriores a la 68.0.3440.75, permitía que un atacante remoto suplantase el contenido de Omnibox (barra de direcciones) mediante una página HTML manipulada. • http://www.securityfocus.com/bid/104887 https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html https://crbug.com/839822 https://security.gentoo.org/glsa/201808-01 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6173 – chromium-browser: URL spoof in Omnibox
https://notcve.org/view.php?id=CVE-2018-6173
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. Aplicación insuficiente de caracteres confundibles en URL Formatter en Google Chrome, en versiones anteriores a la 68.0.3440.75, permitía que un atacante remoto suplantase dominios mediante homogramas IDN mediante un nombre de dominio manipulado. • http://www.securityfocus.com/bid/104887 https://access.redhat.com/errata/RHSA-2018:2282 https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html https://crbug.com/836885 https://security.gentoo.org/glsa/201808-01 https://www.debian.org/security/2018/dsa-4256 https://access.redhat.com/security/cve/CVE-2018-6173 https://bugzilla.redhat.com/show_bug.cgi?id=1608197 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6150 – chromium-browser: Cross origin information disclosure in Service Workers
https://notcve.org/view.php?id=CVE-2018-6150
Incorrect handling of CORS in ServiceWorker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page. El manejo incorrecto de CORS en ServiceWorker en Google Chrome antes de 66.0.3359.117 permitió a un atacante remoto filtrar datos de origen cruzado a través de una página HTML diseñada. • https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html https://crbug.com/812667 https://access.redhat.com/security/cve/CVE-2018-6150 https://bugzilla.redhat.com/show_bug.cgi?id=1608206 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6159 – chromium-browser: Same origin policy bypass in ServiceWorker
https://notcve.org/view.php?id=CVE-2018-6159
Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. La aplicación insuficiente de políticas en ServiceWorker en Google Chrome antes de 68.0.3440.75 permitió que un atacante remoto obtuviera información potencialmente sensible de la memoria de proceso a través de una página HTML diseñada. • https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html https://crbug.com/837275 https://access.redhat.com/security/cve/CVE-2018-6159 https://bugzilla.redhat.com/show_bug.cgi?id=1608183 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •