CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-6050 – chromium-browser: url spoof in omnibox
https://notcve.org/view.php?id=CVE-2018-6050
Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. Implementación inapropiada en Omnibox en Google Chrome en versiones anteriores a la 64.0.3282.119 permitía que un atacante remoto suplantase el contenido de Omnibox (barra de direcciones) mediante una página HTML manipulada. • http://www.securityfocus.com/bid/102797 http://www.securitytracker.com/id/1040282 https://access.redhat.com/errata/RHSA-2018:0265 https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html https://crbug.com/774842 https://www.debian.org/security/2018/dsa-4103 https://access.redhat.com/security/cve/CVE-2018-6050 https://bugzilla.redhat.com/show_bug.cgi?id=1538522 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2018-6049 – chromium-browser: ui spoof in permissions
https://notcve.org/view.php?id=CVE-2018-6049
Incorrect security UI in permissions prompt in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the origin to which permission is granted via a crafted HTML page. Interfaz de usuario de seguridad incorrecta en el mensaje de permisos en Google Chrome en versiones anteriores a la 64.0.3282.119 permitía que un atacante remoto suplantase el origen al que se le otorgan los permisos mediante una página HTML manipulada. • http://www.securityfocus.com/bid/102797 http://www.securitytracker.com/id/1040282 https://access.redhat.com/errata/RHSA-2018:0265 https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html https://crbug.com/774438 https://www.debian.org/security/2018/dsa-4103 https://access.redhat.com/security/cve/CVE-2018-6049 https://bugzilla.redhat.com/show_bug.cgi?id=1538520 •
CVSS: 6.5EPSS: 2%CPEs: 6EXPL: 0CVE-2018-6038 – chromium-browser: heap buffer overflow in webgl
https://notcve.org/view.php?id=CVE-2018-6038
Heap buffer overflow in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Un desbordamiento de búfer basado en memoria dinámica (heap) en WebGL en Google Chrome en versiones anteriores a la 64.0.3282.119 permitía que un atacante remoto pudiese realizar una lectura de memoria fuera de límites mediante una página HTML manipulada. • http://www.securityfocus.com/bid/102797 http://www.securitytracker.com/id/1040282 https://access.redhat.com/errata/RHSA-2018:0265 https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html https://crbug.com/774174 https://www.debian.org/security/2018/dsa-4103 https://access.redhat.com/security/cve/CVE-2018-6038 https://bugzilla.redhat.com/show_bug.cgi?id=1538510 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2018-6051 – chromium-browser: referrer leak in xss auditor
https://notcve.org/view.php?id=CVE-2018-6051
XSS Auditor in Google Chrome prior to 64.0.3282.119, did not ensure the reporting URL was in the same origin as the page it was on, which allowed a remote attacker to obtain referrer details via a crafted HTML page. XSS Auditor en Google Chrome en versiones anteriores a la 64.0.3282.119 no aseguró que la URL de reporte estaba en el mismo origen que la página en la que estaba, lo que permitía que un atacante remoto obtuviese detalles de referrer mediante una página HTML manipulada. • http://www.securityfocus.com/bid/102797 http://www.securitytracker.com/id/1040282 https://access.redhat.com/errata/RHSA-2018:0265 https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html https://crbug.com/441275 https://www.debian.org/security/2018/dsa-4103 https://access.redhat.com/security/cve/CVE-2018-6051 https://bugzilla.redhat.com/show_bug.cgi?id=1538523 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 1%CPEs: 6EXPL: 0CVE-2018-6034 – chromium-browser: integer overflow in blink
https://notcve.org/view.php?id=CVE-2018-6034
Insufficient data validation in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Validación de datos insuficiente en WebGL en Google Chrome en versiones anteriores a la 64.0.3282.119 permitía que un atacante remoto pudiese realizar una lectura de memoria fuera de límites mediante una página HTML manipulada. • http://www.securityfocus.com/bid/102797 http://www.securitytracker.com/id/1040282 https://access.redhat.com/errata/RHSA-2018:0265 https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html https://crbug.com/784183 https://www.debian.org/security/2018/dsa-4103 https://access.redhat.com/security/cve/CVE-2018-6034 https://bugzilla.redhat.com/show_bug.cgi?id=1538506 • CWE-125: Out-of-bounds Read •