CVSS: 5.3EPSS: 0%CPEs: 11EXPL: 0CVE-2016-1692 – chromium-browser: limited cross-origin bypass in serviceworker
https://notcve.org/view.php?id=CVE-2016-1692
01 Jun 2016 — WebKit/Source/core/css/StyleSheetContents.cpp in Blink, as used in Google Chrome before 51.0.2704.63, permits cross-origin loading of CSS stylesheets by a ServiceWorker even when the stylesheet download has an incorrect MIME type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. WebKit/Source/core/css/StyleSheetContents.cpp en Blink, como es usado en Google Chrome en versiones anteriores a 51.0.2704.63, permite la carga de origen cruzado de hojas de estilos de CSS con S... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-284: Improper Access Control •
CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 0CVE-2016-1693 – chromium-browser: http download of software removal tool
https://notcve.org/view.php?id=CVE-2016-1693
01 Jun 2016 — browser/safe_browsing/srt_field_trial_win.cc in Google Chrome before 51.0.2704.63 does not use the HTTPS service on dl.google.com to obtain the Software Removal Tool, which allows remote attackers to spoof the chrome_cleanup_tool.exe (aka CCT) file via a man-in-the-middle attack on an HTTP session. browser/safe_browsing/srt_field_trial_win.cc en Google Chrome en versiones anteriores a 51.0.2704.63 no usa el servicio HTTPS en dl.google.com para obtener el Software Removal Tool, lo que permite a atacantes sup... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-284: Improper Access Control •
CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 0CVE-2016-1694 – chromium-browser: hpkp pins removed on cache clearance
https://notcve.org/view.php?id=CVE-2016-1694
01 Jun 2016 — browser/browsing_data/browsing_data_remover.cc in Google Chrome before 51.0.2704.63 deletes HPKP pins during cache clearing, which makes it easier for remote attackers to spoof web sites via a valid certificate from an arbitrary recognized Certification Authority. browser/browsing_data/browsing_data_remover.cc en Google Chrome en versiones anteriores a 51.0.2704.63 borra los pins HPKP durante la limpieza de la caché, lo que hace más fácil para atacantes remotos suplantar páginas web a través de un certifica... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 1%CPEs: 11EXPL: 0CVE-2016-1695 – chromium-browser: various fixes from internal audits
https://notcve.org/view.php?id=CVE-2016-1695
01 Jun 2016 — Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.63 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google Chrome en versiones anteriores a 51.0.2704.63 permiten a atacantes remotos provocar una denegación del servicio o posiblemente tener otro impacto a través de vectores desconocidos. An unspecified security issue was discovered in Blink. If a user were tricked in to opening a specially cra... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html •
CVSS: 10.0EPSS: 56%CPEs: 24EXPL: 0CVE-2016-5118 – ImageMagick: Remote code execution via filename
https://notcve.org/view.php?id=CVE-2016-5118
30 May 2016 — The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename. La función OpenBlob en blob.c en GraphicsMagick en versiones anteriores a 1.3.24 y ImageMagick permite a atacantes remotos ejecutar código arbitrario a través del caractér | (tubería) en el inicio del nombre de archivo. It was discovered that ImageMagick did not properly sanitize certain input before using it to invoke processe... • http://git.imagemagick.org/repos/ImageMagick/commit/40639d173aa8c76b850d625c630b711fee4dcfb8 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 3%CPEs: 7EXPL: 0CVE-2016-2806 – Mozilla: Miscellaneous memory safety hazards (rv:46.0 / rv:45.1) (MFSA 2016-39)
https://notcve.org/view.php?id=CVE-2016-2806
26 Apr 2016 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador en Mozilla Firefox en versiones anteriores a 46.0 y Firefox ESR 45.x en versiones anteriores a 45.1 permiten a atacantes remotos provocar una denegación de servicio (cor... • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00005.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.1EPSS: 1%CPEs: 4EXPL: 0CVE-2016-1651 – Google Chrome Pdfium JPEG2000 Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2016-1651
15 Apr 2016 — fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium, as used in Google Chrome before 50.0.2661.75, does not properly implement the sycc420_to_rgb and sycc422_to_rgb functions, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via crafted JPEG 2000 data in a PDF document. fxcodec/codec/fx_codec_jpx_opj.cpp en PDFium, como se utiliza en Google Chrome en versiones anteriores a 50.0.2661.75, no implementa correctamente las funciones sycc... • http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_13.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2016-1652 – chromium-browser: universal XSS in extension bindings
https://notcve.org/view.php?id=CVE-2016-1652
15 Apr 2016 — Cross-site scripting (XSS) vulnerability in the ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the Extensions subsystem in Google Chrome before 50.0.2661.75 allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)." Vulnerabilidad de XSS en la función ModuleSystem::RequireForJsInner en extensions/renderer/module_system.cc en el subsistema Extensions en Google Chrome en versiones anteriores a 50.0.2661.75 permite a a... • http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_13.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 2%CPEs: 7EXPL: 0CVE-2016-1653 – chromium-browser: out-of-bounds write in V8
https://notcve.org/view.php?id=CVE-2016-1653
15 Apr 2016 — The LoadBuffer implementation in Google V8, as used in Google Chrome before 50.0.2661.75, mishandles data types, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers an out-of-bounds write operation, related to compiler/pipeline.cc and compiler/simplified-lowering.cc. La implementación LoadBuffer en Google V8, como se utiliza en Google Chrome en versiones anteriores a 50.0.2661.75, no maneja correctamente tipos de dato... • http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_13.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 3%CPEs: 7EXPL: 0CVE-2016-1654 – chromium-browser: uninitialized memory read in media
https://notcve.org/view.php?id=CVE-2016-1654
15 Apr 2016 — The media subsystem in Google Chrome before 50.0.2661.75 does not initialize an unspecified data structure, which allows remote attackers to cause a denial of service (invalid read operation) via unknown vectors. El subsistema media en Google Chrome en versiones anteriores a 50.0.2661.75 no inicializa una estructura de datos no especificada, lo que permite a atacantes remotos provocar una denegación de servicio (operación de lectura no válida) a través de vectores desconocidos. A use-after-free was discover... • http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_13.html • CWE-20: Improper Input Validation •