CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-18351 – chromium-browser: Insufficient policy enforcement in Navigation
https://notcve.org/view.php?id=CVE-2018-18351
Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass SameSite cookie policy via a crafted HTML page. La falta de validación adecuada de los frames ancestor al enviar cookies lax en Navigation en Google Chrome en versiones anteriores a la 71.0.3578.80 permitía que un atacante remoto omita la política de la cookie SameSite mediante una página HTML manipulada. • http://www.securityfocus.com/bid/106084 https://access.redhat.com/errata/RHSA-2018:3803 https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html https://crbug.com/833847 https://security.gentoo.org/glsa/201908-18 https://www.debian.org/security/2018/dsa-4352 https://access.redhat.com/security/cve/CVE-2018-18351 https://bugzilla.redhat.com/show_bug.cgi?id=1656565 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-18352 – chromium-browser: Inappropriate implementation in Media
https://notcve.org/view.php?id=CVE-2018-18352
Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass same origin policy for audio content via a crafted HTML page. Los trabajos del servicio pueden obtener acceso de forma inapropiada al audio cross-origin en Media en Google Chrome, en versiones anteriores a la 71.0.3578.80, permitía que un atacante remoto omitiese la política del mismo origen para el contenido de audio mediante una página HTML manipulada. • http://www.securityfocus.com/bid/106084 https://access.redhat.com/errata/RHSA-2018:3803 https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html https://crbug.com/849942 https://security.gentoo.org/glsa/201908-18 https://www.debian.org/security/2018/dsa-4352 https://access.redhat.com/security/cve/CVE-2018-18352 https://bugzilla.redhat.com/show_bug.cgi?id=1656566 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2018-18353 – chromium-browser: Inappropriate implementation in Network Authentication
https://notcve.org/view.php?id=CVE-2018-18353
Failure to dismiss http auth dialogs on navigation in Network Authentication in Google Chrome on Android prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of an auto dialog via a crafted HTML page. El error a la hora de descartar los diálogos http auth en la navegación en Network Authentication en Google Chrome en Android en versiones anteriores a la 71.0.3578.80 permitía que un atacante remoto confundiese al usuario sobre el origen de un diálogo auto mediante una página HTML manipulada. • http://www.securityfocus.com/bid/106084 https://access.redhat.com/errata/RHSA-2018:3803 https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html https://crbug.com/884179 https://security.gentoo.org/glsa/201908-18 https://www.debian.org/security/2018/dsa-4352 https://access.redhat.com/security/cve/CVE-2018-18353 https://bugzilla.redhat.com/show_bug.cgi?id=1656567 •
CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 0CVE-2018-18354 – chromium-browser: Insufficient data validation in Shell Integration
https://notcve.org/view.php?id=CVE-2018-18354
Insufficient validate of external protocols in Shell Integration in Google Chrome on Windows prior to 71.0.3578.80 allowed a remote attacker to launch external programs via a crafted HTML page. La validación insuficiente de los protocolos externos en Shell Integration en Google Chrome en Windows en versiones anteriores a la 71.0.3578.80 permitía que un atacante remoto lanzase programas externos mediante una página HTML manipulada. • http://www.securityfocus.com/bid/106084 https://access.redhat.com/errata/RHSA-2018:3803 https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html https://crbug.com/889459 https://security.gentoo.org/glsa/201908-18 https://www.debian.org/security/2018/dsa-4352 https://access.redhat.com/security/cve/CVE-2018-18354 https://bugzilla.redhat.com/show_bug.cgi?id=1656568 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-18355 – chromium-browser: Insufficient policy enforcement in URL Formatter
https://notcve.org/view.php?id=CVE-2018-18355
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. El manejo incorrecto de caracteres confundibles en URL Formatter en Google Chrome en versiones anteriores a la 71.0.3578.80 permitía que un atacante remoto suplantase el contenido de Omnibox (barra de direcciones) mediante un nombre de dominio manipulado. • http://www.securityfocus.com/bid/106084 https://access.redhat.com/errata/RHSA-2018:3803 https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html https://crbug.com/896717 https://security.gentoo.org/glsa/201908-18 https://www.debian.org/security/2018/dsa-4352 https://access.redhat.com/security/cve/CVE-2018-18355 https://bugzilla.redhat.com/show_bug.cgi?id=1656569 •