CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5226 – chromium-browser: limited xss in blink
https://notcve.org/view.php?id=CVE-2016-5226
Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac executed javascript: URLs entered in the URL bar in the context of the current tab, which allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar. Blink en Google Chrome anterior a 55.0.2883.75 para Linux, Windows y Mac ejecutó javascript: las URLs escritas en la barra de URL en el contexto de la pestaña actual, lo que permitió a un usuario de ingeniería social realizar XSS por si mismos arrastrando y soltando un javascript: URL en la barra de URL. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/639750 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5226 https://bugzilla.redhat.com/show_bug.cgi?id=1400876 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5204 – chromium-browser: universal xss in blink
https://notcve.org/view.php?id=CVE-2016-5204
Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. La filtración de un árbol de sombra SVG dando lugar a corrupción del árbol DOM en Blink en Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android permitió a un atacante remoto inyectar secuencias de comandos o HTML arbitrarios (UXSS) a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/630870 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5204 https://bugzilla.redhat.com/show_bug.cgi?id=1400855 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9650 – chromium-browser: csp referrer disclosure
https://notcve.org/view.php?id=CVE-2016-9650
Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled iframes, which allowed a remote attacker to bypass a no-referrer policy via a crafted HTML page. Blink en Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android maneja iframes incorrectamente, lo que permitió a un atacante remoto eludir una política no referida a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/653034 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-9650 https://bugzilla.redhat.com/show_bug.cgi?id=1400873 • CWE-19: Data Processing Errors •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5218 – chromium-browser: address spoofing in omnibox
https://notcve.org/view.php?id=CVE-2016-5218
The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to temporarily spoof the contents of the Omnibox (URL bar) via a crafted HTML page containing PDF data. La API de extensiones en Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android maneja incorrectamente la navegación en PDFs, lo que permitió a un atacante remoto suplantar temporalmente los contenidos de la Omnibox (barra de URL) a través de una página HTML manipulada que contiene datos PDF. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/660498 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5218 https://bugzilla.redhat.com/show_bug.cgi?id=1400868 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5208 – chromium-browser: universal xss in blink
https://notcve.org/view.php?id=CVE-2016-5208
Blink in Google Chrome prior to 55.0.2883.75 for Linux and Windows, and 55.0.2883.84 for Android allowed possible corruption of the DOM tree during synchronous event handling, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Blink en Google Chrome anterior a 55.0.2883.75 para Linux y Windows y 55.0.2883.84 para Android permitió una posible corrupción del árbol DOM durante el manejo del evento sincronizado, lo que permitió a un atacante remoto inyectar secuencias de comandos o HTML arbitrarios (UXSS) a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/658535 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5208 https://bugzilla.redhat.com/show_bug.cgi?id=1400851 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •