Page 4 of 94 results (0.005 seconds)

CVSS: 8.8EPSS: 1%CPEs: 7EXPL: 0

23 Jul 2015 — The LocalFrame::isURLAllowed function in core/frame/LocalFrame.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly check for a page's maximum number of frames, which allows remote attackers to cause a denial of service (invalid count value and use-after-free) or possibly have unspecified other impact via crafted JavaScript code that makes many createElement calls for IFRAME elements. Vulnerabilidad en la función LocalFrame::isURLAllowed en core/frame/LocalFrame.cpp en Blink impleme... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-20: Improper Input Validation CWE-416: Use After Free •

CVSS: 7.8EPSS: 1%CPEs: 8EXPL: 0

23 Jul 2015 — The XSSAuditor::canonicalize function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 44.0.2403.89, does not properly choose a truncation point, which makes it easier for remote attackers to obtain sensitive information via an unspecified linear-time attack. Vulnerabilidad en la función XSSAuditor::canonicalize en core/html/parser/XSSAuditor.cpp en el auditor XSS en Blink, usado en Google Chrome en versiones anteriores a la 44.0.2403.89, no elige correctamente... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.8EPSS: 0%CPEs: 8EXPL: 0

23 Jul 2015 — Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler.cc in Google Chrome before 44.0.2403.89 allows remote attackers to inject arbitrary web script or HTML by leveraging the lack of a certain V8 context restriction, aka a Blink "Universal XSS (UXSS)." Vulnerabilidad de XSS en la función V8ContextNativeHandler::GetModuleSystem en extensions/renderer/v8_context_native_handler.cc en Google Chrome en versiones anteriore... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0

23 Jul 2015 — Blink, as used in Google Chrome before 44.0.2403.89, enables a quirks-mode exception that limits the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to core/fetch/CSSStyleSheetResource.cpp. Vulnerabilidad en Blink implementado en Google Chrome en versiones anteriores a la 44.0.2403.89, habilita una excepción en el quirks-mode que limita los casos en los que un ... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-17: DEPRECATED: Code •

CVSS: 7.5EPSS: 1%CPEs: 8EXPL: 0

23 Jul 2015 — The Spellcheck API implementation in Google Chrome before 44.0.2403.89 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file, a related issue to CVE-2015-1263. Vulnerabilidad en la implementación de Spellcheck API en Google Chrome en versiones anteriores a la 44.0.2403.89, no usa una sesión HTTPS para la descarga de un diccionario Hunspell, lo cual pe... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-17: DEPRECATED: Code •

CVSS: 7.8EPSS: 1%CPEs: 8EXPL: 0

23 Jul 2015 — Multiple unspecified vulnerabilities in Google Chrome before 44.0.2403.89 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google Chrome en versiones anteriores a la 44.0.2403.89, permite a atacantes causar una denegación de servicio o posiblemente tener otro impacto no especificado a través de vectores desconocidos. An uninitialized value issue was discovered in ICU. If a user were tricked in to opening a speciall... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html •

CVSS: 8.8EPSS: 1%CPEs: 9EXPL: 0

01 May 2015 — Use-after-free vulnerability in the MutationObserver::disconnect function in core/dom/MutationObserver.cpp in the DOM implementation in Blink, as used in Google Chrome before 42.0.2311.135, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an attempt to unregister a MutationObserver object that is not currently registered. Vulnerabilidad de uso después de liberación en la función MutationObserver::disconnect en core/dom/MutationObserver.cpp en la im... • http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_28.html • CWE-416: Use After Free •

CVSS: 8.8EPSS: 1%CPEs: 9EXPL: 0

01 May 2015 — Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google Chrome anterior a 42.0.2311.135 permiten a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto a través de vectores desconocidos. A use-after-free was discovered in the DOM implementation in Blink. If a user were tricked in to opening a specially crafte... • http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_28.html •

CVSS: 10.0EPSS: 86%CPEs: 31EXPL: 2

14 Apr 2015 — Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2015, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, and CVE-2015-3042. Adobe Flash Player anterior a 13.0.0.281... • https://packetstorm.news/files/id/132525 • CWE-787: Out-of-bounds Write •

CVSS: 10.0EPSS: 5%CPEs: 31EXPL: 0

14 Apr 2015 — Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043. Adobe Flash Player anterior a 13.0.0.281 y 14.x hasta 17.x anterior a 17.0.0.169... • http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00010.html •