CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2018-6104 – chromium-browser: URL spoof in Omnibox
https://notcve.org/view.php?id=CVE-2018-6104
24 Apr 2018 — Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. Aplicación insuficiente de caracteres confundibles en URL Formatter en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto suplantase dominios mediante homogramas IDN mediante un nombre de dominio manipulado. Chromium is an open-source web browser, powered by WebKit. This ... • http://www.securityfocus.com/bid/103917 •
CVSS: 5.8EPSS: 1%CPEs: 6EXPL: 0CVE-2018-6110 – chromium-browser: Incorrect handling of plaintext files via file://
https://notcve.org/view.php?id=CVE-2018-6110
24 Apr 2018 — Parsing documents as HTML in Downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to cause Chrome to execute scripts via a local non-HTML page. El análisis de documentos como HTML en Downloads en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto provocase que Chrome ejecutase scripts mediante una página local que no fuese HTML. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 66.0.3359.117. Iss... • http://www.securityfocus.com/bid/103917 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2018-6095 – chromium-browser: Lack of meaningful user interaction requirement before file upload
https://notcve.org/view.php?id=CVE-2018-6095
24 Apr 2018 — Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read local files via a crafted HTML page. La eliminación incorrecta del selector de archivos en los eventos del teclado en Blink en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto leyese archivos locales mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to ... • http://www.securityfocus.com/bid/103917 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-6117 – chromium-browser: Confusing autofill settings
https://notcve.org/view.php?id=CVE-2018-6117
24 Apr 2018 — Confusing settings in Autofill in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Las opciones confusas en Autofill en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitían que un atacante remoto pudiese obtener información potencialmente sensible del la memoria del proceso mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades C... • http://www.securityfocus.com/bid/103917 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 1%CPEs: 6EXPL: 1CVE-2018-6106 – chromium-browser: Incorrect handling of promises in V8
https://notcve.org/view.php?id=CVE-2018-6106
24 Apr 2018 — An asynchronous generator may return an incorrect state in V8 in Google Chrome prior to 66.0.3359.117 allowing a remote attacker to potentially exploit object corruption via a crafted HTML page. Un generador asíncrono podría devolver un estado incorrecto en V8 en Google Chrome, en versiones anteriores a la 66.0.3359.117, lo que permite que un atacante remoto explote una corrupción de objetos mediante una página HTML manipulada. Google Chrome V8 Await methods call ResolveNativePromise which calls InternalRes... • https://packetstorm.news/files/id/147386 • CWE-19: Data Processing Errors •
CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2018-6096 – chromium-browser: Fullscreen UI spoof
https://notcve.org/view.php?id=CVE-2018-6096
24 Apr 2018 — A JavaScript focused window could overlap the fullscreen notification in Fullscreen in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obscure the full screen warning via a crafted HTML page. Una ventana centrada con JavaScript podría superponerse a la notificación de pantalla completa en Fullscreen en Google Chrome, en versiones anteriores a la 66.0.3359.117, lo que permitía que un atacante remoto ocultase la advertencia de pantalla completa mediante una página HTML manipulada. Chromium i... • http://www.securityfocus.com/bid/103917 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2018-6102 – chromium-browser: URL spoof in Omnibox
https://notcve.org/view.php?id=CVE-2018-6102
24 Apr 2018 — Missing confusable characters in Internationalization in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. La falta de caracteres confundibles en Internationalization en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto suplantase el contenido de Omnibox (barra de direcciones) mediante un nombre de dominio manipulado. Chromium is an open-source web browser, powered by WebKit. This ... • http://www.securityfocus.com/bid/103917 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6111 – chromium-browser: Heap-use-after-free in DevTools
https://notcve.org/view.php?id=CVE-2018-6111
24 Apr 2018 — An object lifetime issue in the developer tools network handler in Google Chrome prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via a crafted HTML page. Un problema de ciclo de vida de objetos en el manejador de la red de herramientas de desarrollador en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante local ejecutase código arbitrario mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgr... • http://www.securityfocus.com/bid/103917 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 1%CPEs: 7EXPL: 0CVE-2018-6097 – chromium-browser: Fullscreen UI spoof
https://notcve.org/view.php?id=CVE-2018-6097
24 Apr 2018 — Incorrect handling of asynchronous methods in Fullscreen in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to enter full screen without showing a warning via a crafted HTML page. La gestión incorrecta de los métodos asíncronos en Fullscreen en Google Chrome, en versiones anteriores a la 66.0.3359.117 para macOS, permitía que un atacante remoto pudiese entrar en modo de pantalla completa sin mostrar un aviso mediante una página HTML manipulada. Chromium is an open-source web browser,... • http://www.securityfocus.com/bid/103917 • CWE-19: Data Processing Errors •
CVSS: 8.8EPSS: 1%CPEs: 6EXPL: 0CVE-2018-6094 – chromium-browser: Exploit hardening regression in Oilpan
https://notcve.org/view.php?id=CVE-2018-6094
24 Apr 2018 — Inline metadata in GarbageCollection in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Los metadatos inline en GarbageCollection en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 66.0.3359.117... • http://www.securityfocus.com/bid/103917 • CWE-787: Out-of-bounds Write •