CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 0CVE-2018-6073 – chromium-browser: heap bufffer overflow in webgl
https://notcve.org/view.php?id=CVE-2018-6073
12 Mar 2018 — A heap buffer overflow in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Un desbordamiento de búfer basado en memoria dinámica (heap) en WebGL en Google Chrome en versiones anteriores a la 65.0.3325.146 permitía que un atacante remoto pudiese realizar una escritura de memoria fuera de límites mediante una página HTML manipulada. Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which... • http://www.securityfocus.com/bid/103297 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6074 – chromium-browser: mark-of-the-web bypass
https://notcve.org/view.php?id=CVE-2018-6074
12 Mar 2018 — Failure to apply Mark-of-the-Web in Downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to bypass OS level controls via a crafted HTML page. El error al aplicar Mark-of-the-Web en las descargas en Google Chrome en versiones anteriores a la 65.0.3325.146 permitía que un atacante remoto omitiese los controles de nivel del sistema operativo mediante una página HTML manipulada. Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which could result in the ... • http://www.securityfocus.com/bid/103297 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6075 – chromium-browser: overly permissive cross origin downloads
https://notcve.org/view.php?id=CVE-2018-6075
12 Mar 2018 — Incorrect handling of specified filenames in file downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page and user interaction. El manejo incorrecto de nombres de archivo especificados en las descargas de archivo en Google Chrome en versiones anteriores a la 65.0.3325.146 permitía que un atacante remoto filtrase datos de orígenes cruzados mediante una página HTML manipulada. Multiple vulnerabilities have been found in Chromium and Google ... • http://www.securityfocus.com/bid/103297 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6076 – chromium-browser: incorrect handling of url fragment identifiers in blink
https://notcve.org/view.php?id=CVE-2018-6076
12 Mar 2018 — Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page. El cifrado insuficiente de identificadores de fragmentos de URL en Blink en Google Chrome en versiones anteriores a la 65.0.3325.146 permitía que un atacante remoto realizase un ataque Cross-Site Scripting (XSS) basado en DOM mediante una página HTML manipulada. Multiple vulnerabilities have been found in Chromium and Google C... • http://www.securityfocus.com/bid/103297 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6077 – chromium-browser: timing attack using svg filters
https://notcve.org/view.php?id=CVE-2018-6077
12 Mar 2018 — Displacement map filters being applied to cross-origin images in Blink SVG rendering in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Los filtros de mapa de desplazamiento que se aplican a las imágenes de origen cruzado en el renderizado Blink SVG en Google Chrome en versiones anteriores a la 65.0.3325.146 permitía que un atacante remoto filtrase datos de orígenes cruzados mediante una página HTML manipulada. Multiple vulnerabilities have b... • http://www.securityfocus.com/bid/103297 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6078 – chromium-browser: url spoof in omnibox
https://notcve.org/view.php?id=CVE-2018-6078
12 Mar 2018 — Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. El manejo incorrecto de caracteres confundibles en Omnibox en Google Chrome en versiones anteriores a la 65.0.3325.146 permitía que un atacante remoto suplantase el contenido de Omnibox (barra de direcciones) mediante un nombre de dominio manipulado. Multiple vulnerabilities have been found in Chromium and Google Ch... • http://www.securityfocus.com/bid/103297 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6079 – chromium-browser: information disclosure via texture data in webgl
https://notcve.org/view.php?id=CVE-2018-6079
12 Mar 2018 — Inappropriate sharing of TEXTURE_2D_ARRAY/TEXTURE_3D data between tabs in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page. La compartición inapropiada de datos TEXTURE_2D_ARRAY/TEXTURE_3D entre pestañas en WebGL en Google Chrome en versiones anteriores a la 65.0.3325.146 permitía que un atacante remoto filtrase datos de orígenes cruzados mediante una página HTML manipulada. Multiple vulnerabilities have been found in Chromium and Goog... • http://www.securityfocus.com/bid/103297 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 1CVE-2018-6080 – chromium-browser: information disclosure in ipc call
https://notcve.org/view.php?id=CVE-2018-6080
12 Mar 2018 — Lack of access control checks in Instrumentation in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to obtain memory metadata from privileged processes . La falta de comprobaciones de control de acceso en Instrumentation en Google Chrome en versiones anteriores a la 65.0.3325.146 permitía que un atacante remoto que había comprometido el proceso renderer obtuviese metadatos de la memoria de procesos privilegiados. Multiple vulnerabilities have been foun... • https://packetstorm.news/files/id/146734 • CWE-269: Improper Privilege Management •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6081 – chromium-browser: xss in interstitials
https://notcve.org/view.php?id=CVE-2018-6081
12 Mar 2018 — XSS vulnerabilities in Interstitials in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension or open Developer Console to inject arbitrary scripts or HTML via a crafted HTML page. Vulnerabilidades Cross-Site Scripting (XSS) en Interstitials en Google Chrome en versiones anteriores a la 65.0.3325.146 permitían que un atacante que convenció a un usuario para que instalase una extensión maliciosa o abriese la consola de desarrollador para inyectar scrip... • http://www.securityfocus.com/bid/103297 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.7EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6082 – chromium-browser: circumvention of port blocking
https://notcve.org/view.php?id=CVE-2018-6082
12 Mar 2018 — Including port 22 in the list of allowed FTP ports in Networking in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially enumerate internal host services via a crafted HTML page. La inclusión del puerto 22 en la lista de puertos FTP permitidos en Networking en Google Chrome en versiones anteriores a la 65.0.3325.146 permitía que un atacante remoto pudiese enumerar los servicios internos del host mediante una página HTML manipulada. Multiple vulnerabilities have been found in Chromiu... • http://www.securityfocus.com/bid/103297 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •