CVSS: 5.0EPSS: 0%CPEs: 47EXPL: 0CVE-2010-0660
https://notcve.org/view.php?id=CVE-2010-0660
Google Chrome before 4.0.249.78 sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection, which allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging. Google Chrome anterior a v4.0.249.78 envía una dirección URL https en la cabecera Referer de una petición HTTP en determinadas circunstancias involucrando la redirección https a http, lo cual permite a los servidores HTTP remotos obtener información sensible a través de registro HTTP estándar (logs). • http://code.google.com/p/chromium/issues/detail?id=29920 http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html http://securitytracker.com/id?1023506 http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14247 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 47EXPL: 0CVE-2010-0644
https://notcve.org/view.php?id=CVE-2010-0644
Google Chrome before 4.0.249.89, when a SOCKS 5 proxy server is configured, sends DNS queries directly, which allows remote DNS servers to obtain potentially sensitive information about the identity of a client user via request logging, as demonstrated by a proxy server that was configured for the purpose of anonymity. Google Chrome anterior v4.0.249.89, cuando el servidor proxy SOCKS 5 está configurado, permite el ataques a servidores DNS remotos para obtener información potencialmente sensible sobre la identidad de usuarios clientes a través de peticiones logging, como queda demostrada por un servidor proxy que fue configurado para ese propósito de anonimato. • http://code.google.com/p/chromium/issues/detail?id=29914 http://googlechromereleases.blogspot.com/2010/02/stable-channel-update.html http://secunia.com/advisories/38545 http://securitytracker.com/id?1023583 http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs http://www.securityfocus.com/bid/38177 http://www.vupen.com/english/advisories/2010/0361 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13926 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 1%CPEs: 47EXPL: 3CVE-2010-0664
https://notcve.org/view.php?id=CVE-2010-0664
Stack consumption vulnerability in the ChildProcessSecurityPolicy::CanRequestURL function in browser/child_process_security_policy.cc in Google Chrome before 4.0.249.78 allows remote attackers to cause a denial of service (memory consumption and application crash) via a URL that specifies multiple protocols, as demonstrated by a URL that begins with many repetitions of the view-source: substring. Vulnerabilidad de consumo en la pila en la función ChildProcessSecurityPolicy::CanRequestURL en browser/child_process_security_policy.cc en Google Chrome before v4.0.249.78, permite provocar una denegación de servicio (consumo de memoria y caída de aplicación) a través de una URL que especifica múltiples protocolos, como se ha demostrado mediante una URL que comienza con varias repeticiones de "ver código fuente"(view-source): substring. • http://code.google.com/p/chromium/issues/detail?id=31517 http://exchange.kg/other/chrome3_0day-denial_of_service_crash.html http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html http://securitytracker.com/id?1023506 http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs http://twitter.com/akirsanov/statuses/7370288490 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14097 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 0%CPEs: 47EXPL: 0CVE-2010-0649
https://notcve.org/view.php?id=CVE-2010-0649
Integer overflow in the CrossCallParamsEx::CreateFromBuffer function in sandbox/src/crosscall_server.cc in Google Chrome before 4.0.249.89 allows attackers to leverage renderer access to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a malformed message, related to deserializing of sandbox messages. Desbordamiento de enteros en la función CrossCallParamsEx::CreateFromBuffer en Google Chrome anterior v4.0.249.89 permite a atacantes aprovechar el acceso "renderer" y causar una denegación de servicio (caída de memoria dinámica) o probablemente otros impactos no especificados a través de un mensaje malformado, relacionado con la deserialización de mensajes sandbox. • http://code.google.com/p/chromium/issues/detail?id=32915 http://googlechromereleases.blogspot.com/2010/02/stable-channel-update.html http://secunia.com/advisories/38545 http://securitytracker.com/id?1023583 http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs http://www.osvdb.org/62320 http://www.securityfocus.com/bid/38177 http://www.vupen.com/english/advisories/2010/0361 https://exchange.xforce.ibmcloud.com/vulnerabilities/56217 https://oval.cis • CWE-189: Numeric Errors •
CVSS: 2.6EPSS: 0%CPEs: 5EXPL: 1CVE-2010-0650
https://notcve.org/view.php?id=CVE-2010-0650
WebKit, as used in Google Chrome before 4.0.249.78 and Apple Safari, allows remote attackers to bypass intended restrictions on popup windows via crafted use of a mouse click event. WebKit, usado en Google Chrome, anterior a v4.0.249.78 y Apple Safari, permite a atacantes remotos evitar las restricciones destinadas a ventanas emergentes mediante el uso de un evento de clic de ratón manipulado. • http://code.google.com/p/chromium/issues/detail?id=3275 http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://secunia.com/advisories/41856 http://secunia.com/advisories/43068 http://securitytracker.com/id?1023506 http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs http://www.mandriva.com/security/advisories?name=MDVSA-2011:039 http://www.securityfoc • CWE-264: Permissions, Privileges, and Access Controls •