CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2011-5037
https://notcve.org/view.php?id=CVE-2011-5037
Google V8 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, as demonstrated by attacks against Node.js. Google V8 calcula los valores hash de los parámetros de forma, sin restringir la capacidad de desencadenar colisiones hash predecible, lo que permite a atacantes remotos provocar una denegación de servicio (consumo de CPU) mediante el envío de gran cantidad de parámetros a mano, como lo demuestran los ataques contra Node.js. • http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html http://www.kb.cert.org/vuls/id/903934 http://www.nruns.com/_downloads/advisory28122011.pdf http://www.ocert.org/advisories/ocert-2011-003.html • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 1%CPEs: 2EXPL: 0CVE-2011-3886
https://notcve.org/view.php?id=CVE-2011-3886
Google V8, as used in Google Chrome before 15.0.874.102, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers out-of-bounds write operations. Google V8, tal como se utiliza en Google Chrome en versiones anteriores a la 15.0.874.102, permite a atacantes remotos provocar una denegación de servicio o posiblemente realizar otras acciones sin especificar a través de código JavaScript modificado que provoca operaciones de escritura fuera de los límites. • http://code.google.com/p/chromium/issues/detail?id=98773 http://code.google.com/p/chromium/issues/detail?id=99167 http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html https://exchange.xforce.ibmcloud.com/vulnerabilities/70964 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13201 • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 8%CPEs: 29EXPL: 0CVE-2009-2555
https://notcve.org/view.php?id=CVE-2009-2555
Heap-based buffer overflow in src/jsregexp.cc in Google V8 before 1.1.10.14, as used in Google Chrome before 2.0.172.37, allows remote attackers to execute arbitrary code in the Chrome sandbox via a crafted JavaScript regular expression. Desbordamiento de búfer basado en memoria dinámica en src/jsregexp.cc en Google V8 anterior a v1.1.10.14, como el utilizado en Google Chrome anterior a v2.0.172.37, permite a atacantes remotos ejecutar código de su elección en el Chrome sandbox a través de una expresión regular JavaScript manipulada. • http://code.google.com/p/chromium/issues/detail?id=14719 http://codereview.chromium.org/141042 http://codereview.chromium.org/141042/diff/6/1004 http://googlechromereleases.blogspot.com/2009/07/stable-beta-update-bug-fixes.html http://secunia.com/advisories/35844 http://www.osvdb.org/55939 http://www.securityfocus.com/bid/35722 http://www.vupen.com/english/advisories/2009/1924 https://exchange.xforce.ibmcloud.com/vulnerabilities/51801 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •