CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 0CVE-2016-1693 – chromium-browser: http download of software removal tool
https://notcve.org/view.php?id=CVE-2016-1693
01 Jun 2016 — browser/safe_browsing/srt_field_trial_win.cc in Google Chrome before 51.0.2704.63 does not use the HTTPS service on dl.google.com to obtain the Software Removal Tool, which allows remote attackers to spoof the chrome_cleanup_tool.exe (aka CCT) file via a man-in-the-middle attack on an HTTP session. browser/safe_browsing/srt_field_trial_win.cc en Google Chrome en versiones anteriores a 51.0.2704.63 no usa el servicio HTTPS en dl.google.com para obtener el Software Removal Tool, lo que permite a atacantes sup... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-284: Improper Access Control •
CVSS: 5.3EPSS: 1%CPEs: 8EXPL: 0CVE-2016-1694 – chromium-browser: hpkp pins removed on cache clearance
https://notcve.org/view.php?id=CVE-2016-1694
01 Jun 2016 — browser/browsing_data/browsing_data_remover.cc in Google Chrome before 51.0.2704.63 deletes HPKP pins during cache clearing, which makes it easier for remote attackers to spoof web sites via a valid certificate from an arbitrary recognized Certification Authority. browser/browsing_data/browsing_data_remover.cc en Google Chrome en versiones anteriores a 51.0.2704.63 borra los pins HPKP durante la limpieza de la caché, lo que hace más fácil para atacantes remotos suplantar páginas web a través de un certifica... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 1%CPEs: 11EXPL: 0CVE-2016-1695 – chromium-browser: various fixes from internal audits
https://notcve.org/view.php?id=CVE-2016-1695
01 Jun 2016 — Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.63 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google Chrome en versiones anteriores a 51.0.2704.63 permiten a atacantes remotos provocar una denegación del servicio o posiblemente tener otro impacto a través de vectores desconocidos. An unspecified security issue was discovered in Blink. If a user were tricked in to opening a specially cra... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html •
CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2016-1672 – chromium-browser: cross-origin bypass in extension bindings
https://notcve.org/view.php?id=CVE-2016-1672
01 Jun 2016 — The ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the extension bindings in Google Chrome before 51.0.2704.63 mishandles properties, which allows remote attackers to conduct bindings-interception attacks and bypass the Same Origin Policy via unspecified vectors. La función ModuleSystem::RequireForJsInner en extensions/renderer/module_system.cc en las extensiones vinculantes en Google Chrome en versiones anteriores a 51.0.2704.63 no maneja correctamente las propiedades, ... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-254: 7PK - Security Features CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 0%CPEs: 11EXPL: 0CVE-2016-1673 – chromium-browser: cross-origin bypass in blink
https://notcve.org/view.php?id=CVE-2016-1673
01 Jun 2016 — Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy via unspecified vectors. Blink, como es usado en Google Chrome en versiones anteriores a 51.0.2704.63 permite a atacantes remotos eludir la Same Origin Policy a través de vectores no especificados. An unspecified security issue was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. An i... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2016-1674 – chromium-browser: cross-origin bypass in extensions
https://notcve.org/view.php?id=CVE-2016-1674
01 Jun 2016 — The extensions subsystem in Google Chrome before 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified vectors. El subsistema de extensiones en Google Chrome en versiones anteriores a 51.0.2704.63 permite a atacantes remotos eludir la Same Origin Policy a través de vectores no especificados. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 51.0.2704.63. Security Fix: Multiple flaws were found in the processing of malformed we... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html •
CVSS: 8.8EPSS: 0%CPEs: 11EXPL: 0CVE-2016-1675 – chromium-browser: cross-origin bypass in blink
https://notcve.org/view.php?id=CVE-2016-1675
01 Jun 2016 — Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy by leveraging the mishandling of Document reattachment during destruction, related to FrameLoader.cpp and LocalFrame.cpp. Blink, tal como se utiliza en Google Chrome en versiones anteriores a 51.0.2704.63, permite a atacantes remotos eludir la Same Origin Policy aprovechando el manejo incorrecto de la reinserción de documentos durante la destrucción, relacionado con FrameLoader.cpp y LocalFrame.cpp.... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2016-1676 – chromium-browser: cross-origin bypass in extension bindings
https://notcve.org/view.php?id=CVE-2016-1676
01 Jun 2016 — extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.63 does not properly use prototypes, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors. extensions/renderer/resources/binding.js en las extensiones vinculantes en Google Chrome en versiones anteriores a 51.0.2704.63 no utiliza adecuadamente prototipos, lo que permite a atacantes remotos eludir la Same Origin Policy a través de vectores no especificados. Chromium is an ope... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 1%CPEs: 12EXPL: 0CVE-2016-1678 – chromium-browser: heap overflow in v8
https://notcve.org/view.php?id=CVE-2016-1678
01 Jun 2016 — objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JavaScript code. objects.cc en Google V8 en versiones anteriores a 5.0.71.32, como es usado en Google Chrome en versiones anteriores a 51.0.2704.63, no restringe adecuadamente el empeoramiento descuidado, lo que permite a atacantes re... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 1%CPEs: 11EXPL: 0CVE-2016-1679 – chromium-browser: heap use-after-free in v8 bindings
https://notcve.org/view.php?id=CVE-2016-1679
01 Jun 2016 — The ToV8Value function in content/child/v8_value_converter_impl.cc in the V8 bindings in Google Chrome before 51.0.2704.63 does not properly restrict use of getters and setters, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code. La función ToV8Value en content/child/v8_value_converter_impl.cc en los vínculos V8 en Google Chrome en versiones anteriores a 51.0.2704.63 no restringe adecuadamente el uso de captadores... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html •