Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-6011 State: PUBLISHED Published: 2018-11-01T17:00:00 Last Updated: 2024-08-05T05:47:56.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: The time-based one-time-password (TOTP) function in the application logic of the Green Electronics RainMachine Mini-8 (2nd generation) uses the administrator's password hash to generate a 6-digit temporary passcode that can be used for remote and local access, aka a "Use of Password Hash Instead of Password for Authentication" issue. This is exploitable by an attacker who discovers a hash value in the rainmachine-settings.sqlite file. Additional Analyst Notes: - CVE Program Container: References: - http://www.irongeek.com/i.ph
hine-settings.sqlite file. Additional Analyst Notes: - CVE Program Container: References: - http://www.irongeek.com/i.php?page=videos/bsidesrdu2018/bsidesrdu-2018-07-when-it-rains-it-pours-sam-granger
CVE ID: CVE-2018-6012 State: PUBLISHED Published: 2018-11-01T17:00:00 Last Updated: 2024-08-05T05:47:56.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: The 'Weather Service' feature of the Green Electronics RainMachine Mini-8 (2nd generation) allows an attacker to inject arbitrary Python code via the 'Add new weather data source' upload function. Additional Analyst Notes: - CVE Program Container: References: - http://www.irongeek.com/i.php?page=videos/bsidesrdu2018/bsidesrdu-2018-07-when-it-rains-it-pours-sam-granger
CVE ID: CVE-2018-6013 State: PUBLISHED Published: 2018-01-23T00:00:00 Last Updated: 2024-08-05T05:47:56.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) in BigTree 4.2.19 allows any remote users to inject arbitrary web script or HTML via the directory parameter. This issue exists in core/admin/ajax/developer/extensions/file-browser.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigtreecms/BigTree-CMS/issues/327
CVE ID: CVE-2018-6014 State: PUBLISHED Published: 2018-01-23T00:00:00 Last Updated: 2024-08-05T05:47:56.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: Subsonic v6.1.3 has an insecure allow-access-from domain="*" Flash cross-domain policy that allows an attacker to retrieve sensitive user information via a read request. To exploit this issue, an attacker must convince the user to visit a web site loaded with a SWF file created specifically to steal user data. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2115 - https://www.youtube.com/watch?v=t3nYuhAHOMg
CVE ID: CVE-2018-6015 State: PUBLISHED Published: 2018-01-26T20:00:00 Last Updated: 2024-08-05T05:54:53.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=view_all_subscribers in the body, allows downloading of a CSV data file with all subscriber data. Additional Analyst Notes: - CVE Program Container: References: - https://blog.threatpress.com/vulnerability-email-subscribers-plugin/ - https://wordpress.org/plugins/email-subscribers/#developers - https://www.exploit-db.com/exploits/43872/
CVE ID: CVE-2018-6016 State: PUBLISHED Published: 2018-03-12T21:00:00 Last Updated: 2024-08-05T05:54:51.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unquoted Windows search path vulnerability in the srvInventoryWebServer service in 10-Strike Network Monitor 5.4 allows local users to gain privileges via a malicious artefact. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Mar/21
CVE ID: CVE-2018-6017 State: PUBLISHED Published: 2018-01-24T15:00:00 Last Updated: 2024-08-05T05:54:52.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unencrypted transmission of images in Tinder iOS app and Tinder Android app allows an attacker to extract private sensitive information by sniffing network traffic. Additional Analyst Notes: - CVE Program Container: References: - https://www.wired.com/story/tinder-lack-of-encryption-lets-strangers-spy-on-swipes/ - https://www.checkmarx.com/2018/01/23/tinder-someone-may-watching-swipe-2/
CVE ID: CVE-2018-6018 State: PUBLISHED Published: 2018-01-24T15:00:00 Last Updated: 2024-08-05T05:54:52.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fixed sizes of HTTPS responses in Tinder iOS app and Tinder Android app allow an attacker to extract private sensitive information by sniffing network traffic. Additional Analyst Notes: - CVE Program Container: References: - https://www.wired.com/story/tinder-lack-of-encryption-lets-strangers-spy-on-swipes/ - https://www.checkmarx.com/2018/01/23/tinder-someone-may-watching-swipe-2/
CVE ID: CVE-2018-6019 State: PUBLISHED Published: 2018-03-06T20:00:00 Last Updated: 2024-08-05T05:54:51.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samsung Display Solutions App before 3.02 for Android allows man-in-the-middle attackers to spoof B2B content by leveraging failure to use encryption during information transmission. Additional Analyst Notes: - CVE Program Container: References: - https://wwws.nightwatchcybersecurity.com/2018/03/01/content-injection-in-samsung-display-solutions-application-for-android-cve-2018-6019/
CVE ID: CVE-2018-6020 State: PUBLISHED Published: 2018-05-09T21:00:00Z Last Updated: 2024-09-17T02:12:11.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Silex SX-500 all versions and GE MobileLink(GEH-500) version 1.54 and prior, authentication is not verified when making certain POST requests, which may allow attackers to modify system settings. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSMA-18-128-01
CVE ID: CVE-2018-6021 State: PUBLISHED Published: 2018-05-09T21:00:00Z Last Updated: 2024-09-16T19:47:05.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: Silex SD-320AN version 2.01 and prior and GE MobileLink(GEH-SD-320AN) version GEH-1.1 and prior have a system call parameter that is not properly sanitized, which may allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSMA-18-128-01
CVE ID: CVE-2018-6022 State: PUBLISHED Published: 2018-01-23T06:00:00 Last Updated: 2024-08-05T05:54:52.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authenticated users to delete arbitrary files by leveraging back-office access to provide a ..\ in the param.path parameter. Additional Analyst Notes: - CVE Program Container: References: - http://blackwolfsec.cc/2018/01/22/Nonecms/
CVE ID: CVE-2018-6023 State: PUBLISHED Published: 2018-05-11T21:00:00 Last Updated: 2024-08-05T05:54:51.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi activating, etc. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/147571/Fastweb-FASTGate-0.00.47-Cross-Site-Request-Forgery.html - https://www.exploit-db.com/exploits/44606/
CVE ID: CVE-2018-6024 State: PUBLISHED Published: 2018-02-18T20:00:00 Last Updated: 2024-08-05T05:54:52.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44124/ - http://packetstormsecurity.com/files/146454/Joomla-Project-Log-1.5.3-SQL-Injection.html
CVE ID: CVE-2018-6029 State: PUBLISHED Published: 2018-01-23T06:00:00 Last Updated: 2024-08-05T05:54:53.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery (SSRF), because URL validation only considers whether the URL contains the "csdn" substring. Additional Analyst Notes: - CVE Program Container: References: - http://blackwolfsec.cc/2018/01/23/Nonecms_ssrf/
CVE ID: CVE-2018-6031 State: PUBLISHED Published: 2018-09-25T14:00:00 Last Updated: 2024-08-05T05:54:52.523Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in PDFium in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - https://www.debian.org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://crbug.com/780450 - https://access.redhat.com/errata/RHSA-2018:02
7 - http://www.securitytracker.com/id/1040282 - https://crbug.com/780450 - https://access.redhat.com/errata/RHSA-2018:0265
CVE ID: CVE-2018-6032 State: PUBLISHED Published: 2018-09-25T14:00:00 Last Updated: 2024-08-05T05:54:52.922Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - https://www.debian.org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/errata/R
http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/errata/RHSA-2018:0265 - https://crbug.com/787103
CVE ID: CVE-2018-6033 State: PUBLISHED Published: 2018-09-25T14:00:00 Last Updated: 2024-08-05T05:54:52.611Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in Downloads in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside sandbox via a crafted Chrome Extension. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - https://www.debian.org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://crbug.com/7936
/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://crbug.com/793620 - https://access.redhat.com/errata/RHSA-2018:0265
CVE ID: CVE-2018-6034 State: PUBLISHED Published: 2018-09-25T14:00:00 Last Updated: 2024-08-05T05:54:51.322Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - https://www.debian.org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://crbug.com/784183 - https://access.r
w.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://crbug.com/784183 - https://access.redhat.com/errata/RHSA-2018:0265
CVE ID: CVE-2018-6035 State: PUBLISHED Published: 2018-09-25T14:00:00 Last Updated: 2024-08-05T05:54:52.530Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local file data via a crafted Chrome Extension. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - https://crbug.com/797500 - https://www.debian.org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 -
ebian.org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/errata/RHSA-2018:0265
CVE ID: CVE-2018-6036 State: PUBLISHED Published: 2018-09-25T14:00:00 Last Updated: 2024-08-05T05:54:51.301Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in V8 in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user data via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - https://www.debian.org/security/2018/dsa-4103 - https://crbug.com/789952 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/err
52 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/errata/RHSA-2018:0265
CVE ID: CVE-2018-6037 State: PUBLISHED Published: 2018-09-25T14:00:00 Last Updated: 2024-08-05T05:54:51.311Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in autofill in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain autofill data with insufficient user gestures via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - https://www.debian.org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://crbug.com/753645
sa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://crbug.com/753645 - https://access.redhat.com/errata/RHSA-2018:0265
CVE ID: CVE-2018-6038 State: PUBLISHED Published: 2018-09-25T14:00:00 Last Updated: 2024-08-05T05:54:52.923Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - https://www.debian.org/security/2018/dsa-4103 - https://crbug.com/774174 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/errata
- http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/errata/RHSA-2018:0265
CVE ID: CVE-2018-6039 State: PUBLISHED Published: 2018-09-25T14:00:00 Last Updated: 2024-08-05T05:54:52.815Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted Chrome Extension. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - https://www.debian.org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/erra
3 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/errata/RHSA-2018:0265 - https://crbug.com/775527
CVE ID: CVE-2018-6040 State: PUBLISHED Published: 2018-09-25T14:00:00 Last Updated: 2024-08-05T05:54:51.313Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially bypass content security policy via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - https://crbug.com/778658 - https://www.debian.org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - http
.org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/errata/RHSA-2018:0265
CVE ID: CVE-2018-6041 State: PUBLISHED Published: 2018-09-25T14:00:00 Last Updated: 2024-08-05T05:54:52.833Z Vendors: Google Products: Chrome Problem Types: Incorrect security UI Description: Incorrect security UI in navigation in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - https://www.debian.org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/errata/RHSA-2018:02
securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/errata/RHSA-2018:0265 - https://crbug.com/760342
CVE ID: CVE-2018-6042 State: PUBLISHED Published: 2018-09-25T14:00:00 Last Updated: 2024-08-05T05:54:52.923Z Vendors: Google Products: Chrome Problem Types: Incorrect security UI Description: Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - https://www.debian.org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://crbug.com/773930 - https://access.redhat
urityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://crbug.com/773930 - https://access.redhat.com/errata/RHSA-2018:0265
CVE ID: CVE-2018-6043 State: PUBLISHED Published: 2018-09-25T14:00:00 Last Updated: 2024-08-05T05:54:53.261Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in External Protocol Handler in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially execute arbitrary programs on user machine via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - https://www.debian.org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https
org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/errata/RHSA-2018:0265 - https://crbug.com/785809
CVE ID: CVE-2018-6044 State: REJECTED Published: 2021-11-02T21:10:10 Last Updated: 2021-11-02T21:10:10 Description: No description available.
CVE ID: CVE-2018-6045 State: PUBLISHED Published: 2018-09-25T14:00:00 Last Updated: 2024-08-05T05:54:52.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local file data via a crafted Chrome Extension. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - https://crbug.com/797497 - https://www.debian.org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/errata/
http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/errata/RHSA-2018:0265
CVE ID: CVE-2018-6046 State: PUBLISHED Published: 2018-09-25T14:00:00 Last Updated: 2024-08-05T05:54:52.601Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted Chrome Extension. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - https://www.debian.org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/erra
3 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/errata/RHSA-2018:0265 - https://crbug.com/798163
CVE ID: CVE-2018-6047 State: PUBLISHED Published: 2018-09-25T14:00:00 Last Updated: 2024-08-05T05:54:52.541Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user redirect URL via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - https://www.debian.org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://crbug.com/799847 - https://acce
//www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://crbug.com/799847 - https://access.redhat.com/errata/RHSA-2018:0265
CVE ID: CVE-2018-6048 State: PUBLISHED Published: 2018-09-25T14:00:00 Last Updated: 2024-08-05T05:54:53.179Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak referrer information via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - https://www.debian.org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://crbug.com/763194 - https://a
tp://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://crbug.com/763194 - https://access.redhat.com/errata/RHSA-2018:0265
CVE ID: CVE-2018-6049 State: PUBLISHED Published: 2018-09-25T14:00:00 Last Updated: 2024-08-05T05:54:52.805Z Vendors: Google Products: Chrome Problem Types: Incorrect security UI Description: Incorrect security UI in permissions prompt in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the origin to which permission is granted via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - https://www.debian.org/security/2018/dsa-4103 - http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/errata/
http://www.securityfocus.com/bid/102797 - http://www.securitytracker.com/id/1040282 - https://access.redhat.com/errata/RHSA-2018:0265 - https://crbug.com/774438