deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-19843
Published: 2018-12-04
Description: opmov in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (buffer over-read) via crafted x86 assembly data, as demonstrated by rasm2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/radare/radare2/commit/f17bfd9f1da05f30f23a4dd05e9d2363e1406948; https://github.com/radare/radare2/issues/12242; https://github.com/radare/radare2/commit/f17bfd9f1da05f30f23a4dd05e9d2363e1406948
CVE: CVE-2018-19849
Published: 2018-12-04
Description: An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/yzmcms/yzmcms/issues/8; https://github.com/yzmcms/yzmcms/issues/8
CVE: CVE-2018-19853
Published: 2018-12-04
Description: An issue was discovered in hitshop through 2014-07-15. There is an elevation-of-privilege vulnerability (that allows control over the whole web site) via the admin.php/user/add URI because a storekeeper account (which is supposed to have only privileges for commodity management) can add an administrator account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://github.com/liu946/hitshop/issues/1; https://github.com/liu946/hitshop/issues/1
CVE: CVE-2018-16478
Published: 2018-12-04
Description: A Path Traversal in simplehttpserver versions <=0.2.1 allows to list any file in another folder of web root.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/403703; https://hackerone.com/reports/403703
CVE: CVE-2018-6981
Published: 2018-12-04
Description: VMware ESXi 6.7 without ESXi[PII_REDACTED]01-BG and VMware ESXi 6.5 without ESXi[PII_REDACTED]01-BG, VMware ESXi 6.0 without ESXi[PII_REDACTED]01-BG, VMware Workstation 15, VMware Workstation 14.1.3 or below, VMware Fusion 11, VMware Fusion 10.1.3 or below contain uninitialized stack memory usage in the vmxnet3 virtual network adapter which may allow a guest to execute code on the host.
CVSS Score: 8.8 (HIGH)
CWE: CWE-908
References: http://www.securityfocus.com/bid/105881; http://www.securitytracker.com/id/1042054; http://www.securitytracker.com/id/1042055
CVE: CVE-2018-6982
Published: 2018-12-04
Description: VMware ESXi 6.7 without ESXi[PII_REDACTED]01-BG and VMware ESXi 6.5 without ESXi[PII_REDACTED]01-BG contain uninitialized stack memory usage in the vmxnet3 virtual network adapter which may lead to an information leak from host to guest.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-908
References: http://www.securityfocus.com/bid/105882; http://www.securitytracker.com/id/1042055; https://www.vmware.com/security/advisories/VMSA-2018-0027.html
CVE: CVE-2018-17157
Published: 2018-12-04
Description: In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error when handling opcodes can cause memory corruption by sending a specially crafted NFSv4 request. Unprivileged remote users with access to the NFS server may be able to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://www.securityfocus.com/bid/106192; http://www.securitytracker.com/id/1042164; https://secuniaresearch.flexerasoftware.com/secunia_research/2018-25/
CVE: CVE-2018-17158
Published: 2018-12-04
Description: In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error can occur when handling the client address length field in an NFSv4 request. Unprivileged remote users with access to the NFS server can crash the system by sending a specially crafted NFSv4 request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/106192; http://www.securitytracker.com/id/1042164; https://secuniaresearch.flexerasoftware.com/secunia_research/2018-24/
CVE: CVE-2018-17159
Published: 2018-12-04
Description: In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, the NFS server lacks a bounds check in the READDIRPLUS NFS request. Unprivileged remote users with access to the NFS server can cause a resource exhaustion by forcing the server to allocate an arbitrarily large memory allocation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.securityfocus.com/bid/106192; http://www.securitytracker.com/id/1042164; https://secuniaresearch.flexerasoftware.com/secunia_research/2018-24/
CVE: CVE-2018-16628
Published: 2018-12-04
Description: panel/login in Kirby v2.5.12 allows XSS via a blog name.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/security-breachlock/CVE-2018-16628/blob/master/kirby10.pdf; https://github.com/security-breachlock/CVE-2018-16628/blob/master/kirby10.pdf
CVE: CVE-2018-16629
Published: 2018-12-04
Description: panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/security-breachlock/CVE-2018-16629/blob/master/subrion_cms.pdf; https://github.com/security-breachlock/CVE-2018-16629/blob/master/subrion_cms.pdf
CVE: CVE-2018-16631
Published: 2018-12-04
Description: Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/security-breachlock/CVE-2018-16631/blob/master/Subrion_cms.pdf; https://github.com/security-breachlock/CVE-2018-16631/blob/master/Subrion_cms.pdf
CVE: CVE-2018-16633
Published: 2018-12-04
Description: Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/security-breachlock/CVE-2018-16633/blob/master/PLUCK_XSS.pdf; https://github.com/security-breachlock/CVE-2018-16633/blob/master/PLUCK_XSS.pdf
CVE: CVE-2018-16634
Published: 2018-12-04
Description: Pluck v4.7.7 allows CSRF via admin.php?action=settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/security-breachlock/CVE-2018-16634/blob/master/PLUCK_CSRF.pdf; https://github.com/security-breachlock/CVE-2018-16634/blob/master/PLUCK_CSRF.pdf
CVE: CVE-2018-19591
Published: 2018-12-04
Description: In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-404
References: http://www.securityfocus.com/bid/106037; http://www.securitytracker.com/id/1042174; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BO7WHN52GFMC5F2I2232GFIPSSXWFV7G/
CVE: CVE-2018-19854
Published: 2018-12-04
Description: An issue was discovered in the Linux kernel before 4.19.3. crypto_report_one() and related functions in crypto/crypto_user.c (the crypto user configuration API) do not fully initialize structures that are copied to userspace, potentially leaking sensitive memory to user programs. NOTE: this is a CVE-2013-2547 regression but with easier exploitability because the attacker does not need a capability (however, the system must have the CONFIG_CRYPTO_USER kconfig option).
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f43f39958beb206b53292801e216d9b8a660f087; https://access.redhat.com/errata/RHSA-2019:3309; https://access.redhat.com/errata/RHSA-2019:3517
CVE: CVE-2018-11347
Published: 2018-12-04
Description: The YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header Injection. This flaw allows an attacker to inject, into the response from the server, one or several HTTP Header. It requires an interaction with the user to send him the malicious link. It could be used to perform other attacks such as user redirection to a malicious website, HTTP response splitting, or HTTP cache poisoning.
CVSS Score: 8.8 (HIGH)
CWE: CWE-113
References: https://www.bishopfox.com/news/2018/10/yunohost-2-7-2-to-2-7-14-multiple-vulnerabilities/; https://www.bishopfox.com/news/2018/10/yunohost-2-7-2-to-2-7-14-multiple-vulnerabilities/
CVE: CVE-2018-11348
Published: 2018-12-04
Description: Two XSS vulnerabilities are located in the profile edition page of the user panel of the YunoHost 2.7.2 through 2.7.14 web application. By injecting a JavaScript payload, these flaws could be used to manipulate a user's session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.bishopfox.com/news/2018/10/yunohost-2-7-2-to-2-7-14-multiple-vulnerabilities/; https://www.bishopfox.com/news/2018/10/yunohost-2-7-2-to-2-7-14-multiple-vulnerabilities/
CVE: CVE-2018-12305
Published: 2018-12-04
Description: Cross-site scripting in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript by uploading SVG images with embedded JavaScript.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc; https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE: CVE-2018-12306
Published: 2018-12-04
Description: Directory Traversal in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to view arbitrary files by modifying the "file1" URL parameter, a similar issue to CVE-2018-11344.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc; https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE: CVE-2018-12307
Published: 2018-12-04
Description: OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc; https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE: CVE-2018-12308
Published: 2018-12-04
Description: Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encrypt_key" URL parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc; https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE: CVE-2018-12309
Published: 2018-12-04
Description: Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the "path" URL parameter.  NOTE: the "filename" POST parameter is covered by CVE-2018-11345.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc; https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE: CVE-2018-12310
Published: 2018-12-04
Description: Cross-site scripting in the Login page in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript via the System Announcement feature.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc; https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE: CVE-2018-12311
Published: 2018-12-04
Description: Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript when a file is moved via a malicious filename.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc; https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE: CVE-2018-12312
Published: 2018-12-04
Description: OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secret_key" URL parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc; https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE: CVE-2018-12313
Published: 2018-12-04
Description: OS command injection in snmp.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands without authentication via the "rocommunity" URL parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc; https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE: CVE-2018-12314
Published: 2018-12-04
Description: Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "file" and "folder" URL parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc; https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE: CVE-2018-12315
Published: 2018-12-04
Description: Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-640
References: https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc; https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE: CVE-2018-12316
Published: 2018-12-04
Description: OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filename POST parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc; https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE: CVE-2018-12317
Published: 2018-12-04
Description: OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" POST parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc; https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE: CVE-2018-12318
Published: 2018-12-04
Description: Information disclosure in the SNMP settings page in ASUSTOR ADM version 3.1.1 allows attackers to obtain the SNMP password in cleartext.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200
References: https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc; https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE: CVE-2018-12319
Published: 2018-12-04
Description: Denial-of-service in the login page of ASUSTOR ADM 3.1.1 allows attackers to prevent users from signing in by placing malformed text in the title.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc; https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE: CVE-2018-6085
Published: 2018-12-04
Description: Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6086
Published: 2018-12-04
Description: A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6087
Published: 2018-12-04
Description: A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6088
Published: 2018-12-04
Description: An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6089
Published: 2018-12-04
Description: A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6090
Published: 2018-12-04
Description: An integer overflow that lead to a heap buffer-overflow in Skia in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6092
Published: 2018-12-04
Description: An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6094
Published: 2018-12-04
Description: Inline metadata in GarbageCollection in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6095
Published: 2018-12-04
Description: Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read local files via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6098
Published: 2018-12-04
Description: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6099
Published: 2018-12-04
Description: A lack of CORS checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6101
Published: 2018-12-04
Description: A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page, if the user is running a remote DevTools debugging server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6102
Published: 2018-12-04
Description: Missing confusable characters in Internationalization in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6103
Published: 2018-12-04
Description: A stagnant permission prompt in Prompts in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass permission policy via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6104
Published: 2018-12-04
Description: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6105
Published: 2018-12-04
Description: Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6107
Published: 2018-12-04
Description: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6108
Published: 2018-12-04
Description: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html