deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-15919
Published: 2018-08-28
Description: Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability.'
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://seclists.org/oss-sec/2018/q3/180; http://www.securityfocus.com/bid/105163; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-1705
Published: 2018-08-28
Description: IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 contain an information disclosure vulnerability that could allow an authenticated attacker to obtain highly sensitive information. IBM X-Force ID: 146340.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/146340; https://www.ibm.com/support/docview.wss?uid=ibm10719665; https://exchange.xforce.ibmcloud.com/vulnerabilities/146340
CVE: CVE-2018-13391
Published: 2018-08-28
Description: The ProfileLinkUserFormat component of Jira Server before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3 and from version 7.11.0 before version 7.11.2 allows remote attackers who can access & view an issue to obtain the email address of the reporter and assignee user of an issue despite the configured email visibility setting being set to hidden.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/105165; https://jira.atlassian.com/browse/JRASERVER-67750; http://www.securityfocus.com/bid/105165
CVE: CVE-2018-13395
Published: 2018-08-28
Description: Various resources in Atlassian Jira before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3 and before version 7.11.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the epic colour field of an issue while an issue is being moved.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-67848; https://jira.atlassian.com/browse/JRASERVER-67848
CVE: CVE-2014-4932
Published: 2018-08-28
Description: Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://techdefencelabs.com/security-advisories.html; https://www.wordfence.com/help/advanced/changelog/; http://techdefencelabs.com/security-advisories.html
CVE: CVE-2014-6045
Published: 2018-08-28
Description: SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via vectors involving the restore function.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://techdefencelabs.com/security-advisories.html; https://www.phpmyfaq.de/security/advisory-2014-09-16; http://techdefencelabs.com/security-advisories.html
CVE: CVE-2014-6046
Published: 2018-08-28
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that (1) delete active users by leveraging improper validation of CSRF tokens or that (2) delete open questions, (3) activate users, (4) publish FAQs, (5) add or delete Glossary, (6) add or delete FAQ news, or (7) add or delete comments or add votes by leveraging lack of a CSRF token.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://techdefencelabs.com/security-advisories.html; https://www.phpmyfaq.de/security/advisory-2014-09-16; http://techdefencelabs.com/security-advisories.html
CVE: CVE-2014-6047
Published: 2018-08-28
Description: phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an attachment" permission checks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-275
References: http://techdefencelabs.com/security-advisories.html; https://www.phpmyfaq.de/security/advisory-2014-09-16; http://techdefencelabs.com/security-advisories.html
CVE: CVE-2014-6048
Published: 2018-08-28
Description: phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://techdefencelabs.com/security-advisories.html; https://www.phpmyfaq.de/security/advisory-2014-09-16; http://techdefencelabs.com/security-advisories.html
CVE: CVE-2014-6049
Published: 2018-08-28
Description: phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter.
CVSS Score: 2.7 (LOW)
CWE: CWE-285
References: http://techdefencelabs.com/security-advisories.html; https://www.phpmyfaq.de/security/advisory-2014-09-16; http://techdefencelabs.com/security-advisories.html
CVE: CVE-2014-6050
Published: 2018-08-28
Description: phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-254
References: http://techdefencelabs.com/security-advisories.html; https://www.phpmyfaq.de/security/advisory-2014-09-16; http://techdefencelabs.com/security-advisories.html
CVE: CVE-2018-15529
Published: 2018-08-28
Description: A command injection vulnerability in maintenance.cgi in Mutiny "Monitoring Appliance" before 6.1.0-5263 allows authenticated users, with access to the admin interface, to inject arbitrary commands within the filename of a system upgrade upload.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/149065/Mutiny-Monitoring-Appliance-Command-Injection.html; https://doddsecurity.com/135/remote-command-execution-on-the-monitoring-appliances/; https://github.com/doddr/Security-Advisories/tree/master/Mutiny/CVE-2018-15529
CVE: CVE-2018-15571
Published: 2018-08-28
Description: The Export Users to CSV plugin through 1.1.1 for WordPress allows CSV injection.
CVSS Score: 8.6 (HIGH)
CWE: CWE-1236
References: https://hackpuntes.com/cve-2018-15571-wordpress-plugin-export-users-to-csv-1-1-1-csv-injection/; https://www.exploit-db.com/exploits/45206/; https://hackpuntes.com/cve-2018-15571-wordpress-plugin-export-users-to-csv-1-1-1-csv-injection/
CVE: CVE-2018-15839
Published: 2018-08-28
Description: D-Link DIR-615 devices have a buffer overflow via a long Authorization HTTP header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://hackingvila.wordpress.com/2018/08/24/d-link-dir-615-buffer-overflow-via-a-long-authorization-http-header-click-here/; https://www.exploit-db.com/exploits/45317/; https://hackingvila.wordpress.com/2018/08/24/d-link-dir-615-buffer-overflow-via-a-long-authorization-http-header-click-here/
CVE: CVE-2018-3926
Published: 2018-08-28
Description: An exploitable integer underflow vulnerability exists in the ZigBee firmware update routine of the hubCore binary of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore process incorrectly handles malformed files existing in its data directory, leading to an infinite loop, which eventually causes the process to crash. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191
References: http://www.securityfocus.com/bid/105162; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0593; http://www.securityfocus.com/bid/105162
CVE: CVE-2017-15407
Published: 2018-08-28
Description: Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to gain code execution via a malicious server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://access.redhat.com/errata/RHSA-2017:3401; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html; https://crbug.com/778505
CVE: CVE-2017-15408
Published: 2018-08-28
Description: Heap buffer overflow in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file that is mishandled by PDFium.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://access.redhat.com/errata/RHSA-2017:3401; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html; https://crbug.com/762374
CVE: CVE-2017-15409
Published: 2018-08-28
Description: Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://access.redhat.com/errata/RHSA-2017:3401; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html; https://crbug.com/763972
CVE: CVE-2017-15410
Published: 2018-08-28
Description: Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://access.redhat.com/errata/RHSA-2017:3401; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html; https://crbug.com/765921
CVE: CVE-2017-15411
Published: 2018-08-28
Description: Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://access.redhat.com/errata/RHSA-2017:3401; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html; https://crbug.com/770148
CVE: CVE-2017-15412
Published: 2018-08-28
Description: Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1040348; https://access.redhat.com/errata/RHSA-2017:3401; https://access.redhat.com/errata/RHSA-2018:0287
CVE: CVE-2017-15413
Published: 2018-08-28
Description: Type confusion in WebAssembly in V8 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-704
References: https://access.redhat.com/errata/RHSA-2017:3401; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html; https://crbug.com/766666
CVE: CVE-2017-15415
Published: 2018-08-28
Description: Incorrect serialization in IPC in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the value of a pointer via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://access.redhat.com/errata/RHSA-2017:3401; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html; https://crbug.com/765512
CVE: CVE-2017-15416
Published: 2018-08-28
Description: Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka a Blink out-of-bounds read.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://access.redhat.com/errata/RHSA-2017:3401; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html; https://crbug.com/779314
CVE: CVE-2017-15417
Published: 2018-08-28
Description: Inappropriate implementation in Skia canvas composite operations in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: https://access.redhat.com/errata/RHSA-2017:3401; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html; https://crbug.com/699028
CVE: CVE-2017-15418
Published: 2018-08-28
Description: Use of uninitialized memory in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: https://access.redhat.com/errata/RHSA-2017:3401; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html; https://crbug.com/765858
CVE: CVE-2017-15419
Published: 2018-08-28
Description: Insufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to infer browsing history by triggering a leaked cross-origin URL via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601
References: https://access.redhat.com/errata/RHSA-2017:3401; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html; https://crbug.com/780312
CVE: CVE-2017-15420
Published: 2018-08-28
Description: Incorrect handling of back navigations in error pages in Navigation in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2017:3401; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
CVE: CVE-2017-15422
Published: 2018-08-28
Description: Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://access.redhat.com/errata/RHSA-2017:3401; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html; https://crbug.com/774382
CVE: CVE-2017-15423
Published: 2018-08-28
Description: Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512(password) by inspecting protocol traffic.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-310
References: https://access.redhat.com/errata/RHSA-2017:3401; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html; https://crbug.com/778101
CVE: CVE-2017-15424
Published: 2018-08-28
Description: Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://access.redhat.com/errata/RHSA-2017:3401; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html; https://crbug.com/756226
CVE: CVE-2017-15425
Published: 2018-08-28
Description: Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://access.redhat.com/errata/RHSA-2017:3401; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html; https://crbug.com/756456
CVE: CVE-2017-15426
Published: 2018-08-28
Description: Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://access.redhat.com/errata/RHSA-2017:3401; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html; https://crbug.com/756735
CVE: CVE-2017-15427
Published: 2018-08-28
Description: Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/errata/RHSA-2017:3401; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html; https://crbug.com/768910
CVE: CVE-2017-15430
Published: 2018-08-28
Description: Insufficient data validation in Chromecast plugin in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html; https://crbug.com/780484; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-14400
Published: 2018-08-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2018-14572
Published: 2018-08-28
Description: In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-502
References: https://github.com/PyconUK/ConferenceScheduler-cli/issues/19; https://joel-malwarebenchmark.github.io/blog/2020/04/25/cve-2018-14572-conference-scheduler-cli/; https://github.com/PyconUK/ConferenceScheduler-cli/issues/19
CVE: CVE-2018-15596
Published: 2018-08-28
Description: An issue was discovered in inc/class_feedgeneration.php in MyBB 1.8.17. On the forum RSS Syndication page, one can generate a URL such as http://localhost/syndication.php?fid=&type=atom1.0&limit=15. The thread titles (within title elements of the generated XML documents) aren't sanitized, leading to XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.mybb.com/2018/08/22/mybb-1-8-18-released-security-maintenance-release/; https://www.exploit-db.com/exploits/45393/; https://blog.mybb.com/2018/08/22/mybb-1-8-18-released-security-maintenance-release/
CVE: CVE-2018-15608
Published: 2018-08-28
Description: Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the "AD Delegation" "Help Desk Technicians" screen.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/45254/; https://www.exploit-db.com/exploits/45254/
CVE: CVE-2018-15740
Published: 2018-08-28
Description: Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/149097/ManageEngine-ADManager-Plus-6.5.7-Cross-Site-Scripting.html; https://drive.google.com/open?id=0Bw8rxEHEov76a0hwbFFVLVRMMjYxc05VV2JYc21NLXJiSHhJ; https://drive.google.com/open?id=0Bw8rxEHEov76cUVxZUxWS3lIanZ1VjhxSVBhdHBHUmJ1dmhr
CVE: CVE-2018-15873
Published: 2018-08-28
Description: A SQL Injection issue was discovered in Sentrifugo 3.2 via the deptid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://hackpuntes.com/cve-2018-15873-sentrifugo-hrms-3-2-blind-sql-injection/; https://hackpuntes.com/cve-2018-15873-sentrifugo-hrms-3-2-blind-sql-injection/
CVE: CVE-2018-15884
Published: 2018-08-28
Description: RICOH MP C4504ex devices allow HTML Injection via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-352
References: http://packetstormsecurity.com/files/149082/RICOH-MP-C4504ex-Cross-Site-Request-Forgery.html; https://www.exploit-db.com/exploits/45264/; http://packetstormsecurity.com/files/149082/RICOH-MP-C4504ex-Cross-Site-Request-Forgery.html
CVE: CVE-2018-15901
Published: 2018-08-28
Description: e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/dhananjay-bajaj/e107_2.1.8_csrf; https://github.com/dhananjay-bajaj/e107_2.1.8_csrf/blob/master/E107_v2.1.8_CSRF_POC.pdf; https://github.com/dhananjay-bajaj/e107_2.1.8_csrf
CVE: CVE-2018-3895
Published: 2018-08-28
Description: An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 Firmware version 0.20.17. The strncpy call overflows the destination buffer, which has a size of 52 bytes. An attacker can send an arbitrarily long 'endTime' value in order to exploit this vulnerability. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0570; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0570
CVE: CVE-2018-3908
Published: 2018-08-28
Description: An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, URL and body. With the implementation of the on_body callback, defined by sub_41734, an attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0577; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0577
CVE: CVE-2018-6643
Published: 2018-08-28
Description: Infoblox NetMRI 7.1.1 has Reflected Cross-Site Scripting via the /api/docs/index.php query parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/undefinedmode/CVE-2018-6643; https://github.com/undefinedmode/CVE-2018-6643
CVE: CVE-2017-15396
Published: 2018-08-28
Description: A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google Chrome prior to 62.0.3202.75 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://bugs.icu-project.org/trac/changeset/40494; http://www.securityfocus.com/bid/101597; https://access.redhat.com/errata/RHSA-2017:3082
CVE: CVE-2017-15398
Published: 2018-08-28
Description: A stack buffer overflow in the QUIC networking stack in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to gain code execution via a malicious server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101692; https://access.redhat.com/errata/RHSA-2017:3151; https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html
CVE: CVE-2017-15399
Published: 2018-08-28
Description: A use after free in V8 in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/101692; https://access.redhat.com/errata/RHSA-2017:3151; https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html
CVE: CVE-2017-15406
Published: 2018-08-28
Description: A stack buffer overflow in V8 in Google Chrome prior to 62.0.3202.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html; https://crbug.com/770450; https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html
CVE: CVE-2017-15429
Published: 2018-08-28
Description: Inappropriate implementation in V8 WebAssembly JS bindings in Google Chrome prior to 63.0.3239.108 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102196; https://access.redhat.com/errata/RHSA-2017:3479; https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html