deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-0376
Published: 2016-06-03
Description: The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) does not properly deserialize classes in an AccessController doPrivileged block, which allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code as demonstrated by the readValue method of the com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton class, which implements the javax.rmi.CORBA.ValueHandler interface.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-5456.
CVSS Score: 8.1 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00042.html
CVE: CVE-2016-3096
Published: 2016-06-03
Description: The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archive_path directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183103.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183132.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183252.html
CVE: CVE-2016-3944
Published: 2016-06-03
Description: UpdateAgent in Lenovo Accelerator Application allows man-in-the-middle attackers to execute arbitrary code by spoofing an update response from susapi.lenovomm.com.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://duo.com/blog/out-of-box-exploitation-a-security-analysis-of-oem-updaters; https://support.lenovo.com/us/en/product_security/len_6718; https://duo.com/blog/out-of-box-exploitation-a-security-analysis-of-oem-updaters
CVE: CVE-2016-4804
Published: 2016-06-03
Description: The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat function.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-06/msg00001.html; http://lists.opensuse.org/opensuse-updates/2016-09/msg00014.html; http://www.securityfocus.com/bid/90311
CVE: CVE-2016-0908
Published: 2016-06-04
Description: EMC Isilon OneFS 7.1.x before 7.1.1.9 and 7.2.x before 7.2.1.2 allows local users to obtain root shell access by leveraging administrative privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/bugtraq/2016/Jun/13; http://seclists.org/bugtraq/2016/Jun/13
CVE: CVE-2016-1390
Published: 2016-06-04
Description: Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) allow local users to obtain root access via crafted CLI input, aka Bug ID CSCuy21892.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160601-prime1; http://www.securitytracker.com/id/1036015; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160601-prime1
CVE: CVE-2016-1391
Published: 2016-06-04
Description: Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(2) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(2) allow remote authenticated users to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuy21889.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160601-prime2; http://www.securitytracker.com/id/1036014; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160601-prime2
CVE: CVE-2016-1211
Published: 2016-06-04
Description: Cross-site scripting (XSS) vulnerability in Epoch Web Mailing List 0.31 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN43076390/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000066; http://www.psl.ne.jp/perl/ml/index.html
CVE: CVE-2016-1403
Published: 2016-06-04
Description: CISCO IP 8800 phones with software 11.0.1 and earlier allow local users to gain privileges for OS command execution via crafted CLI commands, aka Bug ID CSCuz03005.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160603-ipp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160603-ipp
CVE: CVE-2016-4562
Published: 2016-06-04
Description: The DrawDashPolygon function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 mishandles calculations of certain vertices integer data, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.imagemagick.org/script/changelog.php; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html; https://github.com/ImageMagick/ImageMagick/commit/726812fa2fa7ce16bcf58f6e115f65427a1c0950
CVE: CVE-2016-4563
Published: 2016-06-04
Description: The TraceStrokePolygon function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 mishandles the relationship between the BezierQuantum value and certain strokes data, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.imagemagick.org/script/changelog.php; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html; https://github.com/ImageMagick/ImageMagick/commit/726812fa2fa7ce16bcf58f6e115f65427a1c0950
CVE: CVE-2016-4564
Published: 2016-06-04
Description: The DrawImage function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 makes an incorrect function call in attempting to locate the next token, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.imagemagick.org/script/changelog.php; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html; https://github.com/ImageMagick/ImageMagick/commit/726812fa2fa7ce16bcf58f6e115f65427a1c0950
CVE: CVE-2016-4812
Published: 2016-06-04
Description: Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved plugin before 2.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN26026353/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000071; https://srd.wordpress.org/plugins/markdown-on-save-improved/changelog/
CVE: CVE-2016-1212
Published: 2016-06-05
Description: Directory traversal vulnerability in futomi MP Form Mail CGI Professional Edition 3.2.3 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors.
CVSS Score: 2.7 (LOW)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN42545812/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000069; http://www.futomi.com/library/info/2016/201605.html
CVE: CVE-2016-1222
Published: 2016-06-05
Description: Cross-site scripting (XSS) vulnerability in Kobe Beauty php-contact-form before 2016-05-18 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN85112513/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000070; http://www.kobe-beauty.co.jp/php-contact-form/
CVE: CVE-2016-1229
Published: 2016-06-05
Description: Cross-site scripting (XSS) vulnerability in HumHub 0.20.0-beta.1 through 0.20.1 and 1.0.0-beta before 1.0.0-beta.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN56167268/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000068; https://github.com/humhub/humhub/releases/tag/v1.0.0-beta.3
CVE: CVE-2016-1230
Published: 2016-06-05
Description: Cross-site scripting (XSS) vulnerability in NTT PC Communications WebARENA Service formmail before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN24143619/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000072; http://web.arena.ne.jp/support/news/2016/0208.html
CVE: CVE-2016-1672
Published: 2016-06-05
Description: The ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the extension bindings in Google Chrome before 51.0.2704.63 mishandles properties, which allows remote attackers to conduct bindings-interception attacks and bypass the Same Origin Policy via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-254, CWE-284
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1673
Published: 2016-06-05
Description: Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVSS Score: 8.8 (HIGH)
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1674
Published: 2016-06-05
Description: The extensions subsystem in Google Chrome before 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVSS Score: 8.8 (HIGH)
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1675
Published: 2016-06-05
Description: Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy by leveraging the mishandling of Document reattachment during destruction, related to FrameLoader.cpp and LocalFrame.cpp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1676
Published: 2016-06-05
Description: extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.63 does not properly use prototypes, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1677
Published: 2016-06-05
Description: uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain sensitive information by calling the decodeURI function and leveraging "type confusion."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1678
Published: 2016-06-05
Description: objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JavaScript code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1679
Published: 2016-06-05
Description: The ToV8Value function in content/child/v8_value_converter_impl.cc in the V8 bindings in Google Chrome before 51.0.2704.63 does not properly restrict use of getters and setters, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code.
CVSS Score: 8.8 (HIGH)
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1680
Published: 2016-06-05
Description: Use-after-free vulnerability in ports/SkFontHost_FreeType.cpp in Skia, as used in Google Chrome before 51.0.2704.63, allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1681
Published: 2016-06-05
Description: Heap-based buffer overflow in the opj_j2k_read_SPCod_SPCoc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 51.0.2704.63, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1682
Published: 2016-06-05
Description: The ServiceWorkerContainer::registerServiceWorkerImpl function in WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.cpp in Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a ServiceWorker registration.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-254, CWE-284
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1683
Published: 2016-06-05
Description: numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles namespace nodes, which allows remote attackers to cause a denial of service (out-of-bounds heap memory access) or possibly have unspecified other impact via a crafted document.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html; http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
CVE: CVE-2016-1684
Published: 2016-06-05
Description: numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles the i format token for xsl:number data, which allows remote attackers to cause a denial of service (integer overflow or resource consumption) or possibly have unspecified other impact via a crafted document.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html; http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
CVE: CVE-2016-1685
Published: 2016-06-05
Description: core/fxge/ge/fx_ge_text.cpp in PDFium, as used in Google Chrome before 51.0.2704.63, miscalculates certain index values, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1686
Published: 2016-06-05
Description: The CPDF_DIBSource::CreateDecoder function in core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp in PDFium, as used in Google Chrome before 51.0.2704.63, mishandles decoder-initialization failure, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1687
Published: 2016-06-05
Description: The renderer implementation in Google Chrome before 51.0.2704.63 does not properly restrict public exposure of classes, which allows remote attackers to obtain sensitive information via vectors related to extensions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1688
Published: 2016-06-05
Description: The regexp (aka regular expression) implementation in Google V8 before 5.0.71.40, as used in Google Chrome before 51.0.2704.63, mishandles external string sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted JavaScript code.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1689
Published: 2016-06-05
Description: Heap-based buffer overflow in content/renderer/media/canvas_capture_handler.cc in Google Chrome before 51.0.2704.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1690
Published: 2016-06-05
Description: The Autofill implementation in Google Chrome before 51.0.2704.63 mishandles the interaction between field updates and JavaScript code that triggers a frame deletion, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site, a different vulnerability than CVE-2016-1701.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1691
Published: 2016-06-05
Description: Skia, as used in Google Chrome before 51.0.2704.63, mishandles coincidence runs, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted curves, related to SkOpCoincidence.cpp and SkPathOpsCommon.cpp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1692
Published: 2016-06-05
Description: WebKit/Source/core/css/StyleSheetContents.cpp in Blink, as used in Google Chrome before 51.0.2704.63, permits cross-origin loading of CSS stylesheets by a ServiceWorker even when the stylesheet download has an incorrect MIME type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1693
Published: 2016-06-05
Description: browser/safe_browsing/srt_field_trial_win.cc in Google Chrome before 51.0.2704.63 does not use the HTTPS service on dl.google.com to obtain the Software Removal Tool, which allows remote attackers to spoof the chrome_cleanup_tool.exe (aka CCT) file via a man-in-the-middle attack on an HTTP session.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1694
Published: 2016-06-05
Description: browser/browsing_data/browsing_data_remover.cc in Google Chrome before 51.0.2704.63 deletes HPKP pins during cache clearing, which makes it easier for remote attackers to spoof web sites via a valid certificate from an arbitrary recognized Certification Authority.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1695
Published: 2016-06-05
Description: Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.63 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 8.8 (HIGH)
References: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html
CVE: CVE-2016-1696
Published: 2016-06-05
Description: The extensions subsystem in Google Chrome before 51.0.2704.79 does not properly restrict bindings access, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-254, CWE-284
References: http://googlechromereleases.blogspot.com/2016/06/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00004.html