rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-1239 
Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service (process crash) via a crafted PDF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T17:00:00.000Z
CVE-2015-1240 
gpu/blink/webgraphicscontext3d_impl.cc in the WebGL implementation in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WebGL program that triggers a state inconsistency.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-19T10:00:00.000Z
CVE-2015-1241 
Google Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation with the handling of touch events and gesture events, which allows remote attackers to trigger unintended UI actions via a crafted web site that conducts a "tapjacking" attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-19T10:00:00.000Z
CVE-2015-1242 
The ReduceTransitionElementsKind function in hydrogen-check-elimination.cc in Google V8 before 4.2.77.8, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that leverages "type confusion" in the check-elimination optimization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-19T10:00:00.000Z
CVE-2015-1243 
Use-after-free vulnerability in the MutationObserver::disconnect function in core/dom/MutationObserver.cpp in the DOM implementation in Blink, as used in Google Chrome before 42.0.2311.135, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an attempt to unregister a MutationObserver object that is not currently registered.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-01T10:00:00.000Z
CVE-2015-1244 
The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for WebSocket traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-19T10:00:00.000Z
CVE-2015-1245 
Use-after-free vulnerability in the OpenPDFInReaderView::Update function in browser/ui/views/location_bar/open_pdf_in_reader_view.cc in Google Chrome before 41.0.2272.76 might allow user-assisted remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by triggering interaction with a PDFium "Open PDF in Reader" button that has an invalid tab association.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-19T10:00:00.000Z
CVE-2015-1246 
Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-19T10:00:00.000Z
CVE-2015-1247 
The SearchEngineTabHelper::OnPageHasOSDD function in browser/ui/search_engines/search_engine_tab_helper.cc in Google Chrome before 42.0.2311.90 does not prevent use of a file: URL for an OpenSearch descriptor XML document, which might allow remote attackers to obtain sensitive information from local files via a crafted (1) http or (2) https web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-19T10:00:00.000Z
CVE-2015-1248 
The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the SafeBrowsing for Executable Files protection mechanism by creating a .exe file in a temporary filesystem and then referencing this file with a filesystem:http: URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-19T10:00:00.000Z
CVE-2015-1249 
Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.90 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-19T10:00:00.000Z
CVE-2015-1250 
Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-01T10:00:00.000Z
CVE-2015-1251 
Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem in Google Chrome before 43.0.2357.65 allows remote attackers to execute arbitrary code via a crafted document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T10:00:00.000Z
CVE-2015-1252 
common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T10:00:00.000Z
CVE-2015-1253 
core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T10:00:00.000Z
CVE-2015-1254 
core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T10:00:00.000Z
CVE-2015-1255 
Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation in Google Chrome before 43.0.2357.65 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging improper handling of a stop action for an audio track.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T10:00:00.000Z
CVE-2015-1256 
Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that leverages improper handling of a shadow tree for a use element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T10:00:00.000Z
CVE-2015-1257 
platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (container overflow) or possibly have unspecified other impact via a crafted document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T10:00:00.000Z
CVE-2015-1258 
Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, which allows remote attackers to trigger a negative value for a size field, and consequently cause a denial of service or possibly have unspecified other impact, via a crafted frame size in VP9 video data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T10:00:00.000Z
CVE-2015-1259 
PDFium, as used in Google Chrome before 43.0.2357.65, does not properly initialize memory, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T10:00:00.000Z
CVE-2015-1260 
Multiple use-after-free vulnerabilities in content/renderer/media/user_media_client_impl.cc in the WebRTC implementation in Google Chrome before 43.0.2357.65 allow remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that executes upon completion of a getUserMedia request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T10:00:00.000Z
CVE-2015-1261 
android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or deliver misleading popup content via crafted text.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T10:00:00.000Z
CVE-2015-1262 
platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width field, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Unicode text.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T10:00:00.000Z
CVE-2015-1263 
The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T10:00:00.000Z
CVE-2015-1264 
Cross-site scripting (XSS) vulnerability in Google Chrome before 43.0.2357.65 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted data that is improperly handled by the Bookmarks feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T10:00:00.000Z
CVE-2015-1265 
Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T10:00:00.000Z
CVE-2015-1266 
content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated with a WebUI SiteInstance, which allows remote attackers to bypass intended access restrictions via a similar URL, as demonstrated by use of http://gpu when there is a WebUI class for handling chrome://gpu requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-26T14:00:00.000Z
CVE-2015-1267 
Blink, as used in Google Chrome before 43.0.2357.130, does not properly restrict the creation context during creation of a DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that uses a Blink public API, related to WebArrayBufferConverter.cpp, WebBlob.cpp, WebDOMError.cpp, and WebDOMFileSystem.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-26T14:00:00.000Z
CVE-2015-1268 
bindings/scripts/v8_types.py in Blink, as used in Google Chrome before 43.0.2357.130, does not properly select a creation context for a return value's DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code, as demonstrated by use of a data: URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-26T14:00:00.000Z
CVE-2015-1269 
The DecodeHSTSPreloadRaw function in net/http/transport_security_state.cc in Google Chrome before 43.0.2357.130 does not properly canonicalize DNS hostnames before making comparisons to HSTS or HPKP preload entries, which allows remote attackers to bypass intended access restrictions via a string that (1) ends in a . (dot) character or (2) is not entirely lowercase.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-26T14:00:00.000Z
CVE-2015-1270 
The ucnv_io_getConverterName function in common/ucnv_io.cpp in International Components for Unicode (ICU), as used in Google Chrome before 44.0.2403.89, mishandles converter names with initial x- substrings, which allows remote attackers to cause a denial of service (read of uninitialized memory) or possibly have unspecified other impact via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1271 
PDFium, as used in Google Chrome before 44.0.2403.89, does not properly handle certain out-of-memory conditions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted PDF document that triggers a large memory allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1272 
Use-after-free vulnerability in the GPU process implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging the continued availability of a GPUChannelHost data structure during Blink shutdown, related to content/browser/gpu/browser_gpu_channel_host_factory.cc and content/renderer/render_thread_impl.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1273 
Heap-based buffer overflow in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid JPEG2000 data in a PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1274 
Google Chrome before 44.0.2403.89 does not ensure that the auto-open list omits all dangerous file types, which makes it easier for remote attackers to execute arbitrary code by providing a crafted file and leveraging a user's previous "Always open files of this type" choice, related to download_commands.cc and download_prefs.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1275 
Cross-site scripting (XSS) vulnerability in org/chromium/chrome/browser/UrlUtilities.java in Google Chrome before 44.0.2403.89 on Android allows remote attackers to inject arbitrary web script or HTML via a crafted intent: URL, as demonstrated by a trailing alert(document.cookie);// substring, aka "Universal XSS (UXSS)."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1276 
Use-after-free vulnerability in content/browser/indexed_db/indexed_db_backing_store.cc in the IndexedDB implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging an abort action before a certain write operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1277 
Use-after-free vulnerability in the accessibility implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging lack of certain validity checks for accessibility-tree data structures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1278 
content/browser/web_contents/web_contents_impl.cc in Google Chrome before 44.0.2403.89 does not ensure that a PDF document's modal dialog is closed upon navigation to an interstitial page, which allows remote attackers to spoof URLs via a crafted document, as demonstrated by the alert_dialog.pdf document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1279 
Integer overflow in the CJBig2_Image::expand function in fxcodec/jbig2/JBig2_Image.cpp in PDFium, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via large height and stride values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1280 
SkPictureShader.cpp in Skia, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging access to a renderer process and providing crafted serialized data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1281 
core/loader/ImageLoader.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly determine the V8 context of a microtask, which allows remote attackers to bypass Content Security Policy (CSP) restrictions by providing an image from an unintended source.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1282 
Multiple use-after-free vulnerabilities in fpdfsdk/src/javascript/Document.cpp in PDFium, as used in Google Chrome before 44.0.2403.89, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document, related to the (1) Document::delay and (2) Document::DoFieldDelay functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1283 
Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1284 
The LocalFrame::isURLAllowed function in core/frame/LocalFrame.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly check for a page's maximum number of frames, which allows remote attackers to cause a denial of service (invalid count value and use-after-free) or possibly have unspecified other impact via crafted JavaScript code that makes many createElement calls for IFRAME elements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1285 
The XSSAuditor::canonicalize function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 44.0.2403.89, does not properly choose a truncation point, which makes it easier for remote attackers to obtain sensitive information via an unspecified linear-time attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1286 
Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler.cc in Google Chrome before 44.0.2403.89 allows remote attackers to inject arbitrary web script or HTML by leveraging the lack of a certain V8 context restriction, aka a Blink "Universal XSS (UXSS)."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1287 
Blink, as used in Google Chrome before 44.0.2403.89, enables a quirks-mode exception that limits the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to core/fetch/CSSStyleSheetResource.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1288 
The Spellcheck API implementation in Google Chrome before 44.0.2403.89 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file, a related issue to CVE-2015-1263.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1289 
Multiple unspecified vulnerabilities in Google Chrome before 44.0.2403.89 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-23T00:00:00.000Z
CVE-2015-1290 
The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1, allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-09T16:00:00.000Z
CVE-2015-1291 
The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not check whether a node is expected, which allows remote attackers to bypass the Same Origin Policy or cause a denial of service (DOM tree corruption) via a web site with crafted JavaScript code and IFRAME elements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-03T22:00:00.000Z
CVE-2015-1292 
The NavigatorServiceWorker::serviceWorker function in modules/serviceworkers/NavigatorServiceWorker.cpp in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy by accessing a Service Worker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-03T22:00:00.000Z
CVE-2015-1293 
The DOM implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-03T22:00:00.000Z
CVE-2015-1294 
Use-after-free vulnerability in the SkMatrix::invertNonIdentity function in core/SkMatrix.cpp in Skia, as used in Google Chrome before 45.0.2454.85, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering the use of matrix elements that lead to an infinite result during an inversion calculation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-03T22:00:00.000Z
CVE-2015-1295 
Multiple use-after-free vulnerabilities in the PrintWebViewHelper class in components/printing/renderer/print_web_view_helper.cc in Google Chrome before 45.0.2454.85 allow user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact by triggering nested IPC messages during preparation for printing, as demonstrated by messages associated with PDF documents in conjunction with messages about printer capabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-03T22:00:00.000Z