rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-17384 
SQL Injection exists in the Swap Factory 2.2.1 component for Joomla! via the filter_order_Dir or filter_order parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-28T00:00:00.000Z
CVE-2018-17385 
SQL Injection exists in the Social Factory 3.8.3 component for Joomla! via the radius[lat], radius[lng], or radius[radius] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-28T00:00:00.000Z
CVE-2018-17386 
SQL Injection exists in the Micro Deal Factory 2.4.0 component for Joomla! via the id parameter, or the PATH_INFO to mydeals/ or listdeals/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T17:10:10.000Z
CVE-2018-17387 
CSRF exists in Nimble Messaging Bulk SMS Marketing Application 1.0 for adding an admin account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T17:04:39.000Z
CVE-2018-17388 
SQL Injection exists in Twilio WEB To Fax Machine System 1.0 via the email or password parameter to login_check.php, or the id parameter to add_email.php or edit_content.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T17:00:59.000Z
CVE-2018-17389 
CSRF exists in server.php in Live Call Support Application 1.5 for adding an admin account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T16:55:08.000Z
CVE-2018-17391 
SQL Injection exists in authors_post.php in Super Cms Blog Pro 1.0 via the author parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-28T00:00:00.000Z
CVE-2018-17393 
SQL Injection exists in HealthNode Hospital Management System 1.0 via the id parameter to dashboard/Patient/info.php or dashboard/Patient/patientdetails.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T16:46:41.000Z
CVE-2018-17394 
SQL Injection exists in the Timetable Schedule 3.6.8 component for Joomla! via the eid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-28T00:00:00.000Z
CVE-2018-17397 
SQL Injection exists in the AlphaIndex Dictionaries 1.0 component for Joomla! via the letter parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-28T00:00:00.000Z
CVE-2018-17398 
SQL Injection exists in the AMGallery 1.2.3 component for Joomla! via the filter_category_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T16:44:56.000Z
CVE-2018-17399 
SQL Injection exists in the Jimtawl 2.2.7 component for Joomla! via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T16:41:56.000Z
CVE-2018-17400 
The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to perform Account Takeover attacks by intercepting the user name and PIN during the initial configuration of the application.  NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibility permission to the malicious app, that the Android platform provides fair warnings to the users before turning on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or malicious apps taking screenshots
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-23T22:00:00.000Z
CVE-2018-17401 
The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to perform Account Takeover attacks by exploiting its Forgot Password feature.  NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibility permission to the malicious app, that the Android platform provides fair warnings to the users before turning on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or malicious apps taking screenshots
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-23T22:00:00.000Z
CVE-2018-17402 
The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to discover the Credit/Debit card number, expiration date, and CVV number.  NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibility permission to the malicious app, that the Android platform provides fair warnings to the users before turning on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or malicious apps taking screenshots
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-23T22:00:00.000Z
CVE-2018-17403 
The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to impersonate a user and set up their account without their knowledge.  NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibility permission to the malicious app, that the Android platform provides fair warnings to the users before turning on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or malicious apps taking screenshots
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-23T22:00:00.000Z
CVE-2018-17404 
The SBIbuddy (aka com.sbi.erupee) application 1.41 and 1.42 for Android might allow an attacker to sniff private information such as mobile number, PAN number (from a government-issued ID), and date of birth.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-23T22:00:00.000Z
CVE-2018-17407 
An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-23T21:00:00.000Z
CVE-2018-17408 
Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute arbitrary code via a crafted CSV file that is accessed through the Import CSV File menu.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-03T20:00:00.000Z
CVE-2018-17410 
Horus CMS allows SQL Injection, as demonstrated by a request to the /busca or /home URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-26T21:00:00.000Z
CVE-2018-17411 
An XML External Entity (XXE) vulnerability exists in iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-26T22:00:00.000Z
CVE-2018-17412 
zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-07T22:00:00.000Z
CVE-2018-17413 
XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-07T22:00:00.000Z
CVE-2018-17414 
zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-07T22:00:00.000Z
CVE-2018-17415 
zzcms V8.3 has a SQL injection in /user/zs_elite.php via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-07T22:00:00.000Z
CVE-2018-17416 
A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-07T22:00:00.000Z
CVE-2018-17418 
Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbidden_types variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-07T22:00:00.000Z
CVE-2018-17419 
An issue was discovered in setTA in scan_rr.go in the Miek Gieben DNS library before 1.0.10 for Go. A dns.ParseZone() parsing error causes a segmentation violation, leading to denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-07T22:00:00.000Z
CVE-2018-17420 
An issue was discovered in ZrLog 2.0.3. There is a SQL injection vulnerability in the article management search box via the keywords parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-07T22:00:00.000Z
CVE-2018-17421 
An issue was discovered in ZrLog 2.0.3. There is stored XSS in the file upload area via a crafted attached/file/ pathname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-07T22:00:00.000Z
CVE-2018-17422 
dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/common/page_preview_popup.jsp hostname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-07T22:00:00.000Z
CVE-2018-17423 
An issue was discovered in e107 v2.1.9. There is a XSS attack on e107_admin/comment.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T16:38:15.000Z
CVE-2018-17425 
WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-07T22:00:00.000Z
CVE-2018-17426 
WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-07T22:00:00.000Z
CVE-2018-17427 
SIMDComp before 0.1.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) because it can read (and then discard) extra bytes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-01T08:00:00.000Z
CVE-2018-17428 
An issue was discovered in OPAC EasyWeb Five 5.7. There is SQL injection via the w2001/index.php?scelta=campi biblio parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-03T20:00:00.000Z
CVE-2018-17429 
/console/account/manage.php?type=action&action=add in JTBC v3.0(C) has CSRF for adding an administrator account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-07T22:00:00.000Z
CVE-2018-17431 
Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-29T23:00:00.000Z
CVE-2018-17432 
A NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a crafted HDF5 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-24T14:00:00.000Z
CVE-2018-17433 
A heap-based buffer overflow in ReadGifImageDesc() in gifread.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while converting a GIF file to an HDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-24T14:00:00.000Z
CVE-2018-17434 
A SIGFPE signal is raised in the function apply_filters() of h5repack_filters.c in the HDF HDF5 through 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. It could allow a remote denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-24T00:00:00.000Z
CVE-2018-17435 
A heap-based buffer over-read in H5O_attr_decode() in H5Oattr.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while converting an HDF file to GIF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-24T14:00:00.000Z
CVE-2018-17436 
ReadCode() in decompress.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (invalid write access) via a crafted HDF5 file. This issue was triggered while converting a GIF file to an HDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-24T14:00:00.000Z
CVE-2018-17437 
Memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (memory consumption) via a crafted HDF5 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-24T00:00:00.000Z
CVE-2018-17438 
A SIGFPE signal is raised in the function H5D__select_io() of H5Dselect.c in the HDF HDF5 through 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. It could allow a remote denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-24T14:00:00.000Z
CVE-2018-17439 
An issue was discovered in the HDF HDF5 1.10.3 library. There is a stack-based buffer overflow in the function H5S_extent_get_dims() in H5S.c. Specifically, this issue occurs while converting an HDF5 file to a GIF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-24T14:00:00.000Z
CVE-2018-17440 
An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. They expose an FTP server that serves by default on port 9000 and has hardcoded credentials (admin, admin). Taking advantage of this, a remote unauthenticated attacker could execute arbitrary PHP code by uploading any file in the web root directory and then accessing it via a request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-08T16:00:00.000Z
CVE-2018-17441 
An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'username' parameter of the addUser endpoint is vulnerable to stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-08T16:00:00.000Z
CVE-2018-17442 
An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. An unrestricted file upload vulnerability in the onUploadLogPic endpoint allows remote authenticated users to execute arbitrary PHP code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-08T16:00:00.000Z
CVE-2018-17443 
An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'sitename' parameter of the UpdateSite endpoint is vulnerable to stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-08T16:00:00.000Z
CVE-2018-17444 
A Directory Traversal issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-23T21:00:00.000Z
CVE-2018-17445 
A Command Injection issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-23T21:00:00.000Z
CVE-2018-17446 
A SQL Injection issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-23T21:00:00.000Z
CVE-2018-17447 
An Information Exposure Through Log Files issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-23T21:00:00.000Z
CVE-2018-17448 
An Incorrect Access Control issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-23T21:00:00.000Z
CVE-2018-17449 
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Remote attackers could obtain sensitive information about issues, comments, and project titles via events API insecure direct object reference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2018-17450 
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via the Kubernetes integration, leading (for example) to disclosure of a GCP service token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2018-17451 
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Cross Site Request Forgery (CSRF) in the Slack integration for issuing slash commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2018-17452 
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via a loopback address to the validate_localhost function in url_blocker.rb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2018-17453 
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers may have been able to obtain sensitive access-token data from Sentry logs via the GRPC::Unknown exception.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2018-17454 
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the issue details screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2018-17455 
An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure direct object reference to the "merge request approvals" feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2018-17456 
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-06T14:00:00.000Z
CVE-2018-17457 
An object lifecycle issue in Blink could lead to a use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Problem types: description: Object lifecycle issue
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-17458 
An improper update of the WebAssembly dispatch table in WebAssembly in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-17459 
Incorrect handling of clicks in the omnibox in Navigation in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-17460 
Insufficient data validation in filesystem URIs in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2019-06-27T16:13:41.000Z
CVE-2018-17461 
An out of bounds read in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
Problem types: description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-17462 
Incorrect refcounting in AppCache in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform a sandbox escape via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2018-11-14T15:00:00.000Z
CVE-2018-17463 
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2018-11-14T15:00:00.000Z
CVE-2018-17464 
Incorrect handling of history on iOS in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2018-11-14T15:00:00.000Z
CVE-2018-17465 
Incorrect implementation of object trimming in V8 in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.
Problem types: description: Uninitialized Use
Affected products: vendor: Google
product: Chrome
Published: 2018-11-14T15:00:00.000Z
CVE-2018-17466 
Incorrect texture handling in Angle in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Problem types: description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2018-11-14T15:00:00.000Z
CVE-2018-17467 
Insufficiently quick clearing of stale rendered content in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2018-11-14T15:00:00.000Z
CVE-2018-17468 
Incorrect handling of timer information during navigation in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obtain cross origin URLs via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2018-11-14T15:00:00.000Z