rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-15343 
Huawei AR3200 with software V200R006C10, V200R006C11, V200R007C00, V200R007C01, V200R007C02, V200R008C00, V200R008C10, V200R008C20, V200R008C30 has an integer overflow vulnerability. The software does not sufficiently validate certain field in SCTP messages, a remote unauthenticated attacker could send a crafted SCTP message to the device. Successful exploit could system reboot.
Problem types: description: integer overflow
Affected products: vendor: Huawei Technologies Co., Ltd.
product: AR3200
Published: 2018-02-15T16:00:00.000Z
CVE-2017-15344 
Huawei AR3200 with software V200R006C10, V200R006C11, V200R007C00, V200R007C01, V200R007C02, V200R008C00, V200R008C10, V200R008C20, V200R008C30 has an integer overflow vulnerability. The software does not sufficiently validate certain field in SCTP messages, a remote unauthenticated attacker could send a crafted SCTP message to the device. Successful exploit could cause system reboot.
Problem types: description: integer overflow
Affected products: vendor: Huawei Technologies Co., Ltd.
product: AR3200
Published: 2018-02-15T16:00:00.000Z
CVE-2017-15345 
Huawei Smartphones with software LON-L29DC721B186 have a denial of service vulnerability. An attacker could make an loop exit condition that cannot be reached by sending the crafted 3GPP message. Successful exploit could cause the device to reboot.
Problem types: description: DoS
Affected products: vendor: Huawei Technologies Co., Ltd.
product: LON-L29D
Published: 2018-02-15T16:00:00.000Z
CVE-2017-15346 
XML parser in Huawei S12700 V200R005C00,S1700 V200R009C00, V200R010C00,S3700 V100R006C03, V100R006C05,S5700 V200R001C00, V200R002C00, V200R003C00, V200R003C02, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00,S6700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R005C02, V200R008C00, V200R009C00, V200R010C00,S7700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00,S9700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00,eCNS210_TD V100R004C10, V100R004C10SPC003, V100R004C10SPC100, V100R004C10SPC101, V100R004C10SPC102, V100R004C10SPC200, V100R004C10SPC221, V100R004C10SPC400 has a DOS vulnerability. An attacker may craft specific XML files to the affected products. Due to not check the specially XML file and to parse this file, successful exploit will result in DOS attacks.
Problem types: description: DoS
Affected products: vendor: Huawei Technologies Co., Ltd.
product: S12700, S1700,S3700,S5700,S6700,S7700, S9700, eCNS210_TD
Published: 2018-02-15T16:00:00.000Z
CVE-2017-15347 
Huawei Mate 9 Pro mobile phones with software of versions earlier than LON-AL00BC00B235 have a use after free (UAF) vulnerability. An attacker tricks a user into installing a malicious application, and the application can riggers access memory after free it. A local attacker may exploit this vulnerability to cause the mobile phone to crash.
Problem types: description: UAF
Affected products: vendor: Huawei Technologies Co., Ltd.
product: Mate 9 Pro
Published: 2018-02-15T16:00:00.000Z
CVE-2017-15348 
Huawei IPS Module V500R001C00, NGFW Module V500R001C00, NIP6300 V500R001C00, NIP6600 V500R001C00, Secospace USG6300 V500R001C00, Secospace USG6500 V500R001C00, Secospace USG6600 V500R001C00, USG9500 V500R001C00 have an insufficient input validation vulnerability. An unauthenticated, remote attacker could send specific MPLS Echo Request messages to the target products. Due to insufficient input validation of some parameters in the messages, successful exploit may cause the device to reset.
Problem types: description: Insufficient Input Validation
Affected products: vendor: Huawei Technologies Co., Ltd.
product: IPS Module,NGFW Module,NIP6300,NIP6600,Secospace USG6300,Secospace USG6500,Secospace USG6600,USG9500,
Published: 2018-02-15T16:00:00.000Z
CVE-2017-15349 
Huawei CloudEngine 12800 V100R003C00, V100R005C00, V100R005C10, V100R006C00,CloudEngine 5800 V100R003C00, V100R005C00, V100R005C10, V100R006C00,CloudEngine 6800 V100R003C00, V100R005C00, V100R005C10, V100R006C00,CloudEngine 7800 V100R003C00, V100R005C00, V100R005C10, V100R006C00 have a memory leak vulnerability. An unauthenticated attacker may send specific Resource ReServation Protocol (RSVP) packets to the affected products. Due to not release the memory to handle the packets, successful exploit will result in memory leak of the affected products and lead to a DoS condition.
Problem types: description: memory leak
Affected products: vendor: Huawei Technologies Co., Ltd.
product: CloudEngine 12800,CloudEngine 5800,CloudEngine 6800,CloudEngine 7800,
Published: 2018-02-15T16:00:00.000Z
CVE-2017-15350 
The Common Open Policy Service Protocol (COPS) module in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, NIP6300 V500R001C00, V500R001C20, V500R001C30, V500R001C50, NIP6600 V500R001C00, V500R001C20, V500R001C30, V500R001C50, NIP6800 V500R001C50, RP200 V500R002C00, V600R006C00, SVN5600 V200R003C00, V200R003C10, SVN5800 V200R003C00, V200R003C10,SVN5800-C V200R003C00, V200R003C10, Secospace USG6300 V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, Secospace USG6500 V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, Secospace USG6600 V100R001C00, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, TE30 V100R001C02, V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V100R001C01, V100R001C10, V500R002C00, V600R006C00, TP3206 V100R002C00, V100R002C10,USG9500 V500R001C00, V500R001C20, V500R001C30, V500R001C50 haa a buffer overflow vulnerability. An unauthenticated, remote attacker could exploit this vulnerability by sending specially crafted message to the affected products. The vulnerability is due to insufficient input validation of the message, which could result in a buffer overflow. Successful exploit may cause some services abnormal.
Problem types: description: buffer overflow
Affected products: vendor: Huawei Technologies Co., Ltd.
product: DP300,IPS Module,NGFW Module,NIP6300,NIP6600,NIP6800,RP200,SVN5600,SVN5800,SVN5800-C,Secospace USG6300,Secospace USG6500,Secospace USG6600,TE30,TE40,TE50,TE60,TP3206,USG9500,
Published: 2018-02-15T16:00:00.000Z
CVE-2017-15351 
The 'Find Phone' function in Huawei Honor V9 play smart phones with versions earlier than Jimmy-AL00AC00B135 has an authentication bypass vulnerability. Due to improper authentication realization in the 'Find Phone' function. An attacker may exploit the vulnerability to bypass the 'Find Phone' function in order to use the phone normally.
Problem types: description: authentication bypass
Affected products: vendor: Huawei Technologies Co., Ltd.
product: Honor V9 play
Published: 2018-02-15T16:00:00.000Z
CVE-2017-15352 
Huawei OceanStor 2800 V3, V300R003C00, V300R003C20, OceanStor 5300 V3, V300R003C00, V300R003C10, V300R003C20, OceanStor 5500 V3, V300R003C00, V300R003C10, V300R003C20, OceanStor 5600 V3, V300R003C00, V300R003C10, V300R003C20, OceanStor 5800 V3, V300R003C00, V300R003C10, V300R003C20 have an improper access control vulnerability. Due to incorrectly restrict access to a resource, an attacker with high privilege may exploit the vulnerability to query some information or send specific message to cause some service abnormal.
Problem types: description: Improper Access Control
Affected products: vendor: Huawei Technologies Co., Ltd.
product: OceanStor 2800 V3,OceanStor 5300 V3,OceanStor 5500 V3,OceanStor 5600 V3,OceanStor 5800 V3
Published: 2018-02-15T16:00:00.000Z
CVE-2017-15353 
Huawei DP300, V500R002C00, RP200, V500R002C00, V600R006C00, RSE6500, V500R002C00, TE30, V100R001C02, V100R001C10, V500R002C00, V600R006C00, TE40, V500R002C00, V600R006C00, TE50, V500R002C00, V600R006C00, TE60, V100R001C01, V100R001C10, V500R002C00, V600R006C00, TX50, V500R002C00, V600R006C00, VP9660, V500R002C00, V500R002C10, ViewPoint 8660, V100R008C03, ViewPoint 9030, V100R011C02, V100R011C03, Viewpoint 8660, V100R008C03 have an out-of-bounds read vulnerability. An attacker has to control the peer device and send specially crafted messages to the affected products. Due to insufficient input validation, successful exploit may cause some service abnormal.
Problem types: description: out-of-bounds read
Affected products: vendor: Huawei Technologies Co., Ltd.
product: DP300,RP200,RSE6500,TE30,TE40,TE50,TE60,TX50,VP9660,ViewPoint 8660,ViewPoint 9030,Viewpoint 8660,
Published: 2018-02-15T16:00:00.000Z
CVE-2017-15354 
Huawei DP300, V500R002C00, RP200, V600R006C00, TE30, V100R001C10, V500R002C00,V600R006C00, TE40, V500R002C00, V600R006C00, TE50, V500R002C00,V600R006C00, TE60, V100R001C10, V500R002C00, V600R006C00, TX50,V500R002C00, V600R006C00 have a buffer overflow vulnerability. An attacker may send specially crafted HTTP messages to the affected products. Due insufficient input validation of three different parameters in the messages, successful exploit may cause some service abnormal.
Problem types: description: buffer overflow
Affected products: vendor: Huawei Technologies Co., Ltd.
product: DP300,RP200,TE30,TE40,TE50,TE60,TX50
Published: 2018-02-15T16:00:00.000Z
CVE-2017-15355 
Huawei DP300, V500R002C00, RP200, V600R006C00, TE30, V100R001C10, V500R002C00,V600R006C00, TE40, V500R002C00, V600R006C00, TE50, V500R002C00,V600R006C00, TE60, V100R001C10, V500R002C00, V600R006C00, TX50,V500R002C00, V600R006C00 have a buffer overflow vulnerability. An attacker may send specially crafted HTTP messages to the affected products. Due insufficient input validation of three different parameters in the messages, successful exploit may cause some service abnormal.
Problem types: description: buffer overflow
Affected products: vendor: Huawei Technologies Co., Ltd.
product: DP300,RP200,TE30,TE40,TE50,TE60,TX50
Published: 2018-02-15T16:00:00.000Z
CVE-2017-15356 
Huawei DP300, V500R002C00, RP200, V600R006C00, TE30, V100R001C10, V500R002C00,V600R006C00, TE40, V500R002C00, V600R006C00, TE50, V500R002C00,V600R006C00, TE60, V100R001C10, V500R002C00, V600R006C00, TX50,V500R002C00, V600R006C00 have a buffer overflow vulnerability. An attacker may send specially crafted HTTP messages to the affected products. Due insufficient input validation of three different parameters in the messages, successful exploit may cause some service abnormal.
Problem types: description: buffer overflow
Affected products: vendor: Huawei Technologies Co., Ltd.
product: DP300,RP200,TE30,TE40,TE50,TE60,TX50
Published: 2018-02-15T16:00:00.000Z
CVE-2017-15357 
The setpermissions function in the auto-updater in Arq before 5.9.7 for Mac allows local users to gain root privileges via a symlink attack on the updater binary itself.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-01T17:00:00.000Z
CVE-2017-15358 
Race condition in the Charles Proxy Settings suid binary in Charles Proxy before 4.2.1 allows local users to gain privileges via vectors involving the --self-repair option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-03T18:00:00.000Z
CVE-2017-15359 
In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack: "/api/RecordingList/DownloadRecord?file=" and "/api/SupportInfo?file=" are the vulnerable parameters. An attacker must be authenticated to exploit this issue to access sensitive information to aid in subsequent attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T18:00:00.000Z
CVE-2017-15360 
PRTG Network Monitor version 17.3.33.2830 is vulnerable to stored Cross-Site Scripting on all group names created, related to incorrect error handling for an HTML encoded script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-15T17:00:00.000Z
CVE-2017-15361 
The Infineon RSA library 1.02.013 in Infineon Trusted Platform Module (TPM) firmware, such as versions before 0000000000000422 - 4.34, before 000000000000062b - 6.43, and before 0000000000008521 - 133.33, mishandles RSA key generation, which makes it easier for attackers to defeat various cryptographic protection mechanisms via targeted attacks, aka ROCA. Examples of affected technologies include BitLocker with TPM 1.2, YubiKey 4 (before 4.3.5) PGP key generation, and the Cached User Data encryption feature in Chrome OS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T17:00:00.000Z
CVE-2017-15362 
osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application. This affects a different tickets.php file than CVE-2015-1176.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T01:00:00.000Z
CVE-2017-15363 
Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler extension before 1.7.1 for TYPO3, allows remote attackers to read arbitrary files via the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-15T19:00:00.000Z
CVE-2017-15364 
The foreach function in ext/ccsv.c in Ccsv 1.1.0 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact via a crafted file. NOTE: This has been disputed and it is argued that this is not present in version 1.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-15T19:00:00.000Z
CVE-2017-15365 
sql/event_data_objects.cc in MariaDB before 10.1.30 and 10.2.x before 10.2.10 and Percona XtraDB Cluster before 5.6.37-26.21-3 and 5.7.x before 5.7.19-29.22-3 allows remote authenticated users with SQL access to bypass intended access restrictions and replicate data definition language (DDL) statements to cluster nodes by leveraging incorrect ordering of DDL replication and ACL checking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-25T16:00:00.000Z
CVE-2017-15366 
Before Thornberry NDoc version 8.0, laptop clients and the server have default database (Cache) users set up with a single password. This password is left behind in a cleartext log file during client installation on laptops. This password can be used to gain full admin/system access to client devices (if no firewall is present) or the NDoc server itself. Once the password is known to an attacker, local access is not required.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-26T20:00:00.000Z
CVE-2017-15367 
Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depending on configuration, escalate privileges on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-07T20:00:00.000Z
CVE-2017-15368 
The wasm_dis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted WASM file that triggers an incorrect r_hex_bin2str call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T01:00:00.000Z
CVE-2017-15369 
The build_filter_chain function in pdf/pdf-stream.c in Artifex MuPDF before 2017-09-25 mishandles a certain case where a variable may reside in a register, which allows remote attackers to cause a denial of service (Fitz fz_drop_imp use-after-free and application crash) or possibly have unspecified other impact via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T01:00:00.000Z
CVE-2017-15370 
There is a heap-based buffer overflow in the ImaExpandS function of ima_rw.c in Sound eXchange (SoX) 14.4.2. A Crafted input will lead to a denial of service attack during conversion of an audio file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T04:00:00.000Z
CVE-2017-15371 
There is a reachable assertion abort in the function sox_append_comment() in formats.c in Sound eXchange (SoX) 14.4.2. A Crafted input will lead to a denial of service attack during conversion of an audio file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T04:00:00.000Z
CVE-2017-15372 
There is a stack-based buffer overflow in the lsx_ms_adpcm_block_expand_i function of adpcm.c in Sound eXchange (SoX) 14.4.2. A Crafted input will lead to a denial of service attack during conversion of an audio file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T04:00:00.000Z
CVE-2017-15373 
E-Sic 1.0 allows SQL injection via the q parameter to esiclivre/restrito/inc/lkpcep.php (aka the search private area).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T04:00:00.000Z
CVE-2017-15374 
Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the customer and orders section of the backend. The execution occurs in the administrator backend listing when processing a preview of the customers (kunden) or orders (bestellungen). The injection can be performed interactively via user registration or by manipulation of the order information inputs. The issue can be exploited by low privileged user accounts against higher privileged (admin or moderator) accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T04:00:00.000Z
CVE-2017-15375 
Multiple client-side cross site scripting vulnerabilities have been discovered in the WpJobBoard v4.5.1 web-application for WordPress. The vulnerabilities are located in the `query` and `id` parameters of the `wpjb-email`, `wpjb-job`, `wpjb-application`, and `wpjb-membership` modules. Remote attackers are able to inject malicious script code to hijack admin session credentials via the backend, or to manipulate the backend on client-side performed requests. The attack vector is non-persistent and the request method to inject is GET. The attacker does not need a privileged user account to perform a successful exploitation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T04:00:00.000Z
CVE-2017-15376 
The TELNET service in Mobatek MobaXterm 10.4 does not require authentication, which allows remote attackers to execute arbitrary commands via TCP port 23.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T04:00:00.000Z
CVE-2017-15377 
In Suricata before 4.x, it was possible to trigger lots of redundant checks on the content of crafted network traffic with a certain signature, because of DetectEngineContentInspection in detect-engine-content-inspection.c. The search engine doesn't stop when it should after no match is found; instead, it stops only upon reaching inspection-recursion-limit (3000 by default).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-23T08:00:00.000Z
CVE-2017-15378 
SQL Injection exists in the E-Sic 1.0 password reset parameter (aka the cpfcnpj parameter to the /reset URI).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-23T08:00:00.000Z
CVE-2017-15379 
An authentication bypass exists in the E-Sic 1.0 /index (aka login) URI via '=''or' values for the username and password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-23T08:00:00.000Z
CVE-2017-15380 
XSS exists in the E-Sic 1.0 /cadastro/index.php URI (aka the requester's registration area) via the nome parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-23T08:00:00.000Z
CVE-2017-15381 
SQL Injection exists in E-Sic 1.0 via the f parameter to esiclivre/restrito/inc/buscacep.php (aka the zip code search script).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-23T08:00:00.000Z
CVE-2017-15383 
Nero 7.10.1.0 has an unquoted BINARY_PATH_NAME for NBService, exploitable via a Trojan horse Nero.exe file in the %PROGRAMFILES(x86)%\Nero directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T17:00:00.000Z
CVE-2017-15384 
rate-me.php in Rate Me 1.0 has XSS via the id field in a rate action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T17:00:00.000Z
CVE-2017-15385 
The store_versioninfo_gnu_verdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service (r_read_le16 invalid write and application crash) or possibly have unspecified other impact via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T22:00:00.000Z
CVE-2017-15386 
Incorrect implementation in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Incorrect security UI
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z
CVE-2017-15387 
Insufficient enforcement of Content Security Policy in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to open javascript: URL windows when they should not be allowed to via a crafted HTML page.
Problem types: description: Insufficient Policy Enforcement
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z
CVE-2017-15388 
Iteration through non-finite points in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Problem types: description: Out-of-bounds Read
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z
CVE-2017-15389 
An insufficient watchdog timer in navigation in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z
CVE-2017-15390 
Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
Problem types: description: Insufficient Policy Enforcement
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z
CVE-2017-15391 
Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to access Extension pages without authorisation via a crafted HTML page.
Problem types: description: Insufficient Policy Enforcement
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z