Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,244

Export CSV
CVE-2018-18351

chromium-browser: Insufficient policy enforcement in Navigation

Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass SameSite cookie policy via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-18350

chromium-browser: Insufficient policy enforcement in Blink

Incorrect handling of CSP enforcement during navigations in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass content security policy via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-18349

chromium-browser: Insufficient policy enforcement in Blink

Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-18348

chromium-browser: Inappropriate implementation in Omnibox

Incorrect handling of bidirectional domain names with RTL characters in Omnibox in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.

CVSS 3.0 · 4.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-18347

chromium-browser: Inappropriate implementation in Navigation

Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to trick a user into executing javascript in an arbitrary origin via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-18346

chromium-browser: Incorrect security UI in Blink

Incorrect handling of alert box display in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to present confusing browser UI via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-18345

chromium-browser: Inappropriate implementation in Site Isolation

Incorrect handling of blob URLS in Site Isolation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker who had compromised the renderer process to bypass site isolation protections via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-18344

chromium-browser: Inappropriate implementation in Extensions

Inappropriate allowance of the setDownloadBehavior devtools protocol feature in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker with control of an installed extension to access files on the local file system via a crafted Chrome Extension.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-18343

chromium-browser: Use after free in Skia

Incorrect handing of paths leading to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-18342

chromium-browser: Out of bounds write in V8

Execution of user supplied Javascript during object deserialization can update object length leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 2.7% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-18341

chromium-browser: Heap buffer overflow in Blink

An integer overflow leading to a heap buffer overflow in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-18340

chromium-browser: Use after free in MediaRecorder

Incorrect object lifecycle in MediaRecorder in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-18339

chromium-browser: Use after free in WebAudio

Incorrect object lifecycle in WebAudio in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-18338

chromium-browser: Heap buffer overflow in Canvas

Incorrect, thread-unsafe use of SkImage in Canvas in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-18337

chromium-browser: Use after free in Blink

Incorrect handling of stylesheets leading to a use after free in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.7% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-18336

chromium-browser: Use after free in PDFium

Incorrect object lifecycle in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-18335

chromium-browser: Heap buffer overflow in Skia

Heap buffer overflow in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 3.9% KEV · Not listed
Vendors
Debian Google Opensuse and 1 more
Products
Debian Linux Chrome Leap and 4 more
CVE-2018-18313

perl: Heap-based buffer read overflow in S_grok_bslash_N()

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVSS 3.0 · 9.1 Critical EPSS 9.5% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Mac Os X Ubuntu Linux Debian Linux and 7 more