| 2018-12-12 | CVE-2018-20097 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. | 6.5 |
| 2018-12-11 | CVE-2018-19970 | Cross-site Scripting vulnerability in multiple products
In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name. | 4.3 |
| 2018-12-11 | CVE-2018-19968 | Information Exposure vulnerability in multiple products
An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. | 4.0 |
| 2018-12-11 | CVE-2018-18358 | Improper Input Validation vulnerability in multiple products
Lack of special casing of localhost in WPAD files in Google Chrome prior to 71.0.3578.80 allowed an attacker on the local network segment to proxy resources on localhost via a crafted WPAD file. | 5.7 |
| 2018-12-11 | CVE-2018-18357 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. | 4.3 |
| 2018-12-11 | CVE-2018-18355 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. | 4.3 |
| 2018-12-11 | CVE-2018-18353 | Failure to dismiss http auth dialogs on navigation in Network Authentication in Google Chrome on Android prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of an auto dialog via a crafted HTML page. | 6.5 |
| 2018-12-11 | CVE-2018-18352 | Incorrect Permission Assignment for Critical Resource vulnerability in multiple products
Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass same origin policy for audio content via a crafted HTML page. | 6.5 |
| 2018-12-11 | CVE-2018-18351 | Improper Input Validation vulnerability in multiple products
Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass SameSite cookie policy via a crafted HTML page. | 6.5 |
| 2018-12-11 | CVE-2018-18350 | Incorrect handling of CSP enforcement during navigations in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass content security policy via a crafted HTML page. | 6.5 |