CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Google : Security Vulnerabilities (CVSS score between 4 and 4.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-9045 310 2017-05-18 2017-05-31
4.3
None Remote Medium Not required None Partial None
The Google I/O 2017 application before 5.1.4 for Android downloads multiple .json files from http://storage.googleapis.com without SSL, which makes it easier for man-in-the-middle attackers to spoof Feed and Schedule data by creating a modified blocks_v4.json file.
2 CVE-2017-8269 200 +Info 2017-08-11 2017-08-16
4.3
None Remote Medium Not required Partial None None
Userspace-controlled non null terminated parameter for IPA WAN ioctl in all Qualcomm products with Android releases from CAF using the Linux kernel can lead to exposure of kernel memory.
3 CVE-2017-8258 125 2017-08-11 2017-08-16
4.3
None Remote Medium Not required Partial None None
An array out-of-bounds access in all Qualcomm products with Android releases from CAF using the Linux kernel can potentially occur in a camera driver.
4 CVE-2017-8254 200 +Info 2017-08-18 2017-08-23
4.3
None Remote Medium Not required Partial None None
In all Qualcomm products with Android releases from CAF using the Linux kernel, an audio client pointer is dereferenced before being checked if it is valid.
5 CVE-2017-8242 362 2017-06-13 2017-07-07
4.3
None Remote Medium Not required None Partial None
In all Android releases from CAF using the Linux kernel, a race condition exists in a QTEE driver potentially leading to an arbitrary memory write.
6 CVE-2017-8239 200 +Info 2017-06-13 2017-07-07
4.3
None Remote Medium Not required Partial None None
In all Android releases from CAF using the Linux kernel, userspace-controlled parameters for flash initialization are not sanitized potentially leading to exposure of kernel memory.
7 CVE-2017-8235 254 2017-06-13 2017-07-07
4.3
None Remote Medium Not required None Partial None
In all Android releases from CAF using the Linux kernel, a memory structure in a camera driver is not properly protected.
8 CVE-2017-7366 20 2017-06-13 2017-07-07
4.3
None Remote Medium Not required None Partial None
In all Android releases from CAF using the Linux kernel, a KGSL ioctl was not validating all of its parameters.
9 CVE-2017-5046 200 +Info 2017-04-24 2017-06-30
4.3
None Remote Medium Not required Partial None None
V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android had insufficient policy enforcement, which allowed a remote attacker to spoof the location object via a crafted HTML page, related to Blink information disclosure.
10 CVE-2017-5045 200 XSS +Info 2017-04-24 2017-06-30
4.3
None Remote Medium Not required Partial None None
XSS Auditor in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed detection of a blocked iframe load, which allowed a remote attacker to brute force JavaScript variables via a crafted HTML page.
11 CVE-2017-5041 20 2017-04-24 2017-06-30
4.3
None Remote Medium Not required None Partial None
Google Chrome prior to 57.0.2987.100 incorrectly handled back-forward navigation, which allowed a remote attacker to display incorrect information for a site via a crafted HTML page.
12 CVE-2017-5040 200 +Info 2017-04-24 2017-06-30
4.3
None Remote Medium Not required Partial None None
V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android was missing a neutering check, which allowed a remote attacker to read values in memory via a crafted HTML page.
13 CVE-2017-5033 284 Bypass 2017-04-24 2017-06-30
4.3
None Remote Medium Not required None Partial None
Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page.
14 CVE-2017-5027 284 Bypass 2017-02-17 2017-02-17
4.3
None Remote Medium Not required None Partial None
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to properly enforce unsafe-inline content security policy, which allowed a remote attacker to bypass content security policy via a crafted HTML page.
15 CVE-2017-5026 284 2017-02-17 2017-07-24
4.3
None Remote Medium Not required None Partial None
Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to prevent alerts from being displayed by swapped out frames, which allowed a remote attacker to show alerts on a page they don't control via a crafted HTML page.
16 CVE-2017-5025 119 Overflow 2017-02-17 2017-07-24
4.3
None Remote Medium Not required None None Partial
FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted video file.
17 CVE-2017-5024 119 Overflow 2017-02-17 2017-07-24
4.3
None Remote Medium Not required None None Partial
FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted video file.
18 CVE-2017-5023 476 2017-02-17 2017-07-24
4.3
None Remote Medium Not required None None Partial
Type confusion in Histogram in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit a near null dereference via a crafted HTML page.
19 CVE-2017-5022 284 Bypass 2017-02-17 2017-07-24
4.3
None Remote Medium Not required None Partial None
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to properly enforce unsafe-inline content security policy, which allowed a remote attacker to bypass content security policy via a crafted HTML page.
20 CVE-2017-5021 416 2017-02-17 2017-07-24
4.3
None Remote Medium Not required None None Partial
A use after free in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
21 CVE-2017-5020 79 Exec Code XSS 2017-02-17 2017-07-24
4.3
None Remote Medium Not required None Partial None
Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to require a user gesture for powerful download operations, which allowed a remote attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted HTML page.
22 CVE-2017-5018 79 XSS 2017-02-17 2017-07-24
4.3
None Remote Medium Not required None Partial None
Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, had an insufficiently strict content security policy on the Chrome app launcher page, which allowed a remote attacker to inject scripts or HTML into a privileged page via a crafted HTML page.
23 CVE-2017-5017 200 +Info 2017-02-17 2017-07-24
4.3
None Remote Medium Not required Partial None None
Interactions with the OS in Google Chrome prior to 56.0.2924.76 for Mac insufficiently cleared video memory, which allowed a remote attacker to possibly extract image fragments on systems with GeForce 8600M graphics chips via a crafted HTML page.
24 CVE-2017-5016 284 2017-02-17 2017-07-24
4.3
None Remote Medium Not required None Partial None
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to prevent certain UI elements from being displayed by non-visible pages, which allowed a remote attacker to show certain UI elements on a page they don't control via a crafted HTML page.
25 CVE-2017-5015 284 2017-02-17 2017-07-24
4.3
None Remote Medium Not required None Partial None
Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled Unicode glyphs, which allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
26 CVE-2017-5013 284 2017-02-17 2017-07-24
4.3
None Remote Medium Not required None Partial None
Google Chrome prior to 56.0.2924.76 for Linux incorrectly handled new tab page navigations in non-selected tabs, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
27 CVE-2017-5011 200 +Info 2017-02-17 2017-07-24
4.3
None Remote Medium Not required Partial None None
Google Chrome prior to 56.0.2924.76 for Windows insufficiently sanitized DevTools URLs, which allowed a remote attacker who convinced a user to install a malicious extension to read filesystem contents via a crafted HTML page.
28 CVE-2017-5010 79 XSS 2017-02-17 2017-07-24
4.3
None Remote Medium Not required None Partial None
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, resolved promises in an inappropriate context, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
29 CVE-2017-5008 79 XSS 2017-02-17 2017-07-24
4.3
None Remote Medium Not required None Partial None
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed attacker controlled JavaScript to be run during the invocation of a private script method, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
30 CVE-2017-5007 79 XSS 2017-02-17 2017-07-24
4.3
None Remote Medium Not required None Partial None
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled the sequence of events when closing a page, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
31 CVE-2017-5006 79 XSS 2017-02-17 2017-07-24
4.3
None Remote Medium Not required None Partial None
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled object owner relationships, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
32 CVE-2017-0779 200 +Info 2017-09-08 2017-09-15
4.3
None Remote Medium Not required Partial None None
A information disclosure vulnerability in the Android media framework (audioflinger). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-38340117.
33 CVE-2017-0777 200 +Info 2017-09-08 2017-09-15
4.3
None Remote Medium Not required None None Partial
A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-38342499.
34 CVE-2017-0776 200 +Info 2017-09-08 2017-09-15
4.3
None Remote Medium Not required None None Partial
A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-38496660.
35 CVE-2017-0739 200 +Info 2017-08-09 2017-08-15
4.3
None Remote Medium Not required Partial None None
A information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37712181.
36 CVE-2017-0738 264 2017-08-09 2017-08-15
4.3
None Remote Medium Not required Partial None None
A information disclosure vulnerability in the Android media framework (audioserver). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37563371.
37 CVE-2017-0735 264 DoS 2017-08-09 2017-08-15
4.3
None Remote Medium Not required None None Partial
A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-38239864.
38 CVE-2017-0734 264 DoS 2017-08-09 2017-08-15
4.3
None Remote Medium Not required None None Partial
A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-38014992.
39 CVE-2017-0733 264 DoS 2017-08-09 2017-08-15
4.3
None Remote Medium Not required None None Partial
A denial of service vulnerability in the Android media framework (libmediaplayerservice). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-38391487.
40 CVE-2017-0730 264 DoS 2017-08-09 2017-08-15
4.3
None Remote Medium Not required None None Partial
A denial of service vulnerability in the Android media framework (h264 decoder). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36279112.
41 CVE-2017-0728 264 DoS 2017-08-09 2017-08-15
4.3
None Remote Medium Not required None None Partial
A denial of service vulnerability in the Android media framework (hevc decoder). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37469795.
42 CVE-2017-0726 264 DoS 2017-08-09 2017-08-15
4.3
None Remote Medium Not required None None Partial
A denial of service vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36389123.
43 CVE-2017-0725 264 DoS 2017-08-09 2017-08-15
4.3
None Remote Medium Not required None None Partial
A denial of service vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-37627194.
44 CVE-2017-0724 264 DoS 2017-08-09 2017-08-15
4.3
None Remote Medium Not required None None Partial
A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36819262.
45 CVE-2017-0709 200 +Info 2017-07-06 2017-07-11
4.3
None Remote Medium Not required Partial None None
A information disclosure vulnerability in the HTC sensor hub driver. Product: Android. Versions: Android kernel. Android ID: A-35468048.
46 CVE-2017-0708 200 +Info 2017-07-06 2017-07-11
4.3
None Remote Medium Not required Partial None None
A information disclosure vulnerability in the HTC sound driver. Product: Android. Versions: Android kernel. Android ID: A-35384879.
47 CVE-2017-0699 200 +Info 2017-07-06 2017-07-11
4.3
None Remote Medium Not required Partial None None
A information disclosure vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36490809.
48 CVE-2017-0698 200 +Info 2017-07-06 2017-07-11
4.3
None Remote Medium Not required Partial None None
A information disclosure vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35467458.
49 CVE-2017-0697 264 DoS 2017-07-06 2017-07-11
4.3
None Remote Medium Not required None None Partial
A denial of service vulnerability in the Android media framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37239013.
50 CVE-2017-0696 264 DoS 2017-07-06 2017-07-11
4.3
None Remote Medium Not required None None Partial
A denial of service vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37207120.
Total number of vulnerabilities : 450   Page : 1 (This Page)2 3 4 5 6 7 8 9
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.