CVEs from 2019

3,413 normalized CVEs published or assigned in this year.

Total
3,413
critical
critical 232
high
high 332
medium
medium 301
low
low 72
% Critical
6.8%
% with KEV
3.5%
% with exploit
3.5%

Top vendors

Top products

  • u-boot 20
  • nsauditor 1
  • crypto 1
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2019-11500 critical 9.5 In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead … archsusedebian
CVE-2019-9788 critical 9.5 Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5. Some of these bugs showed evidence of memory corruption and we pres… archsusedebian
CVE-2019-11718 critical 9.5 Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access … archdebian
CVE-2019-17010 critical 9.5 Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash.… archsusedebian
CVE-2019-9803 critical 9.5 The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same-origin URL must be upgraded to HTTPS. Firefox will incorrec… archdebian
CVE-2019-5810 critical 9.5 multiple issues in chromium archdebian
CVE-2019-3856 critical 9.5 An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH se… archsusedebian
CVE-2019-5765 critical 9.5 multiple issues in chromium archdebian
CVE-2019-13761 critical 9.5 Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. archdebian
CVE-2019-5762 critical 9.5 multiple issues in chromium archdebian
CVE-2019-3836 critical 9.5 It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages. archsusedebian
CVE-2019-5779 critical 9.5 multiple issues in chromium archdebian
CVE-2019-11719 critical 9.5 When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to inf… archsusedebian
CVE-2019-5840 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5780 critical 9.5 multiple issues in chromium archdebian
CVE-2019-13721 critical 9.5 arbitrary code execution in chromium archdebian
CVE-2019-13759 critical 9.5 Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. archdebian
CVE-2019-5758 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5807 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5831 critical 9.5 multiple issues in chromium archdebian
CVE-2019-11759 critical 9.5 An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute arbitrary code or more likely lead to a c… archdebian
CVE-2019-13726 critical 9.5 Buffer overflow in password manager in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page. archdebian
CVE-2019-5806 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5783 critical 9.5 multiple issues in chromium archdebian
CVE-2019-11715 critical 9.5 Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on web sites in certain circumstances. This vulnerability aff… archdebian
CVE-2019-17016 critical 9.5 When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites re… archdebian
CVE-2019-11760 critical 9.5 A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox < 70, Thunderb… archdebian
CVE-2019-7222 critical 9.5 The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak. archsusedebian
CVE-2019-19923 critical 9.5 multiple issues in chromium archdebiansuse
CVE-2019-19925 critical 9.5 multiple issues in chromium archdebiansuse
CVE-2019-3859 critical 9.5 An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to … archsusedebian
CVE-2019-5814 critical 9.5 multiple issues in chromium archdebian
CVE-2019-11693 critical 9.5 The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploita… archsusedebian
CVE-2019-13748 critical 9.5 Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML p… archdebian
CVE-2019-11724 critical 9.5 Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been retired and now redirects to another site. This additional permission is unnece… archsusedebian
CVE-2019-11729 critical 9.5 Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8… archsusedebian
CVE-2019-5768 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5773 critical 9.5 multiple issues in chromium archdebian
CVE-2019-11762 critical 9.5 If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This vulner… archdebian
CVE-2019-17002 critical 9.5 If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https. This vulnerability affects Firefox < … archdebian
CVE-2019-5821 critical 9.5 multiple issues in chromium archdebian
CVE-2019-17666 critical 9.5 rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow. archsusedebian
CVE-2019-13749 critical 9.5 Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. archdebian
CVE-2019-13742 critical 9.5 Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. archdebian
CVE-2019-5828 critical 9.5 multiple issues in chromium archdebian
CVE-2019-13725 critical 9.5 Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page. archdebian
CVE-2019-11712 critical 9.5 POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery (CSRF) a… archdebian
CVE-2019-13739 critical 9.5 Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. archdebian
CVE-2019-13727 critical 9.5 Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy via a crafted HTML page. archdebian
CVE-2019-5837 critical 9.5 multiple issues in chromium archdebian
CVE-2019-11725 critical 9.5 When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation is interrupted but resources from the same site loaded through websockets are not… archdebian
CVE-2019-19880 critical 9.5 multiple issues in chromium archdebian
CVE-2019-17017 critical 9.5 Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. Thi… archdebian
CVE-2019-3862 critical 9.5 An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a… archsusedebian
CVE-2019-8912 critical 9.5 In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr. archsusedebian
CVE-2019-5819 critical 9.5 multiple issues in chromium archdebian
CVE-2019-6974 critical 9.5 In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free. archsusedebian
CVE-2019-5761 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5759 critical 9.5 multiple issues in chromium archdebian
CVE-2019-9810 critical 9.5 Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR… archsusedebian
CVE-2019-13754 critical 9.5 Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. archdebian
CVE-2019-5754 critical 9.5 multiple issues in chromium archdebian
CVE-2019-9791 critical 9.5 The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the con… archsusedebian
CVE-2019-17005 critical 9.5 The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a poten… archsusedebian
CVE-2019-5835 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5811 critical 9.5 multiple issues in chromium archdebian
CVE-2019-11720 critical 9.5 Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This allows malicious code to then be processed, evading cross-si… archdebian
CVE-2019-9793 critical 9.5 A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an attacker to create… archsusedebian
CVE-2019-17022 critical 9.5 When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer does not escape &lt; and &gt; characters. Because the resulting string is pasted directly into the text … archdebian
CVE-2019-5771 critical 9.5 multiple issues in chromium archdebian
CVE-2019-11723 critical 9.5 A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across dif… archdebian
CVE-2019-5830 critical 9.5 multiple issues in chromium archdebian
CVE-2019-11727 critical 9.5 A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in Certificat… archsusedebian
CVE-2019-13764 critical 9.5 Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2019-11757 critical 9.5 When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free and a potentially exploitabl… archdebian
CVE-2019-5777 critical 9.5 multiple issues in chromium archdebian
CVE-2019-9813 critical 9.5 Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox < 66.0.1, Firef… archsusedebian
CVE-2019-5778 critical 9.5 multiple issues in chromium archdebian
CVE-2019-13757 critical 9.5 Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. archdebian
CVE-2019-11710 critical 9.5 Mozilla developers and community members reported memory safety bugs present in Firefox 67. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of… archsusedebian
CVE-2019-11709 critical 9.5 Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enoug… archdebian
CVE-2019-13741 critical 9.5 Insufficient validation of untrusted input in Blink in Google Chrome prior to 79.0.3945.79 allowed a local attacker to bypass same origin policy via crafted clipboard content. archdebian
CVE-2019-13729 critical 9.5 Use-after-free in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2019-13728 critical 9.5 Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2019-5809 critical 9.5 multiple issues in chromium archdebian
CVE-2019-13767 critical 9.5 Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2019-5805 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5775 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5839 critical 9.5 multiple issues in chromium archdebian
CVE-2019-9789 critical 9.5 Mozilla developers and community members reported memory safety bugs present in Firefox 65. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of… archdebian
CVE-2019-13735 critical 9.5 Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. archdebian
CVE-2019-13763 critical 9.5 Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. archdebian
CVE-2019-17025 critical 9.5 Mozilla developers reported memory safety bugs present in Firefox 71. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been expl… archdebian
CVE-2019-5829 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5764 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5774 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5781 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5757 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5770 critical 9.5 multiple issues in chromium archdebian
CVE-2019-11765 critical 9.5 A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown. However, due to lack of validation from the parent process… archdebian