CVEs from 2019
Total
3,250
critical
critical 232
high
high 341
medium
medium 309
low
low 71
% Critical
7.1%
% with KEV
3.6%
% with exploit
4.4%
Top products
- u-boot 20
- active_iq_unified_manager 7
- jdk 5
- weblogic_server 5
- oncommand_workflow_automation 5
- oncommand_insight 4
- codeready_linux_builder_eus 4
- libxslt 4
| CVE | Severity | CVSS | Risk | Flags | OS | Vendor | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-14287 | high | — | 8.0 | — | In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a cra… | |||
| CVE-2019-11750 | high | — | 8.0 | — | A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1. | |||
| CVE-2019-10193 | high | — | 8.0 | — | A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRA… | |||
| CVE-2019-12735 | high | — | 8.0 | — | getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert… | |||
| CVE-2019-3823 | high | — | 8.0 | — | libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL termi… | |||
| CVE-2019-5790 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-11740 | high | — | 8.0 | — | Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8. Some of these bugs showed evidence of memory corruption and we presume th… | |||
| CVE-2019-16866 | high | — | 8.0 | — | Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule. | |||
| CVE-2019-5788 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-5797 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-1000020 | high | — | 8.0 | — | libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660… | |||
| CVE-2019-11461 | high | — | 8.0 | — | An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI … | |||
| CVE-2019-1349 | high | — | 8.0 | — | A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-201… | |||
| CVE-2019-3871 | high | — | 8.0 | — | A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the … | |||
| CVE-2019-5789 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-8377 | high | — | 8.0 | — | An issue was discovered in Tcpreplay 4.3.1. A NULL pointer dereference occurred in the function get_ipv6_l4proto() located at get.c. This can be triggered by sending a crafted pcap file to the tcprep… | |||
| CVE-2019-5436 | high | — | 8.0 | — | A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. | |||
| CVE-2019-11743 | high | — | 8.0 | — | Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload event, which restricts access to detailed timing attributes to … | |||
| CVE-2019-11752 | high | — | 8.0 | — | It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a potentially exploitable crash. This vulnerability affects … | |||
| CVE-2019-14813 | high | — | 8.0 | — | A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A… | |||
| CVE-2019-11748 | high | — | 8.0 | — | WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party context. In light of recent high profile vulnerabilities in … | |||
| CVE-2019-11735 | high | — | 8.0 | — | Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68. Some of these bugs showed evidence of memory corruption and we presume that with enough … | |||
| CVE-2019-3814 | high | — | 8.0 | — | It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could … | |||
| CVE-2019-11741 | high | — | 8.0 | — | A compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS) attack on content from any site it can cause to be loaded in the same process. Because addons.mozilla.org a… | |||
| CVE-2019-5868 | high | — | 8.0 | — | arbitrary code execution in chromium | |||
| CVE-2019-10182 | high | — | 8.0 | — | It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially crafted application … | |||
| CVE-2019-11742 | high | — | 8.0 | — | A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> element due to an error in how same-origin policy is applied … | |||
| CVE-2019-1348 | high | — | 8.0 | — | An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also vi… | |||
| CVE-2019-11706 | high | — | 8.0 | — | A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulting in a crash. This vulnerability affect… | |||
| CVE-2019-13714 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-13700 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-5489 | high | — | 8.0 | — | The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allow… | |||
| CVE-2019-5854 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-13719 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-11737 | high | — | 8.0 | — | If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly … | |||
| CVE-2019-5857 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-13716 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-7524 | high | — | 8.0 | — | In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing c… | |||
| CVE-2019-5858 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-13713 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-5859 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-9812 | high | — | 8.0 | — | Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a maliciou… | |||
| CVE-2019-5862 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-5794 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-5847 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-5787 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-1350 | high | — | 8.0 | — | A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-201… | |||
| CVE-2019-13707 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-5855 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-6956 | high | — | 8.0 | — | An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. It is a buffer over-read in ps_mix_phase in libfaad/ps_dec.c. | |||
| CVE-2019-13710 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-2201 | high | — | 8.0 | — | In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in an unprivileged proces… | |||
| CVE-2019-5796 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-13703 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-18182 | high | — | 8.0 | — | arbitrary command execution in pacman | |||
| CVE-2019-5851 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-14868 | high | — | 8.0 | — | In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell comman… | |||
| CVE-2019-13704 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-13702 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-11704 | high | — | 8.0 | — | A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting in a potentially exploitable crash. Thi… | |||
| CVE-2019-13696 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-5791 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-5852 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-5861 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-18183 | high | — | 8.0 | — | arbitrary command execution in pacman | |||
| CVE-2019-5865 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-1000019 | high | — | 8.0 | — | libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_fo… | |||
| CVE-2019-5795 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-11705 | high | — | 8.0 | — | A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in a potentially exploitable crash. This vu… | |||
| CVE-2019-1351 | high | — | 8.0 | — | A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'. | |||
| CVE-2019-20503 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-5864 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-13697 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-15903 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-13715 | high | — | 8.0 | — | multiple issues in chromium | |||
| CVE-2019-19450 | high | — | 8.0 | 3y ago | Important: python-reportlab security update | |||
| CVE-2019-18466 | high | — | 8.0 | 4y ago | Important: container-tools:rhel8 security and bug fix update | |||
| CVE-2019-9514 | high | — | 8.0 | 4y ago | Important: nodejs:10 security update | |||
| CVE-2019-9512 | high | — | 8.0 | 4y ago | Important: container-tools:rhel8 security and bug fix update | |||
| CVE-2019-10352 | high | — | 8.0 | 4y ago | Improper Limitation of a Pathname to a Restricted Directory in Jenkins | |||
| CVE-2019-10354 | high | — | 8.0 | 4y ago | Missing Authorization in Jenkins | |||
| CVE-2019-10353 | high | — | 8.0 | 4y ago | Cross-Site Request Forgery in Jenkins | |||
| CVE-2019-16276 | high | — | 8.0 | 4y ago | Request smuggling due to accepting invalid headers in net/http via net/textproto | |||
| CVE-2019-2435 | high | — | 8.0 | 4y ago | Improper Access Control in MySQL Connector Python | |||
| CVE-2019-5885 | high | — | 8.0 | 4y ago | Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers … | |||
| CVE-2019-16884 | high | — | 8.0 | 4y ago | Important: container-tools:rhel8 security and bug fix update | |||
| CVE-2019-10214 | high | — | 8.0 | 4y ago | Important: container-tools:rhel8 security, bug fix, and enhancement update | |||
| CVE-2019-18811 | high | — | 8.0 | 5y ago | A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering s… | |||
| CVE-2019-19528 | high | — | 8.0 | 5y ago | In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/iowarrior.c driver, aka CID-edc4746f253d. | |||
| CVE-2019-19523 | high | — | 8.0 | 5y ago | In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/adutux.c driver, aka CID-44efc269db79. | |||
| CVE-2019-2938 | high | — | 8.0 | 6y ago | Important: mariadb:10.3 security, bug fix, and enhancement update | |||
| CVE-2019-2974 | high | — | 8.0 | 6y ago | Important: mariadb:10.3 security, bug fix, and enhancement update | |||
| CVE-2019-15890 | high | — | 8.0 | 6y ago | Important: container-tools:rhel8 security, bug fix, and enhancement update | |||
| CVE-2019-2968 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |||
| CVE-2019-2963 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |||
| CVE-2019-2991 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |||
| CVE-2019-2957 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |||
| CVE-2019-3009 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |||
| CVE-2019-2998 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |||
| CVE-2019-2993 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update |