CVEs from 2019
Total
4,015
critical
critical 232
high
high 332
medium
medium 301
low
low 72
% Critical
5.8%
% with KEV
2.9%
% with exploit
3.0%
Top products
- u-boot 20
- nsauditor 1
- crypto 1
| CVE | Severity | CVSS | Risk | Published | Description | Impact |
|---|---|---|---|---|---|---|
| CVE-2019-11737 | high | — | 8.0 | — | If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly … | |
| CVE-2019-1351 | high | — | 8.0 | — | A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'. | |
| CVE-2019-19604 | high | — | 8.0 | — | Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can… | |
| CVE-2019-0117 | high | — | 8.0 | — | multiple issues in intel-ucode | |
| CVE-2019-11683 | high | — | 8.0 | — | udp_gro_receive_segment in net/ipv4/udp_offload.c in the Linux kernel 5.x before 5.0.13 allows remote attackers to cause a denial of service (slab-out-of-bounds memory corruption) or possibly have un… | |
| CVE-2019-0053 | high | — | 8.0 | — | Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffer overflows, which can be exploited to bypass veriexec restrictions on Junos OS… | |
| CVE-2019-8377 | high | — | 8.0 | — | An issue was discovered in Tcpreplay 4.3.1. A NULL pointer dereference occurred in the function get_ipv6_l4proto() located at get.c. This can be triggered by sending a crafted pcap file to the tcprep… | |
| CVE-2019-14813 | high | — | 8.0 | — | A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A… | |
| CVE-2019-5787 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-12749 | high | — | 8.0 | — | dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofi… | |
| CVE-2019-8381 | high | — | 8.0 | — | An issue was discovered in Tcpreplay 4.3.1. An invalid memory access occurs in do_checksum in checksum.c. It can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an… | |
| CVE-2019-8376 | high | — | 8.0 | — | An issue was discovered in Tcpreplay 4.3.1. A NULL pointer dereference occurred in the function get_layer4_v6() located at get.c. This can be triggered by sending a crafted pcap file to the tcpreplay… | |
| CVE-2019-11706 | high | — | 8.0 | — | A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulting in a crash. This vulnerability affect… | |
| CVE-2019-5785 | high | — | 8.0 | — | Incorrect convexity calculations in Skia in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. | |
| CVE-2019-6109 | high | — | 8.0 | — | An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the… | |
| CVE-2019-6465 | high | — | 8.0 | — | Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.… | |
| CVE-2019-3822 | high | — | 8.0 | — | libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_mess… | |
| CVE-2019-11461 | high | — | 8.0 | — | An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI … | |
| CVE-2019-13702 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13700 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13708 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5867 | high | — | 8.0 | — | arbitrary code execution in chromium | |
| CVE-2019-5791 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-6454 | high | — | 8.0 | — | An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming … | |
| CVE-2019-14287 | high | — | 8.0 | — | In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a cra… | |
| CVE-2019-6111 | high | — | 8.0 | — | An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only perf… | |
| CVE-2019-1354 | high | — | 8.0 | — | A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-201… | |
| CVE-2019-11704 | high | — | 8.0 | — | A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting in a potentially exploitable crash. Thi… | |
| CVE-2019-1348 | high | — | 8.0 | — | An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also vi… | |
| CVE-2019-11734 | high | — | 8.0 | — | Mozilla developers and community members reported memory safety bugs present in Firefox 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of… | |
| CVE-2019-3838 | high | — | 8.0 | — | It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example,… | |
| CVE-2019-6133 | high | — | 8.0 | — | In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to la… | |
| CVE-2019-8907 | high | — | 8.0 | — | do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application crash) or possibly have unspecified other impact. | |
| CVE-2019-13706 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13705 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13701 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13699 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13717 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13695 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13693 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-20503 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13719 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-15903 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13707 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13703 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5796 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5794 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13716 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13715 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13713 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13710 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13704 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13697 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5862 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5858 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5857 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5861 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5859 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5854 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5852 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5851 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5795 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5860 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5798 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5850 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5800 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5793 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5802 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5799 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5789 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-6116 | high | — | 8.0 | — | In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution. | |
| CVE-2019-9849 | high | — | 8.0 | — | LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who w… | |
| CVE-2019-13696 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-19450 | high | — | 8.0 | 3y ago | Important: python-reportlab security update | |
| CVE-2019-18466 | high | — | 8.0 | 4y ago | Important: container-tools:rhel8 security and bug fix update | |
| CVE-2019-9514 | high | — | 8.0 | 4y ago | Important: nodejs:10 security update | |
| CVE-2019-9512 | high | — | 8.0 | 4y ago | Important: container-tools:rhel8 security and bug fix update | |
| CVE-2019-10353 | high | — | 8.0 | 4y ago | Cross-Site Request Forgery in Jenkins | |
| CVE-2019-10352 | high | — | 8.0 | 4y ago | Improper Limitation of a Pathname to a Restricted Directory in Jenkins | |
| CVE-2019-10354 | high | — | 8.0 | 4y ago | Missing Authorization in Jenkins | |
| CVE-2019-16276 | high | — | 8.0 | 4y ago | Request smuggling due to accepting invalid headers in net/http via net/textproto | |
| CVE-2019-2435 | high | — | 8.0 | 4y ago | Improper Access Control in MySQL Connector Python | |
| CVE-2019-5885 | high | — | 8.0 | 4y ago | Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers … | |
| CVE-2019-16884 | high | — | 8.0 | 4y ago | Important: container-tools:rhel8 security and bug fix update | |
| CVE-2019-10214 | high | — | 8.0 | 4y ago | Important: container-tools:rhel8 security, bug fix, and enhancement update | |
| CVE-2019-18811 | high | — | 8.0 | 5y ago | Important: kernel security, bug fix, and enhancement update | |
| CVE-2019-19528 | high | — | 8.0 | 5y ago | Important: kernel security, bug fix, and enhancement update | |
| CVE-2019-19523 | high | — | 8.0 | 5y ago | Important: kernel security, bug fix, and enhancement update | |
| CVE-2019-2938 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-2974 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-15890 | high | — | 8.0 | 6y ago | Important: container-tools:rhel8 security, bug fix, and enhancement update | |
| CVE-2019-2963 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-3018 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-3011 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-2911 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-2998 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-2914 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-3004 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-2960 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-2993 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update |