CVEs from 2019
Total
4,015
critical
critical 232
high
high 332
medium
medium 301
low
low 72
% Critical
5.8%
% with KEV
2.9%
% with exploit
3.0%
Top products
- u-boot 20
- nsauditor 1
- crypto 1
| CVE | Severity | CVSS | Risk | Published | Description | Impact |
|---|---|---|---|---|---|---|
| CVE-2019-13705 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-3838 | high | — | 8.0 | — | It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example,… | |
| CVE-2019-13701 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-6133 | high | — | 8.0 | — | In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to la… | |
| CVE-2019-5856 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13699 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5849 | high | — | 8.0 | — | Out of bounds read in Skia in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. | |
| CVE-2019-8907 | high | — | 8.0 | — | do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application crash) or possibly have unspecified other impact. | |
| CVE-2019-14817 | high | — | 8.0 | — | A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrict… | |
| CVE-2019-13714 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-8343 | high | — | 8.0 | — | In Netwide Assembler (NASM) 2.14.02, there is a use-after-free in paste_tokens in asm/preproc.c. | |
| CVE-2019-11747 | high | — | 8.0 | — | The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site. This includes removing any HTTP Strict Transport Security … | |
| CVE-2019-11706 | high | — | 8.0 | — | A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulting in a crash. This vulnerability affect… | |
| CVE-2019-9278 | high | — | 8.0 | — | In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege in the media content provider with no additional execution privileges… | |
| CVE-2019-13694 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-8905 | high | — | 8.0 | — | do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360. | |
| CVE-2019-11477 | high | — | 8.0 | — | Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker c… | |
| CVE-2019-13693 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5803 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13695 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-8904 | high | — | 8.0 | — | do_bid_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printf and file_vprintf. | |
| CVE-2019-5435 | high | — | 8.0 | — | An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. | |
| CVE-2019-3871 | high | — | 8.0 | — | A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the … | |
| CVE-2019-5848 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5842 | high | — | 8.0 | — | arbitrary code execution in chromium | |
| CVE-2019-5864 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5865 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-18634 | high | — | 8.0 | — | In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and ele… | |
| CVE-2019-11738 | high | — | 8.0 | — | If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed. This could allow for mal… | |
| CVE-2019-6465 | high | — | 8.0 | — | Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.… | |
| CVE-2019-2201 | high | — | 8.0 | — | In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in an unprivileged proces… | |
| CVE-2019-18222 | high | — | 8.0 | — | The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to reco… | |
| CVE-2019-13700 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13702 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-1353 | high | — | 8.0 | — | An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known… | |
| CVE-2019-11139 | high | — | 8.0 | — | Improper conditions check in the voltage modulation interface for some Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially enable denial of service via local access. | |
| CVE-2019-5797 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-6472 | high | — | 8.0 | — | A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2. | |
| CVE-2019-6956 | high | — | 8.0 | — | An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. It is a buffer over-read in ps_mix_phase in libfaad/ps_dec.c. | |
| CVE-2019-0117 | high | — | 8.0 | — | multiple issues in intel-ucode | |
| CVE-2019-11741 | high | — | 8.0 | — | A compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS) attack on content from any site it can cause to be loaded in the same process. Because addons.mozilla.org a… | |
| CVE-2019-11734 | high | — | 8.0 | — | Mozilla developers and community members reported memory safety bugs present in Firefox 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of… | |
| CVE-2019-15717 | high | — | 8.0 | — | Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP. | |
| CVE-2019-11742 | high | — | 8.0 | — | A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> element due to an error in how same-origin policy is applied … | |
| CVE-2019-5790 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5787 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13718 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-25016 | high | — | 8.0 | — | In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed t… | |
| CVE-2019-19604 | high | — | 8.0 | — | Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can… | |
| CVE-2019-11752 | high | — | 8.0 | — | It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a potentially exploitable crash. This vulnerability affects … | |
| CVE-2019-11743 | high | — | 8.0 | — | Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload event, which restricts access to detailed timing attributes to … | |
| CVE-2019-11705 | high | — | 8.0 | — | A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in a potentially exploitable crash. This vu… | |
| CVE-2019-0190 | high | — | 8.0 | — | multiple issues in apache | |
| CVE-2019-14813 | high | — | 8.0 | — | A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A… | |
| CVE-2019-1350 | high | — | 8.0 | — | A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-201… | |
| CVE-2019-19977 | high | — | 8.0 | — | libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer over-read. | |
| CVE-2019-1348 | high | — | 8.0 | — | An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also vi… | |
| CVE-2019-9849 | high | — | 8.0 | — | LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who w… | |
| CVE-2019-8943 | high | — | 8.0 | — | WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two … | |
| CVE-2019-13711 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-1351 | high | — | 8.0 | — | A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'. | |
| CVE-2019-13709 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-12881 | high | — | 8.0 | — | i915_gem_userptr_get_pages in drivers/gpu/drm/i915/i915_gem_userptr.c in the Linux kernel 4.15.0 on Ubuntu 18.04.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) o… | |
| CVE-2019-5489 | high | — | 8.0 | — | The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allow… | |
| CVE-2019-18183 | high | — | 8.0 | — | arbitrary command execution in pacman | |
| CVE-2019-18182 | high | — | 8.0 | — | arbitrary command execution in pacman | |
| CVE-2019-8381 | high | — | 8.0 | — | An issue was discovered in Tcpreplay 4.3.1. An invalid memory access occurs in do_checksum in checksum.c. It can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an… | |
| CVE-2019-11749 | high | — | 8.0 | — | A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using constraints to reveal device properties of cameras on the system without triggeri… | |
| CVE-2019-11737 | high | — | 8.0 | — | If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly … | |
| CVE-2019-11744 | high | — | 8.0 | — | Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these… | |
| CVE-2019-5855 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5847 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5791 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-19450 | high | — | 8.0 | 3y ago | Important: python-reportlab security update | |
| CVE-2019-18466 | high | — | 8.0 | 4y ago | Important: container-tools:rhel8 security and bug fix update | |
| CVE-2019-9512 | high | — | 8.0 | 4y ago | Important: container-tools:rhel8 security and bug fix update | |
| CVE-2019-9514 | high | — | 8.0 | 4y ago | Important: nodejs:10 security update | |
| CVE-2019-10354 | high | — | 8.0 | 4y ago | Missing Authorization in Jenkins | |
| CVE-2019-10353 | high | — | 8.0 | 4y ago | Cross-Site Request Forgery in Jenkins | |
| CVE-2019-10352 | high | — | 8.0 | 4y ago | Improper Limitation of a Pathname to a Restricted Directory in Jenkins | |
| CVE-2019-16276 | high | — | 8.0 | 4y ago | Request smuggling due to accepting invalid headers in net/http via net/textproto | |
| CVE-2019-2435 | high | — | 8.0 | 4y ago | Improper Access Control in MySQL Connector Python | |
| CVE-2019-5885 | high | — | 8.0 | 4y ago | Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers … | |
| CVE-2019-16884 | high | — | 8.0 | 4y ago | Important: container-tools:rhel8 security and bug fix update | |
| CVE-2019-10214 | high | — | 8.0 | 4y ago | Important: container-tools:rhel8 security, bug fix, and enhancement update | |
| CVE-2019-18811 | high | — | 8.0 | 5y ago | Important: kernel security, bug fix, and enhancement update | |
| CVE-2019-19523 | high | — | 8.0 | 5y ago | Important: kernel security, bug fix, and enhancement update | |
| CVE-2019-19528 | high | — | 8.0 | 5y ago | Important: kernel security, bug fix, and enhancement update | |
| CVE-2019-2938 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-2974 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-15890 | high | — | 8.0 | 6y ago | Important: container-tools:rhel8 security, bug fix, and enhancement update | |
| CVE-2019-3011 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-3009 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-2968 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-2998 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-2991 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-3018 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-2967 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-2966 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update | |
| CVE-2019-2982 | high | — | 8.0 | 6y ago | Important: mysql:8.0 security update |