CVEs from 2019
Total
4,015
critical
critical 232
high
high 332
medium
medium 301
low
low 72
% Critical
5.8%
% with KEV
2.9%
% with exploit
3.0%
Top products
- u-boot 20
- nsauditor 1
- crypto 1
| CVE | Severity | CVSS | Risk | Published | Description | Impact |
|---|---|---|---|---|---|---|
| CVE-2019-5839 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5837 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-17666 | critical | — | 9.5 | — | rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow. | |
| CVE-2019-11715 | critical | — | 9.5 | — | Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on web sites in certain circumstances. This vulnerability aff… | |
| CVE-2019-5838 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5833 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5832 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5831 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5828 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5829 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5823 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-8942 | critical | — | 9.5 | — | WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php su… | |
| CVE-2019-5820 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5818 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5819 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5813 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5814 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5809 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5810 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5805 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5782 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5780 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5771 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5807 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5778 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-11695 | critical | — | 9.5 | — | A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the primary web content area. This could be … | |
| CVE-2019-11696 | critical | — | 9.5 | — | Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even though they can be executed if Java is installed on the local sys… | |
| CVE-2019-13725 | critical | — | 9.5 | — | Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page. | |
| CVE-2019-9788 | critical | — | 9.5 | — | Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5. Some of these bugs showed evidence of memory corruption and we pres… | |
| CVE-2019-18197 | critical | — | 9.5 | 4y ago | multiple issues in chromium | |
| CVE-2019-5815 | critical | — | 9.5 | 4y ago | multiple issues in chromium | |
| CVE-2019-11708 | high | — | 9.5 | 4y ago | Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution. | |
| CVE-2019-5786 | high | — | 9.5 | 6y ago | arbitrary code execution in chromium | |
| CVE-2019-14197 | critical | 9.1 | 9.1 | 7y ago | An issue was discovered in Das U-Boot through 2019.07. There is a read of out-of-bounds data at nfs_read_reply. | |
| CVE-2019-25650 | high | 8.4 | 8.4 | 2mo ago | River Past CamDo 3.7.6 contains a structured exception handler (SEH) buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string in the Lame_en… | |
| CVE-2019-25651 | high | 8.3 | 8.3 | 2mo ago | Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW prior to 4.0.6, USG FW prior to 4.4.34 u… | |
| CVE-2019-25642 | high | 8.2 | 8.2 | 2mo ago | Bootstrapy CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters. Attackers can… | |
| CVE-2019-25640 | high | 8.2 | 8.2 | 2mo ago | Inout Article Base CMS contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through the 'p' and 'u' parameters. Attackers can inject SQL code usi… | |
| CVE-2019-10182 | high | — | 8.0 | — | It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially crafted application … | |
| CVE-2019-8905 | high | — | 8.0 | — | do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360. | |
| CVE-2019-8904 | high | — | 8.0 | — | do_bid_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printf and file_vprintf. | |
| CVE-2019-11479 | high | — | 8.0 | — | Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. … | |
| CVE-2019-1000019 | high | — | 8.0 | — | libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_fo… | |
| CVE-2019-12735 | high | — | 8.0 | — | getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert… | |
| CVE-2019-20503 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13719 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-15903 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13707 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13703 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5796 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5794 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13716 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13715 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13713 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13710 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13704 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13697 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5862 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5858 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5857 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5861 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5859 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5854 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5852 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5851 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5795 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5860 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5798 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5850 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5800 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5793 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5802 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5799 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5789 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-18634 | high | — | 8.0 | — | In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and ele… | |
| CVE-2019-9849 | high | — | 8.0 | — | LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who w… | |
| CVE-2019-11477 | high | — | 8.0 | — | Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker c… | |
| CVE-2019-5803 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-19977 | high | — | 8.0 | — | libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer over-read. | |
| CVE-2019-5865 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-11747 | high | — | 8.0 | — | The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site. This includes removing any HTTP Strict Transport Security … | |
| CVE-2019-8343 | high | — | 8.0 | — | In Netwide Assembler (NASM) 2.14.02, there is a use-after-free in paste_tokens in asm/preproc.c. | |
| CVE-2019-11749 | high | — | 8.0 | — | A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using constraints to reveal device properties of cameras on the system without triggeri… | |
| CVE-2019-10185 | high | — | 8.0 | — | It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary… | |
| CVE-2019-8337 | high | — | 8.0 | — | In msmtp 1.8.2 and mpop 1.4.3, when tls_trust_file has its default configuration, certificate-verification results are not properly checked. | |
| CVE-2019-5790 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-11478 | high | — | 8.0 | — | Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences… | |
| CVE-2019-1349 | high | — | 8.0 | — | A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-201… | |
| CVE-2019-5489 | high | — | 8.0 | — | The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allow… | |
| CVE-2019-18183 | high | — | 8.0 | — | arbitrary command execution in pacman | |
| CVE-2019-18182 | high | — | 8.0 | — | arbitrary command execution in pacman | |
| CVE-2019-11737 | high | — | 8.0 | — | If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly … | |
| CVE-2019-1351 | high | — | 8.0 | — | A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'. | |
| CVE-2019-8943 | high | — | 8.0 | — | WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two … | |
| CVE-2019-19882 | high | — | 8.0 | — | shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affe… | |
| CVE-2019-19604 | high | — | 8.0 | — | Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can… | |
| CVE-2019-12881 | high | — | 8.0 | — | i915_gem_userptr_get_pages in drivers/gpu/drm/i915/i915_gem_userptr.c in the Linux kernel 4.15.0 on Ubuntu 18.04.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) o… | |
| CVE-2019-0117 | high | — | 8.0 | — | multiple issues in intel-ucode | |
| CVE-2019-14813 | high | — | 8.0 | — | A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A… | |
| CVE-2019-5868 | high | — | 8.0 | — | arbitrary code execution in chromium |