CVEs from 2019
Total
4,015
critical
critical 232
high
high 332
medium
medium 301
low
low 72
% Critical
5.8%
% with KEV
2.9%
% with exploit
3.0%
Top products
- u-boot 20
- nsauditor 1
- crypto 1
| CVE | Severity | CVSS | Risk | Published | Description | Impact |
|---|---|---|---|---|---|---|
| CVE-2019-13754 | critical | — | 9.5 | — | Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. | |
| CVE-2019-11723 | critical | — | 9.5 | — | A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across dif… | |
| CVE-2019-11718 | critical | — | 9.5 | — | Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access … | |
| CVE-2019-11716 | critical | — | 9.5 | — | Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropertyNames(window). Sites that deploy a sandboxing that depen… | |
| CVE-2019-5756 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-13759 | critical | — | 9.5 | — | Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. | |
| CVE-2019-13757 | critical | — | 9.5 | — | Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. | |
| CVE-2019-11721 | critical | — | 9.5 | — | The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar. This allows for domain spoofing attacks as do not display as punycode text, allowing for user confus… | |
| CVE-2019-17010 | critical | — | 9.5 | — | Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash.… | |
| CVE-2019-13761 | critical | — | 9.5 | — | Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. | |
| CVE-2019-13763 | critical | — | 9.5 | — | Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. | |
| CVE-2019-17012 | critical | — | 9.5 | — | Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these… | |
| CVE-2019-13767 | critical | — | 9.5 | — | Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2019-11729 | critical | — | 9.5 | — | Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8… | |
| CVE-2019-9813 | critical | — | 9.5 | — | Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox < 66.0.1, Firef… | |
| CVE-2019-5810 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5805 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-9810 | critical | — | 9.5 | — | Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR… | |
| CVE-2019-5782 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5821 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5762 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-17008 | critical | — | 9.5 | — | When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3,… | |
| CVE-2019-5780 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-13756 | critical | — | 9.5 | — | Incorrect security UI in printing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. | |
| CVE-2019-9816 | critical | — | 9.5 | — | A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vu… | |
| CVE-2019-13738 | critical | — | 9.5 | — | Insufficient policy enforcement in navigation in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass site isolation via a crafted HTML page. | |
| CVE-2019-13732 | critical | — | 9.5 | — | Use-after-free in WebAudio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2019-9793 | critical | — | 9.5 | — | A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an attacker to create… | |
| CVE-2019-5771 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2019-5815 | critical | — | 9.5 | 4y ago | multiple issues in chromium | |
| CVE-2019-18197 | critical | — | 9.5 | 4y ago | multiple issues in chromium | |
| CVE-2019-11708 | high | — | 9.5 | 4y ago | Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution. | |
| CVE-2019-5786 | high | — | 9.5 | 6y ago | arbitrary code execution in chromium | |
| CVE-2019-14197 | critical | 9.1 | 9.1 | 7y ago | An issue was discovered in Das U-Boot through 2019.07. There is a read of out-of-bounds data at nfs_read_reply. | |
| CVE-2019-25650 | high | 8.4 | 8.4 | 2mo ago | River Past CamDo 3.7.6 contains a structured exception handler (SEH) buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string in the Lame_en… | |
| CVE-2019-25651 | high | 8.3 | 8.3 | 2mo ago | Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW prior to 4.0.6, USG FW prior to 4.4.34 u… | |
| CVE-2019-25642 | high | 8.2 | 8.2 | 2mo ago | Bootstrapy CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters. Attackers can… | |
| CVE-2019-25640 | high | 8.2 | 8.2 | 2mo ago | Inout Article Base CMS contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through the 'p' and 'u' parameters. Attackers can inject SQL code usi… | |
| CVE-2019-16866 | high | — | 8.0 | — | Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule. | |
| CVE-2019-13706 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13705 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13701 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13699 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13717 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13695 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13693 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-20503 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13719 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-15903 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13707 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13703 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5796 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5794 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13716 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13715 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13713 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13710 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13704 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13697 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5862 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5858 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5857 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5861 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5859 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5854 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5852 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5851 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5795 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5860 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5798 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5850 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5800 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5793 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5802 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5799 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5789 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-9849 | high | — | 8.0 | — | LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who w… | |
| CVE-2019-25016 | high | — | 8.0 | — | In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed t… | |
| CVE-2019-18222 | high | — | 8.0 | — | The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to reco… | |
| CVE-2019-11746 | high | — | 8.0 | — | A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Firefox… | |
| CVE-2019-5803 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-5865 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-14811 | high | — | 8.0 | — | A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restriction… | |
| CVE-2019-8337 | high | — | 8.0 | — | In msmtp 1.8.2 and mpop 1.4.3, when tls_trust_file has its default configuration, certificate-verification results are not properly checked. | |
| CVE-2019-10181 | high | — | 8.0 | — | It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw t… | |
| CVE-2019-8905 | high | — | 8.0 | — | do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360. | |
| CVE-2019-6474 | high | — | 8.0 | — | A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leas… | |
| CVE-2019-8904 | high | — | 8.0 | — | do_bid_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printf and file_vprintf. | |
| CVE-2019-6473 | high | — | 8.0 | — | An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0… | |
| CVE-2019-9812 | high | — | 8.0 | — | Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a maliciou… | |
| CVE-2019-12735 | high | — | 8.0 | — | getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert… | |
| CVE-2019-7524 | high | — | 8.0 | — | In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing c… | |
| CVE-2019-14812 | high | — | 8.0 | — | A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions… | |
| CVE-2019-14287 | high | — | 8.0 | — | In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a cra… | |
| CVE-2019-3838 | high | — | 8.0 | — | It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example,… | |
| CVE-2019-12881 | high | — | 8.0 | — | i915_gem_userptr_get_pages in drivers/gpu/drm/i915/i915_gem_userptr.c in the Linux kernel 4.15.0 on Ubuntu 18.04.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) o… | |
| CVE-2019-14869 | high | — | 8.0 | — | A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restricti… | |
| CVE-2019-8381 | high | — | 8.0 | — | An issue was discovered in Tcpreplay 4.3.1. An invalid memory access occurs in do_checksum in checksum.c. It can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an… | |
| CVE-2019-5791 | high | — | 8.0 | — | multiple issues in chromium | |
| CVE-2019-13696 | high | — | 8.0 | — | multiple issues in chromium |