CVEs from 2019

3,413 normalized CVEs published or assigned in this year.

Total
3,413
critical
critical 232
high
high 332
medium
medium 301
low
low 72
% Critical
6.8%
% with KEV
3.5%
% with exploit
3.5%

Top vendors

Top products

  • u-boot 20
  • nsauditor 1
  • crypto 1
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2019-13752 critical 9.5 Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. archdebian
CVE-2019-3863 critical 9.5 A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than uns… archsusedebian
CVE-2019-9802 critical 9.5 If a Sandbox content process is compromised, it can initiate an FTP download which will then use a child process to render the downloaded data. The downloaded data can then be passed to the Chrome pr… archdebian
CVE-2019-17020 critical 9.5 If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL … archdebian
CVE-2019-9803 critical 9.5 The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same-origin URL must be upgraded to HTTPS. Firefox will incorrec… archdebian
CVE-2019-11717 critical 9.5 A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vuln… archsusedebian
CVE-2019-11500 critical 9.5 In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead … archsusedebian
CVE-2019-13734 critical 9.5 Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2019-11763 critical 9.5 Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could… archdebian
CVE-2019-3862 critical 9.5 An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a… archsusedebian
CVE-2019-11720 critical 9.5 Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This allows malicious code to then be processed, evading cross-si… archdebian
CVE-2019-13739 critical 9.5 Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. archdebian
CVE-2019-11727 critical 9.5 A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in Certificat… archsusedebian
CVE-2019-5762 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5836 critical 9.5 multiple issues in chromium archdebian
CVE-2019-13764 critical 9.5 Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2019-5760 critical 9.5 multiple issues in chromium archdebian
CVE-2019-9956 critical 9.5 In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted i… archsusedebian
CVE-2019-5769 critical 9.5 multiple issues in chromium archdebian
CVE-2019-13755 critical 9.5 Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to disable extensions via a crafted HTML page. archdebian
CVE-2019-7733 critical 9.5 multiple issues in live-media arch
CVE-2019-5756 critical 9.5 multiple issues in chromium archdebian
CVE-2019-3855 critical 9.5 An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server … archsusedebian
CVE-2019-3857 critical 9.5 An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker… archsusedebian
CVE-2019-11713 critical 9.5 A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.… archsusedebian
CVE-2019-5821 critical 9.5 multiple issues in chromium archdebian
CVE-2019-9799 critical 9.5 Insufficient bounds checking of data during inter-process communication might allow a compromised content process to be able to read memory from the parent process under certain conditions. This vuln… archdebian
CVE-2019-13917 critical 9.5 Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g., $lo… archdebian
CVE-2019-9809 critical 9.5 If the source for resources on a page is through an FTP connection, it is possible to trigger a series of modal alert messages for these resources through invalid credentials or locations. These mess… archdebian
CVE-2019-18197 critical 9.5 4y ago multiple issues in chromium archsusedebianruby
CVE-2019-5815 critical 9.5 4y ago multiple issues in chromium archdebianruby
CVE-2019-11708 high 9.5 4y ago Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution. archdebian
CVE-2019-5786 high 9.5 6y ago arbitrary code execution in chromium archdebiannpm
CVE-2019-14197 critical 9.1 9.1 7y ago An issue was discovered in Das U-Boot through 2019.07. There is a read of out-of-bounds data at nfs_read_reply. susedebian
CVE-2019-25650 high 8.4 8.4 2mo ago River Past CamDo 3.7.6 contains a structured exception handler (SEH) buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string in the Lame_en…
CVE-2019-25651 high 8.3 8.3 2mo ago Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW prior to 4.0.6, USG FW prior to 4.4.34 u…
CVE-2019-25642 high 8.2 8.2 2mo ago Bootstrapy CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters. Attackers can…
CVE-2019-25640 high 8.2 8.2 2mo ago Inout Article Base CMS contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through the 'p' and 'u' parameters. Attackers can inject SQL code usi…
CVE-2019-5842 high 8.0 arbitrary code execution in chromium archdebian
CVE-2019-5848 high 8.0 multiple issues in chromium archdebian
CVE-2019-10063 high 8.0 Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed a… archsusedebian
CVE-2019-13707 high 8.0 multiple issues in chromium archdebian
CVE-2019-9812 high 8.0 Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a maliciou… archsusedebian
CVE-2019-5435 high 8.0 An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. archdebian
CVE-2019-25016 high 8.0 In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed t… archdebian
CVE-2019-13708 high 8.0 multiple issues in chromium archdebian
CVE-2019-15903 high 8.0 multiple issues in chromium archdebiansuserockylinux
CVE-2019-18634 high 8.0 In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and ele… archsusedebian
CVE-2019-13702 high 8.0 multiple issues in chromium archdebian
CVE-2019-13719 high 8.0 multiple issues in chromium archdebian
CVE-2019-5792 high 8.0 multiple issues in chromium archdebian
CVE-2019-5789 high 8.0 multiple issues in chromium archdebian
CVE-2019-14811 high 8.0 A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restriction… archsusedebian
CVE-2019-14812 high 8.0 A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions… archsusedebian
CVE-2019-5799 high 8.0 multiple issues in chromium archdebian
CVE-2019-20503 high 8.0 multiple issues in chromium archdebiansuse
CVE-2019-5802 high 8.0 multiple issues in chromium archdebian
CVE-2019-5793 high 8.0 multiple issues in chromium archdebian
CVE-2019-13693 high 8.0 multiple issues in chromium archdebian
CVE-2019-8906 high 8.0 do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused. archsusedebian
CVE-2019-5800 high 8.0 multiple issues in chromium archdebian
CVE-2019-1387 high 8.0 An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that… archdebian
CVE-2019-6454 high 8.0 An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming … archsusedebian
CVE-2019-6474 high 8.0 A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leas… archdebian
CVE-2019-5850 high 8.0 multiple issues in chromium archdebian
CVE-2019-13695 high 8.0 multiple issues in chromium archdebian
CVE-2019-7524 high 8.0 In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing c… archsusedebian
CVE-2019-8376 high 8.0 An issue was discovered in Tcpreplay 4.3.1. A NULL pointer dereference occurred in the function get_layer4_v6() located at get.c. This can be triggered by sending a crafted pcap file to the tcpreplay… archdebian
CVE-2019-5798 high 8.0 multiple issues in chromium archdebian
CVE-2019-15717 high 8.0 Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP. archdebian
CVE-2019-5860 high 8.0 multiple issues in chromium archdebian
CVE-2019-11744 high 8.0 Some HTML elements, such as &lt;title&gt; and &lt;textarea&gt;, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these… archsusedebian
CVE-2019-13718 high 8.0 multiple issues in chromium archdebian
CVE-2019-5795 high 8.0 multiple issues in chromium archdebian
CVE-2019-13711 high 8.0 multiple issues in chromium archdebian
CVE-2019-5851 high 8.0 multiple issues in chromium archdebian
CVE-2019-13699 high 8.0 multiple issues in chromium archdebian
CVE-2019-19604 high 8.0 Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can… archdebian
CVE-2019-5803 high 8.0 multiple issues in chromium archdebian
CVE-2019-5852 high 8.0 multiple issues in chromium archdebian
CVE-2019-1000019 high 8.0 libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_fo… archsusedebian
CVE-2019-13701 high 8.0 multiple issues in chromium archdebian
CVE-2019-5854 high 8.0 multiple issues in chromium archdebian
CVE-2019-14813 high 8.0 A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A… archsusedebian
CVE-2019-8907 high 8.0 do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application crash) or possibly have unspecified other impact. archsusedebian
CVE-2019-5859 high 8.0 multiple issues in chromium archdebian
CVE-2019-6111 high 8.0 An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only perf… archsusedebian
CVE-2019-8377 high 8.0 An issue was discovered in Tcpreplay 4.3.1. A NULL pointer dereference occurred in the function get_ipv6_l4proto() located at get.c. This can be triggered by sending a crafted pcap file to the tcprep… archdebian
CVE-2019-13705 high 8.0 multiple issues in chromium archdebian
CVE-2019-5861 high 8.0 multiple issues in chromium archdebian
CVE-2019-14817 high 8.0 A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrict… archsusedebian
CVE-2019-5849 high 8.0 Out of bounds read in Skia in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. archdebian
CVE-2019-14318 high 8.0 Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote attacker, able to measure the duration of hundreds to thousands of signing opera… archdebian
CVE-2019-5857 high 8.0 multiple issues in chromium archdebian
CVE-2019-13706 high 8.0 multiple issues in chromium archdebian
CVE-2019-5858 high 8.0 multiple issues in chromium archdebian
CVE-2019-12735 high 8.0 getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert… archsusedebian
CVE-2019-11737 high 8.0 If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly … archdebian
CVE-2019-1349 high 8.0 A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-201… archdebian
CVE-2019-5862 high 8.0 multiple issues in chromium archdebian