VIR Vulnerability Intelligence Relay

CVEs from 2019

4,187 normalized CVEs published or assigned in this year.

Total
4,187
critical
critical 232
high
high 332
medium
medium 301
low
low 72
% Critical
5.5%
% with KEV
2.8%
% with exploit
2.9%

Top vendors

Top products

  • u-boot 20
  • nsauditor 1
  • crypto 1

Top packages

Severitycriticalhighmediumlowunknown
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2019-11707 critical — 10.0 4y ago Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash. archsusedebian
CVE-2019-13720 critical — 10.0 4y ago arbitrary code execution in chromium archdebian
CVE-2019-11043 critical — 10.0 4y ago Critical: php:7.2 security update archsuserockylinux
CVE-2019-16928 critical — 10.0 4y ago Exim contains an out-of-bounds write vulnerability which can allow for remote code execution. archdebian
CVE-2019-10149 critical — 10.0 4y ago Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution. archdebian
CVE-2019-0211 critical — 10.0 5y ago Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute c… debianarchsuse
CVE-2019-17026 critical — 10.0 5y ago Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements. archdebian
CVE-2019-14204 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_umountall_reply. susedebian
CVE-2019-14203 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_mount_reply. susedebian
CVE-2019-14202 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_readlink_reply. susedebian
CVE-2019-14201 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_lookup_reply. susedebian
CVE-2019-14200 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: rpc_lookup_reply. susedebian
CVE-2019-14199 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer underflow during an *udp_packet_handler call. susedebian
CVE-2019-14198 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in the NFSv3 case. susedebian
CVE-2019-14196 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_lookup_reply. susedebian
CVE-2019-14195 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with unvalidated length at nfs_readlink_reply in the "else" block after calculating the new path length. susedebian
CVE-2019-14194 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in the NFSv2 case. susedebian
CVE-2019-14193 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with an unvalidated length at nfs_readlink_reply, in the "if" block after calculating the new path length. susedebian
CVE-2019-14192 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer underflow during an nc_input_packet call. susedebian
CVE-2019-5813 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13726 critical — 9.5 — Buffer overflow in password manager in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page. archdebian
CVE-2019-13730 critical — 9.5 — Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2019-9805 critical — 9.5 — A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, leading to potential memory corruption. This vulnerability affects Firefox < 66. archdebian
CVE-2019-7733 critical — 9.5 — multiple issues in live-media arch
CVE-2019-13753 critical — 9.5 — Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. archdebian
CVE-2019-13752 critical — 9.5 — Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. archdebian
CVE-2019-5775 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-7221 critical — 9.5 — The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free. archsusedebian
CVE-2019-17000 critical — 9.5 — An object tag with a data URI did not correctly inherit the document's Content Security Policy. This allowed a CSP bypass in a cross-origin frame if the document's policy explicitly allowed data: URI… archdebian
CVE-2019-9799 critical — 9.5 — Insufficient bounds checking of data during inter-process communication might allow a compromised content process to be able to read memory from the parent process under certain conditions. This vuln… archdebian
CVE-2019-12874 critical — 9.5 — arbitrary code execution in vlc archdebian
CVE-2019-5774 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5819 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13736 critical — 9.5 — Integer overflow in PDFium in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. archdebian
CVE-2019-13758 critical — 9.5 — Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. archdebian
CVE-2019-13741 critical — 9.5 — Insufficient validation of untrusted input in Blink in Google Chrome prior to 79.0.3945.79 allowed a local attacker to bypass same origin policy via crafted clipboard content. archdebian
CVE-2019-13762 critical — 9.5 — Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof downloaded files via local code. archdebian
CVE-2019-13739 critical — 9.5 — Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. archdebian
CVE-2019-13729 critical — 9.5 — Use-after-free in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2019-17022 critical — 9.5 — When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer does not escape &lt; and &gt; characters. Because the resulting string is pasted directly into the text … archdebian
CVE-2019-13746 critical — 9.5 — Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. archdebian
CVE-2019-5759 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5773 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5806 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5768 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13727 critical — 9.5 — Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy via a crafted HTML page. archdebian
CVE-2019-13735 critical — 9.5 — Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. archdebian
CVE-2019-5807 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13764 critical — 9.5 — Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2019-5771 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5823 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5810 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5809 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5764 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5777 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5840 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5779 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5783 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13745 critical — 9.5 — Insufficient policy enforcement in audio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. archdebian
CVE-2019-5814 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13759 critical — 9.5 — Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. archdebian
CVE-2019-13757 critical — 9.5 — Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. archdebian
CVE-2019-5766 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5835 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-11745 critical — 9.5 — When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and… archsusedebian
CVE-2019-5833 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5761 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13737 critical — 9.5 — Insufficient policy enforcement in autocomplete in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML pag… archdebian
CVE-2019-3861 critical — 9.5 — An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH… archsusedebian
CVE-2019-5782 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5820 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5765 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13728 critical — 9.5 — Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2019-9810 critical — 9.5 — Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR… archsusedebian
CVE-2019-17009 critical — 9.5 — When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the up… archsusedebian
CVE-2019-5838 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5770 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5767 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5758 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13754 critical — 9.5 — Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. archdebian
CVE-2019-5754 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5763 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-3813 critical — 9.5 — Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-executi… archsusedebian
CVE-2019-5780 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-11500 critical — 9.5 — In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead … archsusedebian
CVE-2019-11719 critical — 9.5 — When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to inf… archsusedebian
CVE-2019-17666 critical — 9.5 — rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow. archsusedebian
CVE-2019-5778 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13725 critical — 9.5 — Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page. archdebian
CVE-2019-19926 critical — 9.5 — multiple issues in chromium archdebiansuse
CVE-2019-5829 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5832 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5818 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5837 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-19925 critical — 9.5 — multiple issues in chromium archdebiansuse
CVE-2019-5805 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13721 critical — 9.5 — arbitrary code execution in chromium archdebian
CVE-2019-19923 critical — 9.5 — multiple issues in chromium archdebiansuse
CVE-2019-11717 critical — 9.5 — A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vuln… archsusedebian
CVE-2019-5831 critical — 9.5 — multiple issues in chromium archdebian