CVEs from 2019

4,187 normalized CVEs published or assigned in this year.

Total
4,187
critical
critical 232
high
high 332
medium
medium 301
low
low 72
% Critical
5.5%
% with KEV
2.8%
% with exploit
2.9%

Top vendors

Top products

  • u-boot 20
  • nsauditor 1
  • crypto 1
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2019-13720 critical 10.0 4y ago arbitrary code execution in chromium archdebian
CVE-2019-11707 critical 10.0 4y ago Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash. archsusedebian
CVE-2019-11043 critical 10.0 4y ago Critical: php:7.2 security update archsuserockylinux
CVE-2019-16928 critical 10.0 4y ago Exim contains an out-of-bounds write vulnerability which can allow for remote code execution. archdebian
CVE-2019-10149 critical 10.0 4y ago Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution. archdebian
CVE-2019-0211 critical 10.0 5y ago Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute c… debianarchsuse
CVE-2019-17026 critical 10.0 5y ago Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements. archdebian
CVE-2019-14204 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_umountall_reply. susedebian
CVE-2019-14203 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_mount_reply. susedebian
CVE-2019-14202 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_readlink_reply. susedebian
CVE-2019-14201 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_lookup_reply. susedebian
CVE-2019-14200 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: rpc_lookup_reply. susedebian
CVE-2019-14199 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer underflow during an *udp_packet_handler call. susedebian
CVE-2019-14198 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in the NFSv3 case. susedebian
CVE-2019-14196 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_lookup_reply. susedebian
CVE-2019-14195 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with unvalidated length at nfs_readlink_reply in the "else" block after calculating the new path length. susedebian
CVE-2019-14194 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in the NFSv2 case. susedebian
CVE-2019-14193 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with an unvalidated length at nfs_readlink_reply, in the "if" block after calculating the new path length. susedebian
CVE-2019-14192 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer underflow during an nc_input_packet call. susedebian
CVE-2019-5777 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5783 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5775 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5833 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5774 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5818 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5779 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5810 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5780 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5806 critical 9.5 multiple issues in chromium archdebian
CVE-2019-9788 critical 9.5 Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5. Some of these bugs showed evidence of memory corruption and we pres… archsusedebian
CVE-2019-19925 critical 9.5 multiple issues in chromium archdebiansuse
CVE-2019-17011 critical 9.5 Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash. This vulner… archsusedebian
CVE-2019-13721 critical 9.5 arbitrary code execution in chromium archdebian
CVE-2019-11745 critical 9.5 When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and… archsusedebian
CVE-2019-5838 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5828 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5820 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5805 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5814 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5809 critical 9.5 multiple issues in chromium archdebian
CVE-2019-3863 critical 9.5 A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than uns… archsusedebian
CVE-2019-13757 critical 9.5 Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. archdebian
CVE-2019-5782 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5807 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5778 critical 9.5 multiple issues in chromium archdebian
CVE-2019-19926 critical 9.5 multiple issues in chromium archdebiansuse
CVE-2019-11709 critical 9.5 Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enoug… archdebian
CVE-2019-3860 critical 9.5 An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial … archsusedebian
CVE-2019-9816 critical 9.5 A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vu… archsusedebian
CVE-2019-13742 critical 9.5 Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. archdebian
CVE-2019-7222 critical 9.5 The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak. archsusedebian
CVE-2019-13729 critical 9.5 Use-after-free in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2019-19923 critical 9.5 multiple issues in chromium archdebiansuse
CVE-2019-9803 critical 9.5 The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same-origin URL must be upgraded to HTTPS. Firefox will incorrec… archdebian
CVE-2019-9811 critical 9.5 As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation. This v… archsusedebian
CVE-2019-5835 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5837 critical 9.5 multiple issues in chromium archdebian
CVE-2019-13739 critical 9.5 Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. archdebian
CVE-2019-5831 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5829 critical 9.5 multiple issues in chromium archdebian
CVE-2019-5823 critical 9.5 multiple issues in chromium archdebian
CVE-2019-13741 critical 9.5 Insufficient validation of untrusted input in Blink in Google Chrome prior to 79.0.3945.79 allowed a local attacker to bypass same origin policy via crafted clipboard content. archdebian
CVE-2019-13917 critical 9.5 Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g., $lo… archdebian
CVE-2019-5813 critical 9.5 multiple issues in chromium archdebian
CVE-2019-3857 critical 9.5 An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker… archsusedebian
CVE-2019-13758 critical 9.5 Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. archdebian
CVE-2019-13759 critical 9.5 Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. archdebian
CVE-2019-13762 critical 9.5 Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof downloaded files via local code. archdebian
CVE-2019-0220 critical 9.5 multiple issues in apache debianarchsuse
CVE-2019-5756 critical 9.5 multiple issues in chromium archdebian
CVE-2019-17010 critical 9.5 Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash.… archsusedebian
CVE-2019-13728 critical 9.5 Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2019-17008 critical 9.5 When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3,… archsusedebian
CVE-2019-13761 critical 9.5 Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. archdebian
CVE-2019-5771 critical 9.5 multiple issues in chromium archdebian
CVE-2019-3862 critical 9.5 An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a… archsusedebian
CVE-2019-11692 critical 9.5 A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunde… archsusedebian
CVE-2019-13748 critical 9.5 Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML p… archdebian
CVE-2019-13763 critical 9.5 Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. archdebian
CVE-2019-9800 critical 9.5 Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we pres… archsusedebian
CVE-2019-11761 critical 9.5 By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it … archdebian
CVE-2019-13767 critical 9.5 Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2019-11720 critical 9.5 Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This allows malicious code to then be processed, evading cross-si… archdebian
CVE-2019-11723 critical 9.5 A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across dif… archdebian
CVE-2019-11725 critical 9.5 When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation is interrupted but resources from the same site loaded through websockets are not… archdebian
CVE-2019-6974 critical 9.5 In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free. archsusedebian
CVE-2019-9790 critical 9.5 A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use. This results in a potentially e… archsusedebian
CVE-2019-15846 critical 9.5 Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash. archdebian
CVE-2019-11757 critical 9.5 When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free and a potentially exploitabl… archdebian
CVE-2019-11764 critical 9.5 Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption and we presume that with enoug… archdebian
CVE-2019-17002 critical 9.5 If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https. This vulnerability affects Firefox < … archdebian
CVE-2019-17013 critical 9.5 Mozilla developers reported memory safety bugs present in Firefox 70. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been expl… archdebian
CVE-2019-17020 critical 9.5 If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL … archdebian
CVE-2019-5840 critical 9.5 multiple issues in chromium archdebian
CVE-2019-13725 critical 9.5 Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page. archdebian
CVE-2019-5830 critical 9.5 multiple issues in chromium archdebian
CVE-2019-9796 critical 9.5 A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a single registration is expected. When a registration is lat… archsusedebian
CVE-2019-7221 critical 9.5 The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free. archsusedebian
CVE-2019-9820 critical 9.5 A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.… archsusedebian
CVE-2019-13727 critical 9.5 Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy via a crafted HTML page. archdebian