VIR Vulnerability Intelligence Relay

CVEs from 2019

3,603 normalized CVEs published or assigned in this year.

Total
3,603
critical
critical 232
high
high 332
medium
medium 301
low
low 72
% Critical
6.4%
% with KEV
3.3%
% with exploit
3.4%

Top vendors

Top products

  • u-boot 20
  • nsauditor 1
  • crypto 1

Top packages

Severitycriticalhighmediumlowunknown
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2019-13720 critical — 10.0 4y ago arbitrary code execution in chromium archdebian
CVE-2019-11707 critical — 10.0 4y ago Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash. archsusedebian
CVE-2019-11043 critical — 10.0 4y ago Critical: php:7.2 security update archsuserockylinux
CVE-2019-16928 critical — 10.0 4y ago Exim contains an out-of-bounds write vulnerability which can allow for remote code execution. archdebian
CVE-2019-10149 critical — 10.0 4y ago Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution. archdebian
CVE-2019-0211 critical — 10.0 5y ago Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute c… debianarchsuse
CVE-2019-17026 critical — 10.0 5y ago Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements. archdebian
CVE-2019-14204 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_umountall_reply. susedebian
CVE-2019-14203 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_mount_reply. susedebian
CVE-2019-14202 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_readlink_reply. susedebian
CVE-2019-14201 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_lookup_reply. susedebian
CVE-2019-14200 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: rpc_lookup_reply. susedebian
CVE-2019-14199 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer underflow during an *udp_packet_handler call. susedebian
CVE-2019-14198 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in the NFSv3 case. susedebian
CVE-2019-14196 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_lookup_reply. susedebian
CVE-2019-14195 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with unvalidated length at nfs_readlink_reply in the "else" block after calculating the new path length. susedebian
CVE-2019-14194 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in the NFSv2 case. susedebian
CVE-2019-14193 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with an unvalidated length at nfs_readlink_reply, in the "if" block after calculating the new path length. susedebian
CVE-2019-14192 critical 9.8 9.8 7y ago An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer underflow during an nc_input_packet call. susedebian
CVE-2019-13729 critical — 9.5 — Use-after-free in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2019-5758 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13727 critical — 9.5 — Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy via a crafted HTML page. archdebian
CVE-2019-0215 critical — 9.5 — multiple issues in apache debianarch
CVE-2019-11728 critical — 9.5 — The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that the accessible to a user when web content is loaded. This vulnerability affects F… archdebian
CVE-2019-13745 critical — 9.5 — Insufficient policy enforcement in audio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. archdebian
CVE-2019-13738 critical — 9.5 — Insufficient policy enforcement in navigation in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass site isolation via a crafted HTML page. archdebian
CVE-2019-13741 critical — 9.5 — Insufficient validation of untrusted input in Blink in Google Chrome prior to 79.0.3945.79 allowed a local attacker to bypass same origin policy via crafted clipboard content. archdebian
CVE-2019-11724 critical — 9.5 — Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been retired and now redirects to another site. This additional permission is unnece… archsusedebian
CVE-2019-13758 critical — 9.5 — Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. archdebian
CVE-2019-18511 critical — 9.5 — multiple issues in thunderbird arch
CVE-2019-9814 critical — 9.5 — Mozilla developers and community members reported memory safety bugs present in Firefox 66. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of… archsusedebian
CVE-2019-13763 critical — 9.5 — Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. archdebian
CVE-2019-13748 critical — 9.5 — Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML p… archdebian
CVE-2019-19923 critical — 9.5 — multiple issues in chromium archdebiansuse
CVE-2019-13739 critical — 9.5 — Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. archdebian
CVE-2019-11762 critical — 9.5 — If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This vulner… archdebian
CVE-2019-17016 critical — 9.5 — When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites re… archdebian
CVE-2019-11760 critical — 9.5 — A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox < 70, Thunderb… archdebian
CVE-2019-5818 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13742 critical — 9.5 — Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. archdebian
CVE-2019-17666 critical — 9.5 — rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow. archsusedebian
CVE-2019-5830 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13754 critical — 9.5 — Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. archdebian
CVE-2019-5819 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13764 critical — 9.5 — Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2019-5810 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5782 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13757 critical — 9.5 — Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. archdebian
CVE-2019-5778 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5783 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5777 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13767 critical — 9.5 — Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2019-5773 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5754 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5763 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5766 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5761 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5767 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-8942 critical — 9.5 — WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php su… archdebian
CVE-2019-5759 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5757 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13728 critical — 9.5 — Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2019-19926 critical — 9.5 — multiple issues in chromium archdebiansuse
CVE-2019-19925 critical — 9.5 — multiple issues in chromium archdebiansuse
CVE-2019-13759 critical — 9.5 — Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. archdebian
CVE-2019-13721 critical — 9.5 — arbitrary code execution in chromium archdebian
CVE-2019-13761 critical — 9.5 — Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. archdebian
CVE-2019-13725 critical — 9.5 — Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page. archdebian
CVE-2019-11759 critical — 9.5 — An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute arbitrary code or more likely lead to a c… archdebian
CVE-2019-5838 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-0217 critical — 9.5 — multiple issues in apache debianarchsuse
CVE-2019-5765 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-9811 critical — 9.5 — As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation. This v… archsusedebian
CVE-2019-5837 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5833 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5832 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5831 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5828 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5829 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5823 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5768 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5820 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5770 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13735 critical — 9.5 — Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. archdebian
CVE-2019-5839 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5813 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5814 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5809 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5835 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5805 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-9819 critical — 9.5 — A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefo… archsusedebian
CVE-2019-5780 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5771 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5807 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5840 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-5806 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-9821 critical — 9.5 — A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers. This results in a potentially exploitable crash. This vulnerability affects Firefox < 67. archsusedebian
CVE-2019-5779 critical — 9.5 — multiple issues in chromium archdebian
CVE-2019-13762 critical — 9.5 — Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof downloaded files via local code. archdebian
CVE-2019-5775 critical — 9.5 — multiple issues in chromium archdebian