2019 CVEs (page 50)
Page 50 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-13717 | Medium | 4.3 | 2019-11-25 | Incorrect security UI in full screen mode in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to hide security UI via a crafted HTML page. |
CVE-2019-13716 | Medium | 4.3 | 2019-11-25 | Insufficient policy enforcement in service workers in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass navigation restrictions via a cra… |
CVE-2019-13715 | Medium | 4.3 | 2019-11-25 | Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to perform domain spoofing via IDN homog… |
CVE-2019-13714 | Medium | 6.1 | 2019-11-25 | Insufficient validation of untrusted input in Color Enhancer extension in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to inject CSS into an H… |
CVE-2019-13713 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to leak cross-origin data via a crafted HTML pag… |
CVE-2019-13711 | Medium | 5.3 | 2019-11-25 | Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to leak cross-origin data via a crafted HTML pag… |
CVE-2019-13710 | Medium | 4.3 | 2019-11-25 | Insufficient validation of untrusted input in downloads in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass download restrictions via a… |
CVE-2019-13709 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in downloads in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass download restrictions via a crafted HTM… |
CVE-2019-13708 | Medium | 4.3 | 2019-11-25 | Inappropriate implementation in navigation in Google Chrome on iOS prior to 78.0.3904.70 allowed a remote attacker to spoof the contents of the Omnibox (URL ba… |
CVE-2019-13707 | Medium | 5.5 | 2019-11-25 | Insufficient validation of untrusted input in intents in Google Chrome on Android prior to 78.0.3904.70 allowed a local attacker to leak files via a crafted ap… |
CVE-2019-13706 | High | 7.8 | 2019-11-25 | Out of bounds memory access in PDFium in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF… |
CVE-2019-13705 | Medium | 4.3 | 2019-11-25 | Insufficient policy enforcement in extensions in Google Chrome prior to 78.0.3904.70 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2019-13704 | Medium | 4.3 | 2019-11-25 | Insufficient policy enforcement in navigation in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass content security policy via a crafted… |
CVE-2019-13703 | Medium | 4.3 | 2019-11-25 | Insufficient policy enforcement in the Omnibox in Google Chrome on Android prior to 78.0.3904.70 allowed a remote attacker to spoof the contents of the Omnibox… |
CVE-2019-13702 | High | 7.8 | 2019-11-25 | Inappropriate implementation in installer in Google Chrome on Windows prior to 78.0.3904.70 allowed a local attacker to perform privilege escalation via a craf… |
CVE-2019-13701 | Medium | 4.3 | 2019-11-25 | Incorrect implementation in navigation in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a cr… |
CVE-2019-13700 | High | 8.8 | 2019-11-25 | Out of bounds memory access in the gamepad API in Google Chrome prior to 78.0.3904.70 allowed a remote attacker who had compromised the renderer process to pot… |
CVE-2019-13699 | High | 8.8 | 2019-11-25 | Use after free in media in Google Chrome prior to 78.0.3904.70 allowed a remote attacker who had compromised the renderer process to potentially exploit heap c… |
CVE-2019-13698 | High | 8.8 | 2019-11-25 | Out of bounds memory access in JavaScript in Google Chrome prior to 73.0.3683.103 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2019-13697 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in performance APIs in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2019-13696 | High | 8.8 | 2019-11-25 | Use after free in JavaScript in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13695 | High | 8.8 | 2019-11-25 | Use after free in audio in Google Chrome on Android prior to 77.0.3865.120 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2019-13694 | High | 8.8 | 2019-11-25 | Use after free in WebRTC in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13693 | High | 8.8 | 2019-11-25 | Use after free in IndexedDB in Google Chrome prior to 77.0.3865.120 allowed a remote attacker who had compromised the renderer process to execute arbitrary cod… |
CVE-2019-13692 | High | 8.8 | 2019-11-25 | Insufficient policy enforcement in reader mode in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML pag… |
CVE-2019-13691 | Medium | 4.3 | 2019-11-25 | Insufficient validation of untrusted input in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox… |
CVE-2019-13688 | High | 8.8 | 2019-11-25 | Use after free in Blink in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13687 | High | 8.8 | 2019-11-25 | Use after free in Blink in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13686 | High | 8.8 | 2019-11-25 | Use after free in offline mode in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13685 | High | 8.8 | 2019-11-25 | Use after free in sharing view in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13684 | Medium | 5.3 | 2019-11-25 | Inappropriate implementation in JavaScript in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-13683 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTM… |
CVE-2019-13682 | High | 8.8 | 2019-11-25 | Insufficient policy enforcement in external protocol handling in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass same origin policy via… |
CVE-2019-13681 | Medium | 4.3 | 2019-11-25 | Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass download restrictions via a crafted HTML p… |
CVE-2019-13680 | Medium | 5.3 | 2019-11-25 | Inappropriate implementation in TLS in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof client IP address to websites via crafted TLS con… |
CVE-2019-13679 | Low | 3.3 | 2019-11-25 | Insufficient policy enforcement in PDFium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to show print dialogs via a crafted PDF file. |
CVE-2019-13678 | Medium | 6.5 | 2019-11-25 | Incorrect data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-13677 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in site isolation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML… |
CVE-2019-13676 | Medium | 4.3 | 2019-11-25 | Insufficient policy enforcement in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-13675 | Medium | 4.3 | 2019-11-25 | Insufficient data validation in extensions in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to disable extensions via a crafted HTML page. |
CVE-2019-13674 | Medium | 4.3 | 2019-11-25 | IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain nam… |
CVE-2019-13673 | High | 7.4 | 2019-11-25 | Insufficient data validation in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML p… |
CVE-2019-13671 | Medium | 4.3 | 2019-11-25 | UI spoofing in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2019-13670 | Medium | 6.5 | 2019-11-25 | Insufficient data validation in JavaScript in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2019-13669 | Medium | 4.3 | 2019-11-25 | Incorrect data validation in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c… |
CVE-2019-13668 | High | 7.4 | 2019-11-25 | Insufficient policy enforcement in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTM… |
CVE-2019-13667 | Medium | 4.3 | 2019-11-25 | Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar)… |
CVE-2019-13666 | High | 7.4 | 2019-11-25 | Information leak in storage in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-13665 | Medium | 6.5 | 2019-11-25 | Insufficient filtering in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass multiple file download protection via a crafted HTML… |
CVE-2019-13664 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML… |
CVE-2019-13663 | Medium | 4.3 | 2019-11-25 | IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain nam… |
CVE-2019-13662 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in navigations in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted… |
CVE-2019-13661 | Medium | 4.3 | 2019-11-25 | UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page. |
CVE-2019-13660 | Medium | 5.3 | 2019-11-25 | UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page. |
CVE-2019-13659 | Medium | 4.3 | 2019-11-25 | IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain nam… |
CVE-2019-10213 | Medium | 6.5 | 2019-11-25 | OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or… |
CVE-2019-18675 | High | 7.8 | 2019-11-25 | The Linux kernel through 5.3.13 has a start_offset+size Integer Overflow in cpia2_remap_buffer in drivers/media/usb/cpia2/cpia2_core.c because cpia2 has its ow… |
CVE-2019-10207 | Medium | 5.5 | 2019-11-25 | A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and kernel 5.x.x. An attacker with local acces… |
CVE-2019-14822 | High | 7.1 | 2019-11-25 | A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due… |
CVE-2019-14891 | Medium | 5.0 | 2019-11-25 | A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can result in container management (conmon) pr… |
CVE-2019-14815 | High | 7.8 | 2019-11-25 | A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marvell Wifi Driver. |
CVE-2019-10214 | Medium | 5.9 | 2019-11-25 | The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Pla… |
CVE-2019-10174 | High | 8.8 | 2019-11-25 | A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke priva… |
CVE-2019-11287 | High | 7.5 | 2019-11-23 | Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versio… |
CVE-2019-11291 | Medium | 4.8 | 2019-11-22 | Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prio… |
CVE-2019-18910 | Medium | 6.8 | 2019-11-22 | The Citrix Receiver wrapper function does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute wit… |
CVE-2019-18909 | High | 8.0 | 2019-11-22 | The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with… |
CVE-2019-16287 | Medium | 6.8 | 2019-11-22 | In HP ThinPro Linux 6.2, 6.2.1, 7.0 and 7.1, an attacker may be able to leverage the application filter bypass vulnerability to gain privileged access to creat… |
CVE-2019-16286 | Medium | 6.8 | 2019-11-22 | An attacker may be able to bypass the OS application filter meant to restrict applications that can be executed by changing browser preferences to launch a sep… |
CVE-2019-16285 | Medium | 4.6 | 2019-11-22 | If a local user has been configured and logged in, an unauthenticated attacker with physical access may be able to extract sensitive information onto a local d… |
CVE-2019-15593 | Medium | 6.5 | 2019-11-22 | GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Commen… |
CVE-2019-18622 | Critical | 9.8 | 2019-11-22 | An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature. |
CVE-2019-13566 | Critical | 9.8 | 2019-11-22 | An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. A buffer overflow allows attackers to… |
CVE-2019-3654 | Medium | 5.3 | 2019-11-22 | Authentication Bypass vulnerability in the Microsoft Windows client in McAfee Client Proxy (MCP) prior to 3.0.0 allows local user to bypass scanning of web tra… |
CVE-2019-19240 | Medium | 5.3 | 2019-11-22 | Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. The GoAhead WebsRedirect uses a static host buffer that has a limi… |
CVE-2019-16763 | Medium | 4.8 | 2019-11-22 | In Pannellum from 2.5.0 through 2.5.4 URLs were not sanitized for data URIs (or vbscript:), allowing for potential XSS attacks. Such an attack would require a… |
CVE-2019-9536 | Medium | 6.1 | 2019-11-22 | Apple iPhone 3GS bootrom malloc implementation returns a non-NULL pointer when unable to allocate memory, aka 'alloc8'. An attacker with physical access to the… |
CVE-2019-18610 | High | 8.8 | 2019-11-22 | An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Aste… |
CVE-2019-17446 | High | 7.8 | 2019-11-22 | An issue was discovered in Eracent EPA Agent through 10.2.26. The agent executable, when installed for non-root operations (scanning), can be used to start ext… |
CVE-2019-17445 | Medium | 5.5 | 2019-11-22 | An issue was discovered in Eracent EDA, EPA, EPM, EUA, FLW, and SUM Agent through 10.2.26. The agent executable, when installed for non-root operations (scanni… |
CVE-2019-15652 | Medium | 6.1 | 2019-11-22 | The web interface for NSSLGlobal SatLink VSAT Modem Unit (VMU) devices before 18.1.0 doesn't properly sanitize input for error messages, leading to the ability… |
CVE-2019-18976 | High | 7.5 | 2019-11-22 | An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38… |
CVE-2019-18790 | Medium | 6.5 | 2019-11-22 | An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.2… |
CVE-2019-4570 | Medium | 5.3 | 2019-11-22 | IBM Tivoli Netcool Impact 7.1.0 through 7.1.0.16 generates an error message that includes sensitive information about its environment, users, or associated dat… |
CVE-2019-4569 | Medium | 5.4 | 2019-11-22 | IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.16 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2019-4243 | Medium | 4.4 | 2019-11-22 | IBM SmartCloud Analytics 1.3.1 through 1.3.5 allows unauthorized disclosure of information like accessing solrconfig.xml and could allow an attacker to perform… |
CVE-2019-4216 | Medium | 4.6 | 2019-11-22 | IBM SmartCloud Analytics 1.3.1 through 1.3.5 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass… |
CVE-2019-4215 | Medium | 6.1 | 2019-11-22 | IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malic… |
CVE-2019-4214 | Low | 3.7 | 2019-11-22 | IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obta… |
CVE-2019-3428 | Medium | 6.5 | 2019-11-22 | The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a configuration error vulnerability. An attacker could directly access the management portal… |
CVE-2019-3427 | High | 7.2 | 2019-11-22 | The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a code injection vulnerability. An attacker could exploit the vulnerability to inject malici… |
CVE-2019-19013 | High | 8.8 | 2019-11-22 | A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request. |
CVE-2019-19227 | Medium | 5.5 | 2019-11-22 | In the AppleTalk subsystem in the Linux kernel before 5.1, there is a potential NULL pointer dereference because register_snap_client may return NULL. This wil… |
CVE-2019-10206 | Medium | 6.5 | 2019-11-22 | ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding… |
CVE-2019-10203 | Medium | 4.3 | 2019-11-22 | PowerDNS Authoritative daemon , pdns versions 4.0.x before 4.0.9, 4.1.x before 4.1.11, exiting when encountering a serial between 2^31 and 2^32-1 while trying… |
CVE-2019-13157 | High | 7.5 | 2019-11-22 | nsGreen.dll in Naver Vaccine 2.1.4 allows remote attackers to overwrite arbitary files via directory traversal sequences in a filename within nsz archive. |
CVE-2019-19221 | Medium | 5.5 | 2019-11-21 | In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example… |
CVE-2019-18933 | Critical | 9.8 | 2019-11-21 | In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentica… |
CVE-2019-18889 | Critical | 9.8 | 2019-11-21 | An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could resu… |
CVE-2019-18888 | High | 7.5 | 2019-11-21 | An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalida… |