CVEs from 2019
Total
3,163
critical
critical 238
high
high 485
medium
medium 485
low
low 94
% Critical
7.5%
% with KEV
3.7%
% with exploit
8.0%
Top vendors
- intel 246
- schneider-electric 117
- netapp 61
- siemens 58
- oracle 36
- hp 23
- denx 20
- phoenixcontact 9
Top products
- u-boot 20
- crimson 8
- active_iq_unified_manager 7
- weblogic_server 5
- jdk 5
- oncommand_workflow_automation 5
- codeready_linux_builder_eus 4
- oncommand_insight 4
| CVE | Severity | CVSS | Risk | Flags | OS | Vendor | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-12983 | unknown | — | — | — | ||||
| CVE-2019-13314 | unknown | — | — | — | ||||
| CVE-2019-7156 | unknown | — | — | — | In libdoc through 2019-01-28, calcFileBlockOffset in ole.c allows division by zero. | |||
| CVE-2019-16723 | unknown | — | — | — | In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter. | |||
| CVE-2019-18602 | unknown | — | — | — | OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to an information disclosure vulnerability because uninitialized scalars are sent over the network to a peer. | |||
| CVE-2019-2524 | unknown | — | — | — | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vuln… | |||
| CVE-2019-16236 | unknown | — | — | — | Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala. | |||
| CVE-2019-16094 | unknown | — | — | — | Symonics libmysofa 0.7 has an invalid read in readOHDRHeaderMessageDataLayout in hdf/dataobject.c. | |||
| CVE-2019-9032 | unknown | — | — | — | An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is an out-of-bounds write problem causing a SEGV in the function Mat_VarFree() in mat.c. | |||
| CVE-2019-19601 | unknown | — | — | — | OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of an incorrect sprintf. | |||
| CVE-2019-9589 | unknown | — | — | — | There is a NULL pointer dereference vulnerability in PSOutputDev::setupResources() located in PSOutputDev.cc in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdfto… | |||
| CVE-2019-3781 | unknown | — | — | — | ||||
| CVE-2019-18898 | unknown | — | — | — | ||||
| CVE-2019-11637 | unknown | — | — | — | An issue was discovered in GNU recutils 1.8. There is a NULL pointer dereference in the function rec_rset_get_props at rec-rset.c in librec.a, leading to a crash. | |||
| CVE-2019-6456 | unknown | — | — | — | An issue was discovered in GNU Recutils 1.8. There is a NULL pointer dereference in the function rec_fex_size() in the file rec-fex.c of librec.a. | |||
| CVE-2019-11638 | unknown | — | — | — | An issue was discovered in GNU recutils 1.8. There is a NULL pointer dereference in the function rec_field_name_equal_p at rec-field-name.c in librec.a, leading to a crash. | |||
| CVE-2019-12290 | unknown | — | — | — | GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to im… | |||
| CVE-2019-9502 | unknown | — | — | — | ||||
| CVE-2019-15639 | unknown | — | — | — | main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a crash in a specific scenario. | |||
| CVE-2019-18976 | unknown | — | — | — | An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line… | |||
| CVE-2019-15757 | unknown | — | — | — | ||||
| CVE-2019-7341 | unknown | — | — | — | Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitor[LinkedMonitors]' parameter value in th… | |||
| CVE-2019-7345 | unknown | — | — | — | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'options' (options.php) does no input validation for the WEB_TITLE, HOME_URL, HOME_CONTENT, or WEB_CONSOLE_BA… | |||
| CVE-2019-7342 | unknown | — | — | — | POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'filter[AutoExecuteCmd]' parameter value in the view fi… | |||
| CVE-2019-10895 | unknown | — | — | — | In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation. | |||
| CVE-2019-14874 | unknown | — | — | — | In the __i2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check is performed to verify if th… | |||
| CVE-2019-17542 | unknown | — | — | — | FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c. | |||
| CVE-2019-13687 | unknown | — | — | — | Use after free in Blink in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |||
| CVE-2019-9028 | unknown | — | — | — | An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a stack-based buffer over-read in the function InflateDimensions() in inflate.c when called from ReadNextCel… | |||
| CVE-2019-11481 | unknown | — | — | — | ||||
| CVE-2019-9038 | unknown | — | — | — | An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is an out-of-bounds read problem with a SEGV in the function ReadNextCell() in mat5.c. | |||
| CVE-2019-14655 | unknown | — | — | — | ||||
| CVE-2019-14465 | unknown | — | — | — | fmt_mtm_load_song in fmt/mtm.c in Schism Tracker 20190722 has a heap-based buffer overflow. | |||
| CVE-2019-14523 | unknown | — | — | — | An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a large plen in fmt_okt_load_song in the Amiga Oktalyzer parser in fmt/okt.c. | |||
| CVE-2019-14524 | unknown | — | — | — | An issue was discovered in Schism Tracker through 20190722. There is a heap-based buffer overflow via a large number of song patterns in fmt_mtm_load_song in fmt/mtm.c, a different vulnerability than… | |||
| CVE-2019-10900 | unknown | — | — | — | In Wireshark 3.0.0, the Rbm dissector could go into an infinite loop. This was addressed in epan/dissectors/file-rbm.c by handling unknown object types safely. | |||
| CVE-2019-13508 | unknown | — | — | — | FreeTDS through 1.1.11 has a Buffer Overflow. | |||
| CVE-2019-15522 | unknown | — | — | — | An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a failure of a hello command when the configuration requires use of SSL. | |||
| CVE-2019-15759 | unknown | — | — | — | An issue was discovered in Binaryen 1.38.32. Two visitors in ir/ExpressionManipulator.cpp can lead to a NULL pointer dereference in wasm::LocalSet::finalize in wasm/wasm.cpp. A crafted input can caus… | |||
| CVE-2019-7704 | unknown | — | — | — | wasm::WasmBinaryBuilder::readUserSection in wasm-binary.cpp in Binaryen 1.38.22 triggers an attempt at excessive memory allocation, as demonstrated by wasm-merge and wasm-opt. | |||
| CVE-2019-1786 | unknown | — | — | — | A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause … | |||
| CVE-2019-18901 | unknown | — | — | — | ||||
| CVE-2019-16237 | unknown | — | — | — | Dino before 2019-09-10 does not properly check the source of an MAM message in module/xep/0313_message_archive_management.vala. | |||
| CVE-2019-10079 | unknown | — | — | — | Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent from the client using the HTTP/2 protocol… | |||
| CVE-2019-17565 | unknown | — | — | — | There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encoding. Upgrade to versions 7.1.9 and 8.0.6 or later version… | |||
| CVE-2019-17559 | unknown | — | — | — | There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and scheme parsing. Upgrade to versions 7.1.9 and 8.0.6 or later versions. | |||
| CVE-2019-9070 | unknown | — | — | — | An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. It is a heap-based buffer over-read in d_expression_1 in cp-demangle.c after many recursive calls. | |||
| CVE-2019-10735 | unknown | — | — | — | In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/C… | |||
| CVE-2019-14274 | unknown | — | — | — | MCPP 2.7.2 has a heap-based buffer overflow in the do_msg() function in support.c. | |||
| CVE-2019-12216 | unknown | — | — | — | An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a heap-based buffer overflow in the SDL2_image… | |||
| CVE-2019-10269 | unknown | — | — | — | BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file. | |||
| CVE-2019-10178 | unknown | — | — | — | It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting (XSS) vulnerability. An unauthenticated a… | |||
| CVE-2019-15058 | unknown | — | — | — | stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information Disclosure or Denial of Service. | |||
| CVE-2019-12482 | unknown | — | — | — | An issue was discovered in GPAC 0.7.1. There is a NULL pointer dereference in the function gf_isom_get_original_format_type at isomedia/drm_sample.c in libgpac.a, as demonstrated by MP4Box. | |||
| CVE-2019-20022 | unknown | — | — | — | An invalid memory address dereference was discovered in load_pnm in frompnm.c in libsixel before 1.8.3. | |||
| CVE-2019-9495 | unknown | — | — | — | The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD suppo… | |||
| CVE-2019-20005 | unknown | — | — | — | An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted XML file, performs incorrect memory handling, leading to a heap-based buffer over-read while r… | |||
| CVE-2019-11834 | unknown | — | — | — | cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal. | |||
| CVE-2019-11835 | unknown | — | — | — | cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments. | |||
| CVE-2019-16091 | unknown | — | — | — | Symonics libmysofa 0.7 has an out-of-bounds read in directblockRead in hdf/fractalhead.c. | |||
| CVE-2019-2848 | unknown | — | — | — | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vul… | |||
| CVE-2019-3693 | unknown | — | — | — | ||||
| CVE-2019-3005 | unknown | — | — | — | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.34 and prior to 6.0.14. Easily exploitable vulnerab… | |||
| CVE-2019-16095 | unknown | — | — | — | Symonics libmysofa 0.7 has an invalid read in getDimension in hrtf/reader.c. | |||
| CVE-2019-19886 | unknown | — | — | — | Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming slow or unresponsive (Denial of Service… | |||
| CVE-2019-3684 | unknown | — | — | — | ||||
| CVE-2019-3683 | unknown | — | — | — | ||||
| CVE-2019-25018 | unknown | — | — | — | ||||
| CVE-2019-25544 | unknown | — | — | — | ||||
| CVE-2019-2566 | unknown | — | — | — | ||||
| CVE-2019-14975 | unknown | — | — | — | Artifex MuPDF before 1.16.0 has a heap-based buffer over-read in fz_chartorune in fitz/string.c because pdf/pdf-op-filter.c does not check for a missing string. | |||
| CVE-2019-7321 | unknown | — | — | — | Usage of an uninitialized variable in the function fz_load_jpeg in Artifex MuPDF 1.14 can result in a heap overflow vulnerability that allows an attacker to execute arbitrary code. | |||
| CVE-2019-13217 | unknown | — | — | — | A heap buffer overflow in the start_decoder function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or execute arbitrary code by opening a crafted Ogg Vorbis file. | |||
| CVE-2019-13218 | unknown | — | — | — | Division by zero in the predict_point function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file. | |||
| CVE-2019-17345 | unknown | — | — | — | An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check during the cleanup of… | |||
| CVE-2019-17347 | unknown | — | — | — | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because a guest can manipulate its virtualised %cr4 in a way that is incom… | |||
| CVE-2019-18420 | unknown | — | — | — | An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall. hypercall_create_continuation() is a variadic function whi… | |||
| CVE-2019-18421 | unknown | — | — | — | An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations. There are issues … | |||
| CVE-2019-19577 | unknown | — | — | — | An issue was discovered in Xen through 4.12.x allowing x86 AMD HVM guest OS users to cause a denial of service or possibly gain privileges by triggering data-structure access during pagetable-height … | |||
| CVE-2019-19582 | unknown | — | — | — | An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service (infinite loop) because certain bit iteration is mishandled. In a number of places bitmaps are b… | |||
| CVE-2019-11249 | unknown | — | — | — | The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over t… | |||
| CVE-2019-9151 | unknown | — | — | — | An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5VM_memcpyvv in H5VM.c when called from H5D__compact_readvv in H5Dcompact.c. | |||
| CVE-2019-9152 | unknown | — | — | — | An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5MM_xstrdup in H5MM.c when called from H5O_dtype_decode_helper in H5Odtype.c. | |||
| CVE-2019-10052 | unknown | — | — | — | An issue was discovered in Suricata 4.1.3. If the network packet does not have the right length, the parser tries to access a part of a DHCP packet. At this point, the Rust environment runs into a pa… | |||
| CVE-2019-10054 | unknown | — | — | — | An issue was discovered in Suricata 4.1.3. The function process_reply_record_v3 lacks a check for the length of reply.data. It causes an invalid memory access and the program crashes within the nfs/n… | |||
| CVE-2019-19555 | unknown | — | — | — | read_textobject in read.c in Xfig fig2dev 3.2.7b has a stack-based buffer overflow because of an incorrect sscanf. | |||
| CVE-2019-13288 | unknown | — | — | — | In Xpdf 4.01.01, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. This is similar to CVE-2018-16646. | |||
| CVE-2019-25136 | unknown | — | — | — | A compromised child process could have injected XBL Bindings into privileged CSS rules, resulting in arbitrary code execution and a sandbox escape. This vulnerability affects Firefox < 70. | |||
| CVE-2019-6976 | unknown | — | — | — | libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can resul… | |||
| CVE-2019-2506 | unknown | — | — | — | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vuln… | |||
| CVE-2019-16375 | unknown | — | — | — | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.11, and Community Edition 5.0.x through 5.0.37 and 6.0.x through 6.0.22. An attacker who is logged in as an agent or cus… | |||
| CVE-2019-9751 | unknown | — | — | — | An issue was discovered in Open Ticket Request System (OTRS) 6.x before 6.0.17 and 7.x before 7.0.5. An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of … | |||
| CVE-2019-18902 | unknown | — | — | — | ||||
| CVE-2019-19638 | unknown | — | — | — | An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function load_pnm at frompnm.c, due to an integer overflow. | |||
| CVE-2019-9496 | unknown | — | — | — | An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version o… | |||
| CVE-2019-5062 | unknown | — | — | — | An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association… | |||
| CVE-2019-2450 | unknown | — | — | — | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vuln… | |||
| CVE-2019-2448 | unknown | — | — | — | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vuln… | |||
| CVE-2019-20140 | unknown | — | — | — | An issue was discovered in libsixel 1.8.4. There is a heap-based buffer overflow in the function gif_out_code at fromgif.c. | |||
| CVE-2019-6461 | unknown | — | — | — | An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c. |