Export limit exceeded: 425894 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2019-7573

SDL: heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (inside the wNumCoef loop).

CVSS 3.1 · 8.8 High EPSS 3.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2019-7524

dovecot: Buffer overflow in indexer-worker process results in privilege escalation

In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components.

CVSS 3.0 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Dovecot and 2 more
Products
Ubuntu Linux Debian Linux Dovecot and 2 more
CVE-2019-7310

poppler: heap-based buffer over-read in XRef::getEntry in XRef.cc

In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.

CVSS 3.1 · 7.8 High EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 8 more
CVE-2019-7292

webkitgtk: arbitrary code execution via malicious web content

A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may result in the disclosure of process memory.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Apple Redhat
Products
Icloud Iphone Os Itunes and 4 more
CVE-2019-7285

webkitgtk: crafted web content leads to arbitrary code execution

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.1% KEV · Not listed
Vendors
Apple Redhat
Products
Icloud Iphone Os Itunes and 3 more
CVE-2019-7164

python-sqlalchemy: SQL Injection when the order_by parameter can be controlled

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Debian Opensuse Oracle and 2 more
Products
Debian Linux Backports Sle Leap and 6 more
CVE-2019-7150

elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c

An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Canonical Debian Elfutils Project and 2 more
Products
Ubuntu Linux Debian Linux Elfutils and 9 more
CVE-2019-7149

elfutils: heap-based buffer over-read in read_srclines in dwarf_getsrclines.c in libdw

A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm.

CVSS 3.0 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Debian Elfutils Project Redhat
Products
Debian Linux Elfutils Ansible Tower and 1 more
CVE-2019-7146

elfutils: buffer over-read in the ebl_object_note function in eblobjnote.c in libebl

In elfutils 0.175, there is a buffer over-read in the ebl_object_note function in eblobjnote.c in libebl. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted elf file, as demonstrated by eu-readelf.

CVSS 3.0 · 5.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Elfutils Project Redhat
Products
Elfutils Enterprise Linux
CVE-2019-7108

flash-plugin: Information Disclosure vulnerability (APSB19-19)

Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 6 more
CVE-2019-7096

flash-plugin: Arbitrary Code Execution vulnerability (APSB19-19)

Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 9.8 Critical EPSS 6.2% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 6 more
CVE-2019-7090

flash-plugin: Information Disclosure vulnerability (APSB19-06)

Flash Player Desktop Runtime versions 32.0.0.114 and earlier, Flash Player for Google Chrome versions 32.0.0.114 and earlier, and Flash Player for Microsoft Edge and Internet Explorer 11 versions 32.0.0.114 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.

CVSS 3.0 · 6.5 Medium EPSS 4.8% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Macos and 6 more
CVE-2019-6978

gd: Double free in the gdImage*Ptr in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c

The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.

CVSS 3.0 · 9.8 Critical EPSS 4.5% KEV · Not listed
Vendors
Canonical Debian Libgd and 1 more
Products
Ubuntu Linux Debian Linux Libgd and 1 more