Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,404

Export CSV
CVE-2019-8763

webkitgtk: Multiple memory corruption issues leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.1 and iPadOS 13.1, tvOS 13, Safari 13.0.1, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Apple Redhat
Products
Icloud Ipados Iphone Os and 4 more
CVE-2019-20044

zsh: insecure dropping of privileges when unsetting PRIVILEGED option

In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 3 more
Products
Ipados Iphone Os Mac Os X and 9 more
CVE-2019-15126

linux-firmware: Transmission of data encrypted with an all-zero session key after disassociation

An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.

CVSS 3.1 · 3.1 Low EPSS 7.3% KEV · Not listed
Vendors
Apple Broadcom
Products
Ipados Iphone Os Mac Os X and 12 more
CVE-2019-14899

VPN: an attacker can inject data into the TCP stream which allows a hijack of active connections inside the VPN tunnel

A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user, to determine if a connected user is using a VPN, make positive inferences about the websites they are visiting, and determine the correct sequence and acknowledgement numbers in use, allowing the bad actor to inject data into the TCP stream. This provides everything that is needed for an attacker to hijack active connections inside the VPN tunnel.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Apple Freebsd Linux and 1 more
Products
Ipados Iphone Os Mac Os X and 5 more