CVE-2019-14846

ansible: secrets disclosed on logs when no_log enabled

In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Opensuse Redhat

Products

Debian Linux Backports Sle Leap and 3 more

CVE-2019-14835

kernel: vhost-net: guest to host kernel escape during migration

A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 5 more

Products

Ubuntu Linux Debian Linux Fedora and 46 more

CVE-2019-14823

JSS: OCSP policy "Leaf and Chain" implicitly trusts the root certificate

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Jss Cryptomanager Project Linux Redhat

Products

Jss Cryptomanager Linux Kernel Enterprise Linux and 7 more

CVE-2019-14821

Kernel: KVM: OOB memory access via mmio ring buffer

An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 5 more

Products

Ubuntu Linux Debian Linux Fedora and 38 more

CVE-2019-14816

kernel: heap overflow in mwifiex_update_vs_ie() function of Marvell WiFi driver

There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 57 more

CVE-2019-14815

kernel: heap-overflow in mwifiex_set_wmm_params() function of Marvell WiFi driver leading to DoS

A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marvell Wifi Driver.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel Altavault Baseboard Management Controller and 16 more

CVE-2019-14814

kernel: heap overflow in mwifiex_set_uap_rates() function of Marvell Wifi Driver leading to DoS

There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 3 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 47 more

CVE-2019-14813

ghostscript: Safer mode bypass by .forceput exposure in setsystemparams (701443)

A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

CVSS 3.1 · 9.8 Critical EPSS 11.0% KEV · Not listed

Vendors

Artifex Debian Fedoraproject and 2 more

Products

Ghostscript Debian Linux Fedora and 10 more

CVE-2019-14744

kdelibs: malicious desktop files and configuration files lead to code execution with minimal user interaction

In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.

CVSS 3.1 · 7.8 High EPSS 4.1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 7 more

CVE-2019-14287

sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

CVSS 3.1 · 8.8 High EPSS 63.8% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 18 more

CVE-2019-13764

chromium-browser: Type Confusion in V8

Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 6.4% KEV · Not listed

Vendors

Debian Fedoraproject Google and 3 more

Products

Debian Linux Fedora Chrome and 7 more

CVE-2019-13763

chromium-browser: Insufficient policy enforcement in payments

Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Debian Fedoraproject Google and 1 more

Products

Debian Linux Fedora Chrome and 5 more

CVE-2019-13762

chromium-browser: Insufficient policy enforcement in downloads

Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof downloaded files via local code.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Google and 2 more

Products

Debian Linux Fedora Chrome and 6 more

CVE-2019-13761

chromium-browser: Incorrect security UI in Omnibox

Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Debian Fedoraproject Google and 1 more

Products

Debian Linux Fedora Chrome and 5 more

CVE-2019-13759

chromium-browser: Incorrect security UI in interstitials

Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed

Vendors

Debian Fedoraproject Google and 1 more

Products

Debian Linux Fedora Chrome and 5 more

CVE-2019-13758

chromium-browser: Insufficient policy enforcement in navigation

Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Debian Fedoraproject Google and 1 more

Products

Debian Linux Fedora Android and 6 more

CVE-2019-13757

chromium-browser: Incorrect security UI in Omnibox

Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Debian Fedoraproject Google and 1 more

Products

Debian Linux Fedora Chrome and 5 more

CVE-2019-13756

chromium-browser: Incorrect security UI in printing

Incorrect security UI in printing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed

Vendors

Debian Fedoraproject Google and 1 more

Products

Debian Linux Fedora Chrome and 5 more

CVE-2019-13755

chromium-browser: Insufficient policy enforcement in extensions

Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to disable extensions via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Debian Fedoraproject Google and 1 more

Products

Debian Linux Fedora Chrome and 5 more

CVE-2019-13754

chromium-browser: Insufficient policy enforcement in extensions

Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed

Vendors

Debian Fedoraproject Google and 1 more

Products

Debian Linux Fedora Chrome and 5 more