Export limit exceeded: 425877 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 24818 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2019-13671

chromium-browser: Dialog box fails to show origin

UI spoofing in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof security UI via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2019-13670

chromium-browser: V8 memory corruption in regex

Insufficient data validation in JavaScript in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2019-13669

chromium-browser: HTTP authentication spoof

Incorrect data validation in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2019-13668

chromium-browser: Global window leak via console

Insufficient policy enforcement in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2019-13667

chromium-browser: URI bar spoof when using external app URIs

Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google Redhat
Products
Iphone Os Chrome Rhel Extras
CVE-2019-13666

chromium-browser: Side channel using storage size estimate

Information leak in storage in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2019-13665

chromium-browser: Multiple file download protection bypass

Insufficient filtering in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass multiple file download protection via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2019-13664

chromium-browser: CSRF bypass

Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2019-13663

chromium-browser: IDN spoof

IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2019-13662

chromium-browser: CSP bypass

Insufficient policy enforcement in navigations in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2019-13661

chromium-browser: Full screen notification spoof

UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2019-13660

chromium-browser: Full screen notification overlap

UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2019-13659

chromium-browser: URL spoof

IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2019-13648

kernel: denial of service in arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c via sigreturn() system call

In the Linux kernel through 5.2.1 on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Eus
CVE-2019-13638

patch: OS shell command injection when processing crafted patch files

GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.

CVSS 3.0 · 7.8 High EPSS 4.5% KEV · Not listed
Vendors
Debian Gnu Redhat
Products
Debian Linux Patch Enterprise Linux and 4 more
CVE-2019-13636

patch: the following of symlinks in inp.c and util.c is mishandled in cases other than input files

In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c.

CVSS 3.0 · 5.9 Medium EPSS 3.9% KEV · Not listed
Vendors
Gnu Redhat
Products
Patch Enterprise Linux
CVE-2019-13631

kernel: OOB writes in parse_hid_report_descriptor in drivers/input/tablet/gtco.c

In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages.

CVSS 3.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2019-13616

SDL: heap-based buffer overflow in SDL blit functions in video/SDL_blit*.c

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.

CVSS 3.1 · 8.1 High EPSS 3.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2019-13456

freeradius: eap-pwd: Information leak due to aborting when needing more than 10 iterations

In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is similar to the "Dragonblood" attack and CVE-2019-9494.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Freeradius Linux Opensuse and 1 more
Products
Freeradius Linux Kernel Leap and 1 more