Export limit exceeded: 10244 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,244

Export CSV
CVE-2019-14369

exiv2: Heap-based buffer over-read in Exiv2::PngImage::readMetadata() in pngimage.cpp

Exiv2::PngImage::readMetadata() in pngimage.cpp in Exiv2 0.27.99.0 allows attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Exiv2
Products
Debian Linux Exiv2
CVE-2019-14287

sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

CVSS 3.1 · 8.8 High EPSS 63.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 18 more
CVE-2019-14271

docker: nsswitch based config loaded inside chroot under Glibc

In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.

CVSS 3.1 · 9.8 Critical EPSS 18.8% KEV · Not listed
Vendors
Debian Docker Opensuse
Products
Debian Linux Docker Leap
CVE-2019-14234

Django: SQL injection possibility in key and index lookups for JSONField/HStoreField

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.

CVSS 3.0 · 9.8 Critical EPSS 47.7% KEV · Not listed
Vendors
Debian Djangoproject Fedoraproject and 1 more
Products
Debian Linux Django Fedora and 1 more
CVE-2019-13917

exim: ${sort} in configuration leads to privilege escalation

Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g., $local_part or $domain).

CVSS 3.0 · 9.8 Critical EPSS 8.6% KEV · Not listed
Vendors
Debian Exim
Products
Debian Linux Exim
CVE-2019-13767

chromium-browser: Use after free in media picker

Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 15.5% KEV · Not listed
Vendors
Debian Fedoraproject Google and 2 more
Products
Debian Linux Fedora Chrome and 2 more
CVE-2019-13764

chromium-browser: Type Confusion in V8

Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 6.4% KEV · Not listed
Vendors
Debian Fedoraproject Google and 3 more
Products
Debian Linux Fedora Chrome and 7 more
CVE-2019-13763

chromium-browser: Insufficient policy enforcement in payments

Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Chrome and 5 more
CVE-2019-13762

chromium-browser: Insufficient policy enforcement in downloads

Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof downloaded files via local code.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Google and 2 more
Products
Debian Linux Fedora Chrome and 6 more
CVE-2019-13761

chromium-browser: Incorrect security UI in Omnibox

Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Chrome and 5 more
CVE-2019-13759

chromium-browser: Incorrect security UI in interstitials

Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Chrome and 5 more
CVE-2019-13758

chromium-browser: Insufficient policy enforcement in navigation

Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Android and 6 more
CVE-2019-13757

chromium-browser: Incorrect security UI in Omnibox

Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Chrome and 5 more
CVE-2019-13756

chromium-browser: Incorrect security UI in printing

Incorrect security UI in printing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Chrome and 5 more
CVE-2019-13755

chromium-browser: Insufficient policy enforcement in extensions

Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to disable extensions via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Chrome and 5 more
CVE-2019-13754

chromium-browser: Insufficient policy enforcement in extensions

Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Chrome and 5 more
CVE-2019-13753

sqlite: fts3: incorrectly removed corruption check

Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 7 more
CVE-2019-13752

sqlite: fts3: improve shadow table corruption detection

Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 7 more
CVE-2019-13751

sqlite: fts3: improve detection of corrupted records

Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 7 more