Export limit exceeded: 17087 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,087

Export CSV
CVE-2019-9824

QEMU: slirp: information leakage in tcp_emu() due to uninitialized stack variables

tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Openstack and 1 more
CVE-2019-9820

Mozilla: Use-after-free of ChromeEventHandler by DocShell

A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

CVSS 3.0 · 9.8 Critical EPSS 1.6% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 1 more
CVE-2019-9819

Mozilla: Compartment mismatch with fetch API

A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

CVSS 3.0 · 9.8 Critical EPSS 1.7% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 1 more
CVE-2019-9817

Mozilla: Stealing of cross-domain images using canvas

Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

CVSS 3.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 1 more
CVE-2019-9816

Mozilla: Type confusion with object groups and UnboxedObjects

A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

CVSS 3.0 · 5.9 Medium EPSS 6.2% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 1 more
CVE-2019-9811

Mozilla: Sandbox escape via installation of malicious language pack

As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

CVSS 3.1 · 8.3 High EPSS 2.6% KEV · Not listed
Vendors
Debian Mozilla Novell and 2 more
Products
Debian Linux Firefox Firefox Esr and 4 more
CVE-2019-9800

Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7

Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

CVSS 3.0 · 9.8 Critical EPSS 1.7% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 1 more
CVE-2019-9797

Mozilla: Cross-origin theft of images with createImageBitmap

Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox < 66.

CVSS 3.0 · 5.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Enterprise Linux
CVE-2019-9795

Mozilla: Type-confusion in IonMonkey JIT compiler

A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to trigger a potentially exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.

CVSS 3.0 · 9.8 Critical EPSS 1.7% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 1 more
CVE-2019-9793

Mozilla: Improper bounds checks when Spectre mitigations are disabled

A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an attacker to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully controlled, incorrect range in circumstances where users have explicitly disabled Spectre mitigations. *Note: Spectre mitigations are currently enabled for all users by default settings.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.

CVSS 3.0 · 5.9 Medium EPSS 1.6% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 1 more
CVE-2019-9755

ntfs-3g: heap-based buffer overflow leads to local root privilege escalation

An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Redhat Tuxera
Products
Advanced Virtualization Enterprise Linux Enterprise Linux Eus and 4 more
CVE-2019-9741

golang: CRLF injection in net/http

An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.

CVSS 3.1 · 6.1 Medium EPSS 2.2% KEV · Not listed
Vendors
Debian Fedoraproject Golang and 1 more
Products
Debian Linux Fedora Go and 3 more
CVE-2019-9639

php: Uninitialized read in exif_process_IFD_in_MAKERNOTE

An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len variable.

CVSS 3.1 · 7.5 High EPSS 8.2% KEV · Not listed
Vendors
Canonical Debian Netapp and 3 more
Products
Ubuntu Linux Debian Linux Storage Automation Store and 5 more
CVE-2019-9638

php: Uninitialized read in exif_process_IFD_in_MAKERNOTE

An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the maker_note->offset relationship to value_len.

CVSS 3.1 · 7.5 High EPSS 6.7% KEV · Not listed
Vendors
Canonical Debian Netapp and 3 more
Products
Ubuntu Linux Debian Linux Storage Automation Store and 5 more
CVE-2019-9637

php: File rename across filesystems may allow unwanted access during processing

An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data.

CVSS 3.0 · 7.5 High EPSS 7.3% KEV · Not listed
Vendors
Canonical Debian Netapp and 3 more
Products
Ubuntu Linux Debian Linux Storage Automation Store and 4 more
CVE-2019-9631

poppler: heap-based buffer over-read in function downsample_row_box_filter in CairoRescaleBox.cc

Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.

CVSS 3.0 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Debian Fedoraproject Freedesktop and 1 more
Products
Debian Linux Fedora Poppler and 1 more
CVE-2019-9512

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

CVSS 3.1 · 7.5 High EPSS 83.4% KEV · Not listed
Vendors
Apache Apple Canonical and 3 more
Products
Traffic Server Mac Os X Swiftnio and 21 more
CVE-2019-9506

Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation

The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.

CVSS 3.1 · 8.1 High EPSS 2.9% KEV · Not listed
Vendors
Apple Blackberry Canonical and 5 more
Products
Iphone Os Mac Os X Tvos and 277 more
CVE-2019-9503

Broadcom brcmfmac driver is vulnerable to a frame validation bypass

The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this frame to be discarded and unprocessed. If the driver receives the firmware event frame from the host, the appropriate handler is called. This frame validation can be bypassed if the bus used is USB (for instance by a wifi dongle). This can allow firmware event frames from a remote source to be processed. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.

CVSS 3.1 · 7.9 High EPSS 3.3% KEV · Not listed
Vendors
Broadcom Redhat
Products
Brcmfmac Driver Enterprise Linux Rhel Eus and 1 more