Export limit exceeded: 17087 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,087

Export CSV
CVE-2019-14823

JSS: OCSP policy "Leaf and Chain" implicitly trusts the root certificate

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Jss Cryptomanager Project Linux Redhat
Products
Jss Cryptomanager Linux Kernel Enterprise Linux and 7 more
CVE-2019-14822

ibus: missing authorization allows local attacker to access the input bus of another user

A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is using the graphical interface, change the input method engine, or modify other input related configurations of the victim user.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Canonical Ibus Project Oracle and 1 more
Products
Ubuntu Linux Ibus Zfs Storage Appliance Kit and 2 more
CVE-2019-14821

Kernel: KVM: OOB memory access via mmio ring buffer

An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 38 more
CVE-2019-14818

dpdk: possible memory leak leads to denial of service

A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed
Vendors
Dpdk Fedoraproject Redhat
Products
Data Plane Development Kit Fedora Enterprise Linux and 4 more
CVE-2019-14817

ghostscript: Safer mode bypass by .forceput exposure in .pdfexectoken and other procedures (701450)

A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed
Vendors
Artifex Debian Fedoraproject and 2 more
Products
Ghostscript Debian Linux Fedora and 4 more
CVE-2019-14816

kernel: heap overflow in mwifiex_update_vs_ie() function of Marvell WiFi driver

There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 57 more
CVE-2019-14814

kernel: heap overflow in mwifiex_set_uap_rates() function of Marvell Wifi Driver leading to DoS

There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 3 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 47 more
CVE-2019-14813

ghostscript: Safer mode bypass by .forceput exposure in setsystemparams (701443)

A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

CVSS 3.1 · 9.8 Critical EPSS 11.0% KEV · Not listed
Vendors
Artifex Debian Fedoraproject and 2 more
Products
Ghostscript Debian Linux Fedora and 10 more
CVE-2019-14812

ghostscript: Safer mode bypass by .forceput exposure in setuserparams (701444)

A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

CVSS 3.1 · 7.8 High EPSS 2.5% KEV · Not listed
Vendors
Artifex Fedoraproject Redhat
Products
Ghostscript Fedora 3scale Amp and 1 more
CVE-2019-14811

ghostscript: Safer mode bypass by .forceput exposure in .pdf_hook_DSC_Creator (701445)

A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

CVSS 3.1 · 7.8 High EPSS 3.7% KEV · Not listed
Vendors
Artifex Debian Fedoraproject and 2 more
Products
Ghostscript Debian Linux Fedora and 4 more
CVE-2019-14809

golang: malformed hosts in URLs leads to authorization bypass

net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.

CVSS 3.0 · 9.8 Critical EPSS 8.4% KEV · Not listed
Vendors
Debian Golang Redhat
Products
Debian Linux Go Devtools and 1 more
CVE-2019-14744

kdelibs: malicious desktop files and configuration files lead to code execution with minimal user interaction

In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.

CVSS 3.1 · 7.8 High EPSS 4.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 7 more
CVE-2019-14615

kernel: Intel graphics card information leak.

Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor Graphics may allow an unauthenticated user to potentially enable information disclosure via local access.

CVSS 3.1 · 5.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Canonical Intel Redhat
Products
Ubuntu Linux Atom E3805 Atom E3805 Firmware and 707 more
CVE-2019-14584

edk2: NULL pointer dereference in AuthenticodeVerify()

Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Tianocore
Products
Enterprise Linux Edk2
CVE-2019-14559

edk2: memory leak in ArpOnFrameRcvdDpc

Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Redhat Tianocore
Products
Enterprise Linux Edk2
CVE-2019-14513

dnsmasq: Improper bounds checking leads to a buffer overread

Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that result in a read operation beyond the buffer allocated for the packet, a different vulnerability than CVE-2017-14491.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Debian Redhat Thekelleys
Products
Debian Linux Enterprise Linux Dnsmasq
CVE-2019-14494

poppler: divide-by-zero in function SplashOutputDev::tilingPatternFill in SplashOutputDev.cc

An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 2 more