Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-4119 | 1 Ibm | 1 Cloud Private | 2022-01-01 | 5.0 MEDIUM | 5.3 MEDIUM |
| IBM Cloud Private Kubernetes API server 2.1.0, 3.1.0, 3.1.1, and 3.1.2 can be used as an HTTP proxy to not only cluster internal but also external target IP addresses. IBM X-Force ID: 158145. | |||||
| CVE-2019-9900 | 2 Envoyproxy, Redhat | 2 Envoy, Openshift Service Mesh | 2022-01-01 | 7.5 HIGH | 8.3 HIGH |
| When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources. | |||||
| CVE-2019-4055 | 1 Ibm | 2 Mq, Mq Appliance | 2022-01-01 | 5.0 MEDIUM | 7.5 HIGH |
| IBM MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, and 9.1.0.0 through 9.1.1 is vulnerable to a denial of service attack within the TLS key renegotiation function. IBM X-Force ID: 156564. | |||||
| CVE-2019-3719 | 1 Dell | 1 Supportassist | 2022-01-01 | 7.9 HIGH | 8.0 HIGH |
| Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites. | |||||
| CVE-2019-8989 | 1 Tibco | 2 Data Science For Aws, Spotfire Data Science | 2022-01-01 | 4.0 MEDIUM | 4.3 MEDIUM |
| The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a vulnerability that theoretically enables a user to spoof their account to look like a different user in the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Science for AWS: versions up to and including 6.4.0, and TIBCO Spotfire Data Science: versions up to and including 6.4.0. | |||||
| CVE-2019-0204 | 2 Apache, Redhat | 2 Mesos, Fuse | 2022-01-01 | 9.3 HIGH | 7.8 HIGH |
| A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, and 1.7.0 to 1.7.1. A malicious actor can therefore gain root-level code execution on the host. | |||||
| CVE-2019-4035 | 1 Ibm | 1 Content Navigator | 2022-01-01 | 4.9 MEDIUM | 5.4 MEDIUM |
| IBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site. If attackers make a fake IBM Content Navigator site, they can send a link to ICN users to send request to their Edit client directly. Then Edit client will download documents from the fake ICN website. IBM X-Force ID: 156001. | |||||
| CVE-2019-4034 | 1 Ibm | 1 Content Navigator | 2022-01-01 | 6.5 MEDIUM | 8.8 HIGH |
| IBM Content Navigator 3.0CD is could allow an attacker to execute arbitrary code on a user's workstation. When editing an executable file in ICN with Edit service, it will be executed on the user's workstation. IBM X-Force ID: 156000. | |||||
| CVE-2019-8986 | 1 Tibco | 1 Jasperreports Server | 2022-01-01 | 4.0 MEDIUM | 7.7 HIGH |
| The SOAP API component vulnerability of TIBCO Software Inc.'s TIBCO JasperReports Server, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that may allow a malicious authenticated user to copy text files from the host operating system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3. | |||||
| CVE-2019-7006 | 1 Avaya | 1 One-x Communicator | 2022-01-01 | 2.1 LOW | 5.5 MEDIUM |
| Avaya one-X Communicator uses weak cryptographic algorithms in the client authentication component that could allow a local attacker to decrypt sensitive information. Affected versions include all 6.2.x versions prior to 6.2 SP13. | |||||
| CVE-2019-5879 | 1 Google | 1 Chrome | 2022-01-01 | 4.3 MEDIUM | 6.5 MEDIUM |
| Insufficient policy enforcement in extensions in Google Chrome prior to 77.0.3865.75 allowed an attacker who convinced a user to install a malicious extension to read local files via a crafted Chrome Extension. | |||||
| CVE-2019-13713 | 2 Google, Opensuse | 2 Chrome, Backports | 2022-01-01 | 4.3 MEDIUM | 6.5 MEDIUM |
| Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | |||||
| CVE-2019-13711 | 2 Google, Opensuse | 2 Chrome, Backports | 2022-01-01 | 5.0 MEDIUM | 5.3 MEDIUM |
| Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | |||||
| CVE-2019-13707 | 2 Google, Opensuse | 2 Chrome, Backports | 2022-01-01 | 4.3 MEDIUM | 5.5 MEDIUM |
| Insufficient validation of untrusted input in intents in Google Chrome on Android prior to 78.0.3904.70 allowed a local attacker to leak files via a crafted application. | |||||
| CVE-2019-13705 | 2 Google, Opensuse | 2 Chrome, Backports | 2022-01-01 | 4.3 MEDIUM | 4.3 MEDIUM |
| Insufficient policy enforcement in extensions in Google Chrome prior to 78.0.3904.70 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. | |||||
| CVE-2019-18910 | 2 Hp, Linux | 2 Thinpro, Linux Kernel | 2022-01-01 | 4.6 MEDIUM | 6.8 MEDIUM |
| The Citrix Receiver wrapper function does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with local user privileges. | |||||
| CVE-2019-18909 | 2 Hp, Linux | 2 Thinpro, Linux Kernel | 2022-01-01 | 7.7 HIGH | 8.0 HIGH |
| The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with root privileges. | |||||
| CVE-2019-5695 | 2 Microsoft, Nvidia | 3 Windows, Geforce Experience, Gpu Driver | 2022-01-01 | 6.9 MEDIUM | 6.5 MEDIUM |
| NVIDIA GeForce Experience (prior to 3.20.1) and Windows GPU Display Driver (all versions) contains a vulnerability in the local service provider component in which an attacker with local system and privileged access can incorrectly load Windows system DLLs without validating the path or signature (also known as a binary planting or DLL preloading attack), which may lead to denial of service or information disclosure through code execution. | |||||
| CVE-2019-5701 | 1 Nvidia | 1 Geforce Experience | 2022-01-01 | 6.2 MEDIUM | 7.8 HIGH |
| NVIDIA GeForce Experience, all versions prior to 3.20.0.118, contains a vulnerability when GameStream is enabled in which an attacker with local system access can load the Intel graphics driver DLLs without validating the path or signature (also known as a binary planting or DLL preloading attack), which may lead to denial of service, information disclosure, or escalation of privileges through code execution. | |||||
| CVE-2019-5694 | 2 Microsoft, Nvidia | 2 Windows, Gpu Driver | 2022-01-01 | 4.4 MEDIUM | 6.5 MEDIUM |
| NVIDIA Windows GPU Display Driver, R390 driver version, contains a vulnerability in NVIDIA Control Panel in which it incorrectly loads Windows system DLLs without validating the path or signature (also known as a binary planting or DLL preloading attack), which may lead to denial of service or information disclosure through code execution. The attacker requires local system access. | |||||