Vulnerabilities (CVE)

Filtered by CWE-20
Total 11430 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2019-10501 1 Qualcomm 80 Mdm9150, Mdm9150 Firmware, Mdm9206 and 77 more 2024-11-21 4.6 MEDIUM 7.8 HIGH
Possible use after free issue due to improper input validation in volume listener library in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVE-2019-10245 2 Eclipse, Redhat 6 Openj9, Enterprise Linux, Enterprise Linux Desktop and 3 more 2024-11-21 5.0 MEDIUM 7.5 HIGH
In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load.
CVE-2019-10191 2 Fedoraproject, Nic 2 Fedora, Knot Resolver 2024-11-21 5.0 MEDIUM 7.5 HIGH
A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secure domains to DNSSEC-insecure state, opening possibility of domain hijack using attacks against insecure DNS protocol.
CVE-2019-10190 2 Fedoraproject, Nic 2 Fedora, Knot Resolver 2024-11-21 5.0 MEDIUM 7.5 HIGH
A vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers to bypass DNSSEC validation for non-existence answer. NXDOMAIN answer would get passed through to the client even if its DNSSEC validation failed, instead of sending a SERVFAIL packet. Caching is not affected by this particular bug but see CVE-2019-10191.
CVE-2019-10134 1 Moodle 1 Moodle 2024-11-21 4.3 MEDIUM 3.7 LOW
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly checked, so their quota allowance could be exceeded.
CVE-2019-10063 1 Flatpak 1 Flatpak 2024-11-21 6.8 MEDIUM 9.0 CRITICAL
Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.
CVE-2019-10054 1 Suricata-ids 1 Suricata 2024-11-21 5.0 MEDIUM 7.5 HIGH
An issue was discovered in Suricata 4.1.3. The function process_reply_record_v3 lacks a check for the length of reply.data. It causes an invalid memory access and the program crashes within the nfs/nfs3.rs file.
CVE-2019-1010295 1 Linaro 1 Op-tee 2024-11-21 7.5 HIGH 9.8 CRITICAL
Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Memory corruption and disclosure of memory content. The component is: optee_os. The fixed version is: 3.4.0 and later.
CVE-2019-1010252 1 Linuxfoundation 1 Open Network Operating System 2024-11-21 5.5 MEDIUM 4.9 MEDIUM
The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: applyFlowRules() and apply() functions in FlowRuleManager.java. The attack vector is: network management and connectivity.
CVE-2019-1010251 1 Oisf 1 Suricata 2024-11-21 5.0 MEDIUM 7.5 HIGH
Open Information Security Foundation Suricata prior to version 4.1.2 is affected by: Denial of Service - DNS detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed network packet. The component is: app-layer-detect-proto.c, decode.c, decode-teredo.c and decode-ipv6.c (https://github.com/OISF/suricata/pull/3590/commits/11f3659f64a4e42e90cb3c09fcef66894205aefe, https://github.com/OISF/suricata/pull/3590/commits/8357ef3f8ffc7d99ef6571350724160de356158b). The attack vector is: An attacker can trigger the vulnerability by sending a specifically crafted network request. The fixed version is: 4.1.2.
CVE-2019-1010250 1 Linuxfoundation 1 Open Network Operating System 2024-11-21 5.5 MEDIUM 4.9 MEDIUM
The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: createFlow() and createFlows() functions in FlowWebResource.java (RESTful service). The attack vector is: network management and connectivity.
CVE-2019-1010245 1 Linuxfoundation 1 Open Network Operating System 2024-11-21 7.5 HIGH 9.8 CRITICAL
The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impact is: A remote attacker can execute arbitrary commands on the controller. The component is: apps/yang/src/main/java/org/onosproject/yang/impl/YangLiveCompilerManager.java. The attack vector is: network connectivity. The fixed version is: 1.15.
CVE-2019-1010234 1 Linuxfoundation 1 Open Network Operating System 2024-11-21 7.5 HIGH 9.8 CRITICAL
The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely execute any commands by sending malicious http request to the controller. The component is: Method runJavaCompiler in YangLiveCompilerManager.java. The attack vector is: network connectivity.
CVE-2019-0966 1 Microsoft 3 Windows 10, Windows Server 2016, Windows Server 2019 2024-11-21 5.5 MEDIUM 6.8 MEDIUM
A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'.
CVE-2019-0965 1 Microsoft 3 Windows 10, Windows Server 2016, Windows Server 2019 2024-11-21 7.7 HIGH 7.6 HIGH
A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on a guest operating system that could cause the Hyper-V host operating system to execute arbitrary code. An attacker who successfully exploited the vulnerability could execute arbitrary code on the host operating system. The security update addresses the vulnerability by correcting how Hyper-V validates guest operating system user input.
CVE-2019-0957 1 Microsoft 2 Sharepoint Enterprise Server, Sharepoint Server 2024-11-21 6.5 MEDIUM 8.8 HIGH
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0958.
CVE-2019-0928 1 Microsoft 2 Windows 10, Windows Server 2016 2024-11-21 5.5 MEDIUM 6.2 MEDIUM
A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'.
CVE-2019-0886 1 Microsoft 3 Windows 10, Windows Server 2016, Windows Server 2019 2024-11-21 2.7 LOW 6.8 MEDIUM
An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Information Disclosure Vulnerability'.
CVE-2019-0885 1 Microsoft 8 Windows 10, Windows 7, Windows 8.1 and 5 more 2024-11-21 9.3 HIGH 7.8 HIGH
A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerability'.
CVE-2019-0786 1 Microsoft 3 Windows 10, Windows Server 2016, Windows Server 2019 2024-11-21 7.5 HIGH 9.8 CRITICAL
An elevation of privilege vulnerability exists in the Microsoft Server Message Block (SMB) Server when an attacker with valid credentials attempts to open a specially crafted file over the SMB protocol on the same machine, aka 'SMB Server Elevation of Privilege Vulnerability'.