Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 12 are already weaponised in the wild.
The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.
Security update for chromium
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | SUSE:Package Hub 15 | chromium | — |
| chromium | affected | openSUSE:Leap 15.0 | chromium | — |
| chromium | affected | SUSE:Package Hub 12 SP2 | chromium | — |
chromium - security update
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:9 | chromium | — |
Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
CVEs:CVE-2019-5786
Use-After-Free in puppeteer
CVEs:CVE-2019-5786
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| puppeteer | affected | npm | puppeteer | — |
Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
CVEs:CVE-2019-5786
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — |
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0797.
CVEs:CVE-2019-0808
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| windows_7 | affected | microsoft | — | — |
| windows_server_2008 | affected | microsoft | — | — |
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0797.
CVEs:CVE-2019-0808
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0704, CVE-2019-0821.
CVEs:CVE-2019-0703
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0704, CVE-2019-0821.
CVEs:CVE-2019-0703
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| windows_10_1507 | affected | microsoft | — | — |
| windows_10_1607 | affected | microsoft | — | — |
| windows_10_1703 | affected | microsoft | — | — |
| windows_10_1709 | affected | microsoft | — | — |
| windows_10_1803 | affected | microsoft | — | — |
| windows_10_1809 | affected | microsoft | — | — |
| windows_7 | affected | microsoft | — | — |
| windows_8.1 | affected | microsoft | — | — |
| windows_rt_8.1 | affected | microsoft | — | — |
| windows_server_1709 | affected | microsoft | — | — |
| windows_server_1803 | affected | microsoft | — | — |
| windows_server_2008 | affected | microsoft | — | — |
| windows_server_2012 | affected | microsoft | — | — |
| windows_server_2016 | affected | microsoft | — | — |
| windows_server_2019 | affected | microsoft | — | — |
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0808.
CVEs:CVE-2019-0797
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| windows_10_1507 | affected | microsoft | — | — |
| windows_10_1607 | affected | microsoft | — | — |
| windows_10_1703 | affected | microsoft | — | — |
| windows_10_1709 | affected | microsoft | — | — |
| windows_10_1803 | affected | microsoft | — | — |
| windows_10_1809 | affected | microsoft | — | — |
| windows_8.1 | affected | microsoft | — | — |
| windows_rt_8.1 | affected | microsoft | — | — |
| windows_server_1709 | affected | microsoft | — | — |
| windows_server_1803 | affected | microsoft | — | — |
| windows_server_2012 | affected | microsoft | — | — |
| windows_server_2016 | affected | microsoft | — | — |
| windows_server_2019 | affected | microsoft | — | — |
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0808.
CVEs:CVE-2019-0797
Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| containerd | affected | SUSE:OpenStack Cloud 6-LTSS | containerd | — |
| containerd | affected | SUSE:Linux Enterprise Module for Containers 12 | containerd | — |
| docker | affected | SUSE:OpenStack Cloud 6-LTSS | docker | — |
| docker | affected | SUSE:Linux Enterprise Module for Containers 12 | docker | — |
| docker-runc | affected | SUSE:OpenStack Cloud 6-LTSS | docker-runc | — |
| docker-runc | affected | SUSE:Linux Enterprise Module for Containers 12 | docker-runc | — |
| golang-github-docker-libnetwork | affected | SUSE:Linux Enterprise Module for Containers 12 | golang-github-docker-libnetwork | — |
| golang-github-docker-libnetwork | affected | SUSE:OpenStack Cloud 6-LTSS | golang-github-docker-libnetwork | — |
chromium - security update
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:9 | chromium | — |
Security update for chromium
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | openSUSE:Leap 15.0 | chromium | — |
An integer overflow that leads to a use-after-free in WebMIDI in Google Chrome on Windows prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.
CVEs:CVE-2019-5789
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| backports | affected | opensuse | — | — |
| chrome | affected | — | — | |
| leap | affected | opensuse | — | — |
An integer overflow that leads to a use-after-free in Blink Storage in Google Chrome on Linux prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.
CVEs:CVE-2019-5788
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| backports | affected | opensuse | — | — |
| chrome | affected | — | — | |
| leap | affected | opensuse | — | — |
Data race in extensions guest view in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVEs:CVE-2019-5796
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| backports_sle | affected | opensuse | — | — |
| chrome | affected | — | — | |
| leap | affected | opensuse | — | — |
In binder_thread_read of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitatio...
CVEs:CVE-2019-2025
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on the PID of the caller. This could allow an app to add or replace a HAL service with its own service, gaining code execution in a privileged...
CVEs:CVE-2019-2023
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In ce_t4t_data_cback of ce_t4t.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product:...
CVEs:CVE-2019-2019
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In llcp_dlc_proc_rr_rnr_pdu of llcp_dlc.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction needed for exploitation.Pr...
CVEs:CVE-2019-2020
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVEs:CVE-2019-5797
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — |
An integer overflow leading to an incorrect capacity of a buffer in JavaScript in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVEs:CVE-2019-5790
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| backports | affected | opensuse | — | — |
| chrome | affected | — | — | |
| leap | affected | opensuse | — | — |
Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVEs:CVE-2019-5798
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| backports | affected | opensuse | — | — |
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
| enterprise_linux | affected | redhat | — | — |
| leap | affected | opensuse | — | — |
| package_hub | affected | suse | — | — |
| ubuntu_linux | affected | canonical | — | — |
CVE-2019-9634 affecting package golang 1.25.7-1
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang | affected | Azure Linux:3 | golang | — |
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection.
CVEs:CVE-2019-9634
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| go | affected | golang | — | — |
An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.
CVEs:CVE-2019-9741
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| debian_linux | affected | debian | — | — |
| developer_tools | affected | redhat | — | — |
| enterprise_linux | affected | redhat | — | — |
| fedora | affected | fedoraproject | — | — |
| go | affected | golang | — | — |
Use-after-garbage-collection in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVEs:CVE-2019-5787
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| backports | affected | opensuse | — | — |
| chrome | affected | — | — | |
| leap | affected | opensuse | — | — |
Inappropriate optimization in V8 in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVEs:CVE-2019-5791
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| backports | affected | opensuse | — | — |
| chrome | affected | — | — | |
| leap | affected | opensuse | — | — |
Incorrect inheritance of a new document's policy in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVEs:CVE-2019-5799
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| backports | affected | opensuse | — | — |
| chrome | affected | — | — | |
| leap | affected | opensuse | — | — |
In ih264d_fmt_conv_420sp_to_420p of ih264d_format_conv.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exp...
CVEs:CVE-2019-1989
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In ihevcd_fmt_conv_420sp_to_420p of ihevcd_fmt_conv.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploi...
CVEs:CVE-2019-1990
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In addLinks of Linkify.java, there is a possible phishing vector due to an unusual root cause. This could lead to remote code execution or misdirection of clicks with no additional execution privileges needed. User interaction is needed for exploitatio...
CVEs:CVE-2019-2003
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file.
CVEs:CVE-2019-5792
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| backports | affected | opensuse | — | — |
| chrome | affected | — | — | |
| leap | affected | opensuse | — | — |
Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file.
CVEs:CVE-2019-5795
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| backports | affected | opensuse | — | — |
| chrome | affected | — | — | |
| leap | affected | opensuse | — | — |
In resetPasswordInternal of DevicePolicyManagerService.java, there is a possible bypass of password reset protection due to an unusual root cause. Remote user interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9Android...
CVEs:CVE-2019-2018
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
Incorrect handling of cancelled requests in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVEs:CVE-2019-5794
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| backports_sle | affected | opensuse | — | — |
| chrome | affected | — | — | |
| leap | affected | opensuse | — | — |
Insufficient policy enforcement in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVEs:CVE-2019-5800
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| backports | affected | opensuse | — | — |
| chrome | affected | — | — | |
| leap | affected | opensuse | — | — |
Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVEs:CVE-2019-5803
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| backports | affected | opensuse | — | — |
| chrome | affected | — | — | |
| leap | affected | opensuse | — | — |
Incorrect eliding of URLs in Omnibox in Google Chrome on iOS prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVEs:CVE-2019-5801
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| backports | affected | opensuse | — | — |
| chrome | affected | — | — | |
| leap | affected | opensuse | — | — |
Insufficient policy enforcement in extensions in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to initiate the extensions installation user interface via a crafted HTML page.
CVEs:CVE-2019-5793
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| backports | affected | opensuse | — | — |
| chrome | affected | — | — | |
| leap | affected | opensuse | — | — |
In getReadIndex and getWriteIndex of FifoControllerBase.cpp, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege in the audio server with no additional execution privileges needed. User i...
CVEs:CVE-2019-2007
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
Incorrect handling of download origins in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVEs:CVE-2019-5802
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| backports_sle | affected | opensuse | — | — |
| chrome | affected | — | — | |
| leap | affected | opensuse | — | — |
In rw_t3t_act_handle_fmt_rsp of rw_t3t.cc, there is a possible out-of-bound write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitatio...
CVEs:CVE-2019-2012
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In rw_t3t_act_handle_sro_rsp of rw_t3t.cc, there is a possible out-of-bound write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitatio...
CVEs:CVE-2019-2013
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In rw_t3t_handle_get_sc_poll_rsp of rw_t3t.cc, there is a possible out-of-bound write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploit...
CVEs:CVE-2019-2014
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In rw_t3t_act_handle_check_rsp of rw_t3t.cc, there is a possible out-of-bound write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitat...
CVEs:CVE-2019-2015
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In NFA_SendRawFrame of nfa_dm_api.cc, there is a possible out-of-bound write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation....
CVEs:CVE-2019-2016
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In rw_t3t_act_handle_fmt_rsp and rw_t3t_act_handle_sro_rsp of rw_t3t.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interacti...
CVEs:CVE-2019-2022
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In llcp_util_parse_connect of llcp_util.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation...
CVEs:CVE-2018-9561
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In llcp_util_parse_cc of llcp_util.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Prod...
CVEs:CVE-2018-9563
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In llcp_util_parse_link_params of llcp_util.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploita...
CVEs:CVE-2018-9564
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In rw_t3t_act_handle_ndef_detect_rsp of rw_t3t.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for explo...
CVEs:CVE-2019-2021
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In serviceDied of HalDeathHandlerHidl.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege in the audio server with no additional execution privileges needed. User interaction is not neede...
CVEs:CVE-2019-2006
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In onPermissionGrantResult of GrantPermissionsActivity.java, there is a possible incorrectly granted permission due to a missing permission check. This could lead to local escalation of privilege on a locked device with no additional execution privileg...
CVEs:CVE-2019-2005
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In l2c_lcc_proc_pdu of l2c_fcr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploit...
CVEs:CVE-2019-2009
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In createEffect of AudioFlinger.cpp, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: An...
CVEs:CVE-2019-2008
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
Incorrect command line processing in Chrome in Google Chrome prior to 73.0.3683.75 allowed a local attacker to perform domain spoofing via a crafted domain name.
CVEs:CVE-2019-5804
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| backports | affected | opensuse | — | — |
| chrome | affected | — | — | |
| leap | affected | opensuse | — | — |
In em28xx_unregister_dvb of em28xx-dvb.c, there is a possible use after free issue. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersion...
CVEs:CVE-2019-2024
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In rw_t2t_handle_tlv_detect_rsp of rw_t2t_ndef.cc, there is a possible out-of-bound write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exp...
CVEs:CVE-2019-2017
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In findAvailSpellCheckerLocked of TextServicesManagerService.java, there is a possible way to bypass the warning dialog when selecting an untrusted spell checker due to a permissions bypass. This could lead to local escalation of privilege with no addi...
CVEs:CVE-2019-1985
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In readNullableNativeHandleNoDup of Parcel.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for e...
CVEs:CVE-2019-2011
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In phNxpNciHal_process_ext_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bound write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed ...
CVEs:CVE-2019-2010
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In publishKeyEvent, publishMotionEvent and sendUnchainedFinishedSignal of InputTransport.cpp, there are uninitialized data leading to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploi...
CVEs:CVE-2019-2004
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.