CVE-2019-11686

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Western Digital SanDisk X300, X300s, X400, and X600 devices: A vulnerability in the wear-leveling algorithm of the drive may cause cryptographically sensitive parameters (such as data encryption keys) to remain on the drive media after their intended erasure.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published
Mar 10, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-116877.8An issue was discovered in the DICOM Part 10 File Format in the NEMA DICOM Standard 1995 through 2019b and continuing in current implementatCVE-2019-116887.4An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl accept any cerCVE-2019-116898.1An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl fail to properCVE-2019-11697.8An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. AnCVE-2019-116905.9gen_rand_uuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which allows attackers to determine UUID values in CVE-2019-116919.8A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called aCVE-2019-116929.8A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potenCVE-2019-116939.8The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious CVE-2019-116947.5A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making aCVE-2019-116954.3A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be alloCVE-2019-116967.8Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even thoughCVE-2019-116976.5If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install