CVE-2019-2526

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Oracle Corporation	VM VirtualBox	>= unspecified, < 5.2.24; >= unspecified, < 6.0.2

References

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html
http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/106568Third Party Advisory, VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html
http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/106568Third Party Advisory, VDB Entry

Timeline

Published: Jan 16, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-252608.2OXID eShop versions 6.x prior to 6.3.4 contains a SQL injection vulnerability in the 'sorting' parameter that allows attackers to insert mal CVE-2019-252617.8AnyDesk 5.4.0 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentiall CVE-2019-252623.5A security vulnerability has been detected in elinicksic Razgover up to db37dfc5c82f023a40f2f7834ded6633fb2b5262. This affects an unknown pa CVE-2019-252636.4Zendesk SweetHawk Survey 1.6 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts thro CVE-2019-252646.4Snipe-IT 4.7.5 contains a persistent cross-site scripting vulnerability that allows authorized users to upload malicious SVG files with embe CVE-2019-252656.4Online Inventory Manager 3.2 contains a stored cross-site scripting vulnerability in the group description field of the admin edit groups se CVE-2019-252667.8Wondershare Application Framework Service 2.4.3.231 contains an unquoted service path vulnerability that allows local attackers to potential CVE-2019-252677.8Wing FTP Server 6.0.7 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with CVE-2019-252689.8NREL BEopt 2.8.0.0 contains a DLL hijacking vulnerability that allows attackers to load arbitrary libraries by tricking users into opening a CVE-2019-252697.8Amiti Antivirus 25.0.640 contains an unquoted service path vulnerability in its Windows service configurations. Attackers can exploit the un CVE-2019-25276.5Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are CVE-2019-252706.1SOCA Access Control System 180612 contains a cross-site scripting vulnerability in the 'senddata' POST parameter of logged_page.php that all