CVE-2019-9150

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page. This functionality can be tricked to either hide a key import from the user or obscure which key was imported.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-320

Affected software

No affected versions have been published.

Timeline

Published: Jul 9, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-91518.8An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5VM_memcpyvv in H5VM.c when called f CVE-2019-91528.8An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5MM_xstrdup in H5MM.c when called fr CVE-2019-91537.5Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signat CVE-2019-91547.5Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed.CVE-2019-91555.9A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryptio CVE-2019-91568.0Gemalto DS3 Authentication Server 2.6.1-SP01 allows OS Command Injection.CVE-2019-91575.7Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure.CVE-2019-91585.7Gemalto DS3 Authentication Server 2.6.1-SP01 has Broken Access Control.CVE-2019-91609.8WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a backdoor account allowing a remote attacker to login to the sys CVE-2019-91619.8WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution issue allowing remote attackers to achiev CVE-2019-91627.8In the Linux kernel before 4.20.12, net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP NAT module has insufficient ASN.1 length checks CVE-2019-91639.8The connection initiation process in March Networks Command Client before 2.7.2 allows remote attackers to execute arbitrary code via crafte