CVE-2018-19443

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.tryton.org/issue7792Issue Tracking, Third Party Advisory
https://discuss.tryton.org/t/security-release-for-issue7792/830Vendor Advisory
https://bugs.tryton.org/issue7792Issue Tracking, Third Party Advisory
https://discuss.tryton.org/t/security-release-for-issue7792/830Vendor Advisory

Timeline

Published: Nov 22, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-194447.8A use after free in the TextBox field Validate action in IReader_ContentProvider can occur for specially crafted PDF files in Foxit Reader S CVE-2018-194457.8A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API CVE-2018-194467.8A File Write can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API Doc.cre CVE-2018-194477.8A stack-based buffer overflow can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) 5.4.0.1031 when parsing the URI string CVE-2018-194487.8In Foxit Reader SDK (ActiveX) Professional 5.4.0.1031, an uninitialized object in IReader_ContentProvider::GetDocEventHandler occurs when em CVE-2018-194497.8A File Write can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API Doc.exp CVE-2018-19456.1IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance could allow a remote attacker to hijack the clicking CVE-2018-194507.8A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) 5.4.0.1031 when parsing a launch action. An atta CVE-2018-194517.8A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when using the Open File CVE-2018-194527.8A use after free in the TextBox field Mouse Enter action in IReader_ContentProvider can occur for specially crafted PDF files in Foxit Reade CVE-2018-194538.8Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type.CVE-2018-194567.5The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from serve