CVE-2018-19971

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

JFrog Artifactory Pro 6.5.9 has Incorrect Access Control.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-345

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/152137/JFrog-Artifactory-Pro-6.5.9-Signature-Validation.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Mar/34Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/107518Third Party Advisory, VDB Entry
https://bintray.com/jfrog/artifactory-pro/jfrog-artifactory-pro-zip/6.5.13#releaseProduct, Third Party Advisory
https://lists.openwall.net/full-disclosure/2019/03/19/3Exploit, Mailing List, Third Party Advisory
http://packetstormsecurity.com/files/152137/JFrog-Artifactory-Pro-6.5.9-Signature-Validation.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Mar/34Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/107518Third Party Advisory, VDB Entry
https://bintray.com/jfrog/artifactory-pro/jfrog-artifactory-pro-zip/6.5.13#releaseProduct, Third Party Advisory
https://lists.openwall.net/full-disclosure/2019/03/19/3Exploit, Mailing List, Third Party Advisory

Timeline

Published: Apr 16, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-199745.5In YARA 3.8.1, bytecode in a specially crafted compiled rule can read uninitialized data from VM scratch memory in libyara/exec.c. This can CVE-2018-199755.5In YARA 3.8.1, bytecode in a specially crafted compiled rule can read data from any arbitrary address in memory, in libyara/exec.c. Specific CVE-2018-199765.5In YARA 3.8.1, bytecode in a specially crafted compiled rule is exposed to information about its environment, in libyara/exec.c. This is a c CVE-2018-199778.0A command injection (missing input validation, escaping) in the ftp upgrade configuration interface on the Auerswald COMfort 1200 IP phone 3 CVE-2018-199788.0A buffer overflow vulnerability in the DHCP and PPPOE configuration interface of the Auerswald COMfort 1200 IP phone 3.4.4.1-10589 allows a CVE-2018-19987.8IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be executed with root privileges. This is due to a CVE-2018-199807.5Anker Nebula Capsule Pro NBUI_M1_V2.1.9 devices allow attackers to cause a denial of service (reboot of the underlying Android 7.1.2 operati CVE-2018-199817.2Amazon AWS SDK <=2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito CVE-2018-199825.3An issue was discovered on KT MC01507L Z-Wave S0 devices. It occurs because HPKP is not implemented. The communication architecture is APP >CVE-2018-199836.5An issue was discovered on Sigma Design Z-Wave S0 through S2 devices. An attacker first prepares a Z-Wave frame-transmission program (e.g., CVE-2018-199854.6The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB device (as a u8) and CVE-2018-199869.8In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects D-Link DIR-818LW Rev.A 2.05.B