CVE-2019-10049

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an administrator user into opening a link shared through the application, that in turn opens a shared file that contains JavaScript code (that is executed in the context of the victim user to obtain sensitive information such as session identifiers and perform actions on behalf of him/her).

Metrics

CVSS 3.0 7.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 31, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-10057.5A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerabil CVE-2019-100507.5A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the decode-mpls.c function DecodeMPLS is composed on CVE-2019-100517.5An issue was discovered in Suricata 4.1.3. If the function filetracker_newchunk encounters an unsafe "Some(sfcm) => { ft.new_chunk }" item, CVE-2019-100527.5An issue was discovered in Suricata 4.1.3. If the network packet does not have the right length, the parser tries to access a part of a DHCP CVE-2019-100539.8An issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the function SSHParseBanner is composed only of a \n character, then CVE-2019-100547.5An issue was discovered in Suricata 4.1.3. The function process_reply_record_v3 lacks a check for the length of reply.data. It causes an inv CVE-2019-100557.5An issue was discovered in Suricata 4.1.3. The function ftp_pasv_response lacks a check for the length of part1 and part2, leading to a cras CVE-2019-100567.5An issue was discovered in Suricata 4.1.3. The code mishandles the case of sending a network packet with the right type, such that the funct CVE-2019-100576.5Various Lexmark products have CSRF.CVE-2019-100589.1Various Lexmark products have Incorrect Access Control.CVE-2019-100595.3The legacy finger service (TCP port 79) is enabled by default on various older Lexmark devices.CVE-2019-10067.5An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing sign