First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2019-1020004

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Tridactyl before 1.16.0 allows fake key events.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Tridactyl	Tridactyl	< 1.16.0

References

Timeline

Published: Jul 29, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-10200055.4invenio-communities before 1.0.0a20 allows XSS.CVE-2019-10200066.1invenio-app before 1.1.1 allows host header injection.CVE-2019-10200075.4Dependency-Track before 3.5.1 allows XSS.CVE-2019-10200086.1stacktable.js before 1.0.4 allows XSS.CVE-2019-10200097.5Fleet before 2.1.2 allows exposure of SMTP credentials.CVE-2019-10200106.1Misskey before 10.102.4 allows hijacking a user's token.CVE-2019-10200117.2SmokeDetector intentionally does automatic deployments of updated copies of SmokeDetector without server operator authority.CVE-2019-10200127.5parse-server before 3.4.1 allows DoS after any POST to a volatile class.CVE-2019-10200135.3parse-server before 3.6.0 allows account enumeration.CVE-2019-10200145.5docker-credential-helpers before 0.6.3 has a double free in the List functions.CVE-2019-10200157.5graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.CVE-2019-10200166.1ASH-AIO before 2.0.0.3 allows an open redirect.

CVE-2019-1020004: High severity, CVSS 7.5 | Vulnix