CVE-2019-10219

MediumCVSS 6.1/10Last modified Oct 8, 2026

Description

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Nov 8, 2019
Last modified
Oct 8, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-10227.8An elevation of privilege exists in Windows Audio Service. An attacker who successfully exploited the vulnerability could run arbitrary codeCVE-2019-102208.8Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.CVE-2019-102216.1A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. CVE-2019-102227.5A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crashCVE-2019-102236.5A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 releasCVE-2019-102244.6A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may diCVE-2019-102256.3A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently prCVE-2019-102265.4HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTCVE-2019-102276.1openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.CVE-2019-102298.8An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2. When the directory service (for sCVE-2019-10236.5An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge. An atCVE-2019-102319.8Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication. This occurs in Auth::checkPas
CVE-2019-10219: Medium severity, CVSS 6.1 | Vulnix