CVE-2019-10220

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Nov 27, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-102216.1A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. CVE-2019-102227.5A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crashCVE-2019-102236.5A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 releasCVE-2019-102244.6A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may diCVE-2019-102256.3A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently prCVE-2019-102265.4HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTCVE-2019-102276.1openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.CVE-2019-102298.8An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2. When the directory service (for sCVE-2019-10236.5An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge. An atCVE-2019-102319.8Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication. This occurs in Auth::checkPasCVE-2019-102329.8Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock_tasks.php.CVE-2019-102338.1Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie.
CVE-2019-10220: High severity, CVSS 8.8 | Vulnix