First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2019-10227

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://openitcockpit.io/2019/05/21/openitcockpit-3-7-1-released/Release Notes, Vendor Advisory
https://openitcockpit.io/security/Vendor Advisory
https://openitcockpit.io/2019/05/21/openitcockpit-3-7-1-released/Release Notes, Vendor Advisory
https://openitcockpit.io/security/Vendor Advisory

Timeline

Published: Dec 31, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-102298.8An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2. When the directory service (for s CVE-2019-10236.5An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge. An at CVE-2019-102319.8Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication. This occurs in Auth::checkPas CVE-2019-102329.8Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock_tasks.php.CVE-2019-102338.1Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie.CVE-2019-102378.8S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a related CVE-2019-102386.1Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter.CVE-2019-102397.8Robotronic RunAsSpc 3.7.0.0 protects stored credentials insufficiently, which allows locally authenticated attackers (under the same user co CVE-2019-10244.2A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-b CVE-2019-102408.1Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these de CVE-2019-102416.1In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote cl CVE-2019-102425.3In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path travers