CVE-2019-10229

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2. When the directory service (for synchronizing and authenticating users) is set to Generic LDAP, an attacker is able to login as an existing user with an arbitrary password on the second login attempt.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published
Dec 31, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-10236.5An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge. An atCVE-2019-102319.8Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication. This occurs in Auth::checkPasCVE-2019-102329.8Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock_tasks.php.CVE-2019-102338.1Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie.CVE-2019-102378.8S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a relatedCVE-2019-102386.1Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter.CVE-2019-102397.8Robotronic RunAsSpc 3.7.0.0 protects stored credentials insufficiently, which allows locally authenticated attackers (under the same user coCVE-2019-10244.2A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-bCVE-2019-102408.1Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these deCVE-2019-102416.1In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote clCVE-2019-102425.3In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversCVE-2019-102435.3In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies. This can be used as a hint by an att
CVE-2019-10229: High severity, CVSS 8.8 | Vulnix