CVE-2019-10716

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

An Information Disclosure issue in Verodin Director 3.5.3.1 and earlier reveals usernames and passwords of integrated security technologies via a /integrations.json JSON REST API request.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/156214/Verodin-Director-Web-Console-3.5.4.0-Password-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
http://www.nolanbkennedy.com/post/cve-2019-10716-information-disclosure-verodin-directorExploit, Third Party Advisory
https://www.verodin.com/Product
https://www.verodin.com/technology/platformProduct
http://packetstormsecurity.com/files/156214/Verodin-Director-Web-Console-3.5.4.0-Password-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
http://www.nolanbkennedy.com/post/cve-2019-10716-information-disclosure-verodin-directorExploit, Third Party Advisory
https://www.verodin.com/Product
https://www.verodin.com/technology/platformProduct

Timeline

Published: Oct 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-107177.1BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter.CVE-2019-107187.5BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.Core/Web/HttpHandlers/CVE-2019-107198.8BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api CVE-2019-10729.8A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Az CVE-2019-107208.8BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. NOTE: this CVE-2019-107216.1BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Securit CVE-2019-107235.5An issue was discovered in PoDoFo 0.9.6. The PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp has an attempted excessive memory allocati CVE-2019-107246.5There is a vulnerability with the Dolby DAX2 API system services in which a low-privileged user can terminate arbitrary processes that are r CVE-2019-10735.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information CVE-2019-107324.3In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email.CVE-2019-107344.3In KDE Trojita 0.7, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email.CVE-2019-107354.3In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart emai