CVE-2019-10782

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix for CVE-2019-9658.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	com.puppycrawl.tools:checkstyle	all versions before 8.29

References

Timeline

Published: Jan 30, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-107839.8All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec CVE-2019-107849.6phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One CVE-2019-107856.1dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to CVE-2019-107869.8network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument.CVE-2019-107879.8im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js CVE-2019-107889.8im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary CVE-2019-107899.8All versions of curling.js are vulnerable to Command Injection via the run function. The command argument can be controlled by users without CVE-2019-10796.5An information disclosure vulnerability exists when Visual Studio improperly parses XML input in certain settings files, aka 'Visual Studio CVE-2019-107907.5taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-i CVE-2019-107919.8promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be CVE-2019-107926.3bodymen before 1.1.1 is vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Obje CVE-2019-107936.3dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Objec