CVE-2019-10786

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
n/anetwork-managerAll versions

References

Timeline

Published
Feb 4, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-107879.8im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.jsCVE-2019-107889.8im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary CVE-2019-107899.8All versions of curling.js are vulnerable to Command Injection via the run function. The command argument can be controlled by users withoutCVE-2019-10796.5An information disclosure vulnerability exists when Visual Studio improperly parses XML input in certain settings files, aka 'Visual Studio CVE-2019-107907.5taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-iCVE-2019-107919.8promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can beCVE-2019-107926.3bodymen before 1.1.1 is vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of ObjeCVE-2019-107936.3dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of ObjecCVE-2019-107946.3All versions of component-flatten are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying propertiesCVE-2019-107956.3undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of ObjectCVE-2019-107969.8rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part ofCVE-2019-107976.5Netty in WSO2 transport-http before v6.3.1 is vulnerable to HTTP Response Splitting due to HTTP Header validation being disabled.
CVE-2019-10786: Critical severity, CVSS 9.8 | Vulnix