CVE-2019-10846

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and password reset page via the username GET parameter.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/155257/Computrols-CBAS-Web-19.0.0-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
https://applied-risk.com/index.php/download_file/view/196/165Third Party Advisory
https://applied-risk.com/labs/advisoriesThird Party Advisory
http://packetstormsecurity.com/files/155257/Computrols-CBAS-Web-19.0.0-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
https://applied-risk.com/index.php/download_file/view/196/165Third Party Advisory
https://applied-risk.com/labs/advisoriesThird Party Advisory

Timeline

Published: May 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-108478.8Computrols CBAS 18.0.0 allows Cross-Site Request Forgery.CVE-2019-108485.3Computrols CBAS 18.0.0 allows Username Enumeration.CVE-2019-108497.5Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure.CVE-2019-10857.8An elevation of privilege vulnerability exists in the way that the wlansvc.dll handles objects in memory, aka 'Windows WLAN Service Elevatio CVE-2019-108509.8Computrols CBAS 18.0.0 has Default Credentials.CVE-2019-108516.5Computrols CBAS 18.0.0 has hard-coded encryption keys.CVE-2019-108528.8Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=start CVE-2019-108538.1Computrols CBAS 18.0.0 allows Authentication Bypass.CVE-2019-108548.8Computrols CBAS 18.0.0 allows Authenticated Command Injection.CVE-2019-108557.5Computrols CBAS 18.0.0 mishandles password hashes. The approach is MD5 with a pw prefix, e.g., if the password is admin, it will calculate t CVE-2019-108566.1In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. This issue exists because of an incomplete fix for CVE-201 CVE-2019-10867.8An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is