CVE-2019-10849

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
May 23, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-10857.8An elevation of privilege vulnerability exists in the way that the wlansvc.dll handles objects in memory, aka 'Windows WLAN Service ElevatioCVE-2019-108509.8Computrols CBAS 18.0.0 has Default Credentials.CVE-2019-108516.5Computrols CBAS 18.0.0 has hard-coded encryption keys.CVE-2019-108528.8Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=startCVE-2019-108538.1Computrols CBAS 18.0.0 allows Authentication Bypass.CVE-2019-108548.8Computrols CBAS 18.0.0 allows Authenticated Command Injection.CVE-2019-108557.5Computrols CBAS 18.0.0 mishandles password hashes. The approach is MD5 with a pw prefix, e.g., if the password is admin, it will calculate tCVE-2019-108566.1In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. This issue exists because of an incomplete fix for CVE-201CVE-2019-10867.8An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is CVE-2019-108637.2A command injection vulnerability exists in TeemIp versions before 2.4.0. The new_config parameter of exec.php allows one to create a new PHCVE-2019-108646.1The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the RefCVE-2019-108669.8In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the fi
CVE-2019-10849: High severity, CVSS 7.5 | Vulnix