CVE-2019-11242

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform version 5.x and 6.x prior to 6.1.1c. Cohesity clusters did not verify TLS certificates presented by vCenter. This vulnerability could expose Cohesity user credentials configured to access vCenter.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published
Jul 12, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-112438.1In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials rCVE-2019-112445.0In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cachCVE-2019-112457.8In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container reCVE-2019-112466.5The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar insCVE-2019-112478.1The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were naCVE-2019-112488.2The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the KubeCVE-2019-112496.5The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar insCVE-2019-11255.6An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory. An attacker who succCVE-2019-112506.5The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized userCVE-2019-112515.7The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinCVE-2019-112526.5The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logsCVE-2019-112537.5Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 a