CVE-2019-11405

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

OpenAPI Tools OpenAPI Generator before 4.0.0-20190419.052012-560 uses http:// URLs in various build.gradle, build.gradle.mustache, and build.sbt files, which may have caused insecurely resolved dependencies.

Metrics

CVSS 3.0 7.4/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-311

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/OpenAPITools/openapi-generator/issues/2253Exploit, Third Party Advisory
https://github.com/OpenAPITools/openapi-generator/pull/2248Third Party Advisory
https://github.com/OpenAPITools/openapi-generator/pull/2697Third Party Advisory
https://github.com/OpenAPITools/openapi-generator/issues/2253Exploit, Third Party Advisory
https://github.com/OpenAPITools/openapi-generator/pull/2248Third Party Advisory
https://github.com/OpenAPITools/openapi-generator/pull/2697Third Party Advisory

Timeline

Published: Apr 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-114066.1Subrion CMS 4.2.1 allows _core/en/contacts/ XSS via the name, email, or phone parameter.CVE-2019-114077.2app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 suffers from an information disclosure vulnerability due to CVE-2019-114086.1XSS in app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 allows remote unauthenticated attackers to inject ar CVE-2019-114098.8app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of CVE-2019-11414.2A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-b CVE-2019-114107.2app/backup/index.php in the Backup Module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validatio CVE-2019-114119.8An issue was discovered in Artifex MuJS 1.0.5. The Number#toFixed() and numtostr implementations in jsnumber.c have a stack-based buffer ove CVE-2019-114127.5An issue was discovered in Artifex MuJS 1.0.5. jscompile.c can cause a denial of service (invalid stack-frame jump) because it lacks an ENDT CVE-2019-114137.5An issue was discovered in Artifex MuJS 1.0.5. It has unlimited recursion because the match function in regexp.c lacks a depth check.CVE-2019-114148.8An issue was discovered on Intelbras IWR 3000N 1.5.0 devices. When the administrator password is changed from a certain client IP address, a CVE-2019-114157.5An issue was discovered on Intelbras IWR 3000N 1.5.0 devices. A malformed login request allows remote attackers to cause a denial of service CVE-2019-114168.8A CSRF issue was discovered on Intelbras IWR 3000N 1.5.0 devices, leading to complete control of the router, as demonstrated by v1/system/us