CVE-2019-11628

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-917

Affected software

No affected versions have been published.

Timeline

Published: May 1, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-116296.1Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS.CVE-2019-11635.5A security feature bypass exists when Windows incorrectly validates CAB file signatures. An attacker who successfully exploited this vulnera CVE-2019-116328.1In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEd CVE-2019-116337.5HoneyPress through 2016-09-27 can be fingerprinted by attackers because of the ingrained unique www.atxsec.com and ayylmao.wpengine.com host CVE-2019-116349.8Citrix Workspace App before 1904 for Windows has Incorrect Access Control.CVE-2019-116367.5Zcash 2.x allows an inexpensive approach to "fill all transactions of all blocks" and "prevent any real transaction from occurring" via a "S CVE-2019-116376.5An issue was discovered in GNU recutils 1.8. There is a NULL pointer dereference in the function rec_rset_get_props at rec-rset.c in librec.CVE-2019-116386.5An issue was discovered in GNU recutils 1.8. There is a NULL pointer dereference in the function rec_field_name_equal_p at rec-field-name.c CVE-2019-116398.8An issue was discovered in GNU recutils 1.8. There is a stack-based buffer overflow in the function rec_type_check_enum at rec-types.c in li CVE-2019-11647.8An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfu CVE-2019-116408.8An issue was discovered in GNU recutils 1.8. There is a heap-based buffer overflow in the function rec_fex_parse_str_simple at rec-fex.c in CVE-2019-116417.5Anomali Agave (formerly Drupot) through 1.0.0 fails to avoid fingerprinting by including predictable data and minimal variation in size with