CVE-2019-12299

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Sandline Centraleyezer (On Premises) allows Stored XSS using HTML entities in the name field of the Category section.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Nov 18, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-12306.8An information disclosure vulnerability exists when the Windows Hyper-V Network Switch on a host operating system fails to properly validateCVE-2019-123009.8Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If anCVE-2019-123019.8The Percona Server 5.6.44-85.0-1 packages for Debian and Ubuntu suffered an issue where the server would reset the root password to a blank CVE-2019-123038.8In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside thCVE-2019-123056.5In EZCast Pro II, the administrator password md5 hash is provided upon a web request. This hash can be cracked to access the administration CVE-2019-123086.1An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by CVE-2019-123094.9dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files. The vulnerability is caused by the iCVE-2019-12315.9An information disclosure vulnerability exists in the way Rome SDK handles server SSL/TLS certificate validation, aka 'Rome SDK Information CVE-2019-123109.8ExaGrid appliances with firmware version v4.8.1.1044.P50 have a /monitor/data/Upgrade/ directory traversal vulnerability, which allows remotCVE-2019-123116.1Sandline Centraleyezer (On Premises) allows Unrestricted File Upload leading to Stored XSS. An HTML page running a script could be uploaded CVE-2019-123127.5In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiatCVE-2019-123136.1XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.