CVE-2019-14849

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-201CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Dec 12, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-14857.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code ExecutCVE-2019-148503.7A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and caCVE-2019-148516.5A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertCVE-2019-148527.5A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol CVE-2019-148537.5An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexCVE-2019-148546.5OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to DebCVE-2019-148557.5A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use thisCVE-2019-148566.5ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a NoneCVE-2019-148576.1A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019CVE-2019-148585.5A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub paramCVE-2019-148599.1A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. WithoutCVE-2019-14866.1A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL
CVE-2019-14849: Medium severity, CVSS 5.4 | Vulnix