First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2019-15089

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in PRiSE adAS 1.7.0. Forms have no CSRF protection, letting an attacker execute actions as the administrator.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.adas-sso.com/es/extra/download.phpProduct
https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adasThird Party Advisory
http://www.adas-sso.com/es/extra/download.phpProduct
https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adasThird Party Advisory

Timeline

Published: Sep 20, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-150906.7An issue was discovered in drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before 5.1.12. In the qedi_dbg_* family of functions, there is a CVE-2019-150919.8filemgr.php in Artica Integria IMS 5.0.86 allows index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload arbitrary file upload.CVE-2019-150927.3The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, displ CVE-2019-150956.1DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter.CVE-2019-150984.6drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplete address in an endpo CVE-2019-150997.5drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplete address in an endpo CVE-2019-151029.8An issue was discovered in Tyto Sahi Pro 6.x through 8.0.0. TestRunner_Non_distributed (and distributed end points) does not have any authen CVE-2019-151048.8An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguratio CVE-2019-151058.8An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdCon CVE-2019-151069.8An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute comm CVE-2019-151079.8An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.CVE-2019-151084.8An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457. There is XSS via a crafted filename to the file-uploa