CVE-2019-15652

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The web interface for NSSLGlobal SatLink VSAT Modem Unit (VMU) devices before 18.1.0 doesn't properly sanitize input for error messages, leading to the ability to inject client-side code.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2019-15652-satlink-vsat-vulnerabilities/Third Party Advisory
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26455Exploit, Third Party Advisory
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2019-15652-satlink-vsat-vulnerabilities/Third Party Advisory
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26455Exploit, Third Party Advisory

Timeline

Published: Nov 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-156537.5Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. The HTML source cod CVE-2019-156547.5Comba AC2400 devices are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?download=true request to the CVE-2019-156557.5D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management s CVE-2019-156567.5D-Link DSL-2875AL and DSL-2877AL devices through 1.00.05 are prone to information disclosure via a simple crafted request to index.asp on th CVE-2019-156579.8In eslint-utils before 1.4.1, the getStaticValue function can execute arbitrary code.CVE-2019-156587.3connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data.CVE-2019-156599.8The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.CVE-2019-15666.1The PAN-OS management web interface in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an unau CVE-2019-156608.8The wp-members plugin before 3.2.8 for WordPress has CSRF.CVE-2019-156617.2An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120004 in KfeCo10X64.sys fails to validate parameters, leadi CVE-2019-156622.7An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120444 in KfeCo10X64.sys fails to validate an offset passed CVE-2019-156632.7An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120404 in KfeCo10X64.sys fails to validate an offset passed