CVE-2019-15859

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get full access to a device via the /password.jsn URI.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Oct 9, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-15864.6A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated, local attacker with ph CVE-2019-158605.5Xpdf 2.00 allows a SIGSEGV in XRef::constructXRef in XRef.cc. NOTE: 2.00 is a version from November 2002.CVE-2019-158627.5An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any exten CVE-2019-158637.5The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants.CVE-2019-158646.1The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS.CVE-2019-158658.8The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF.CVE-2019-158668.8The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_im CVE-2019-158678.8The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber ca CVE-2019-158688.8The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.CVE-2019-158695.4The JobCareer theme before 2.5.1 for WordPress has stored XSS.CVE-2019-15874.3A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, re CVE-2019-158705.4The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.