CVE-2019-16116

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file. This allows an attacker to obtain the administrator password hash.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-327 CWE-532

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://enterprisedt.com/products/completeftp/doc/guide/html/history.htmlRelease Notes, Vendor Advisory
https://rhinosecuritylabs.com/application-security/completeftp-server-local-privesc-cve-2019-16116/Exploit, Third Party Advisory
https://enterprisedt.com/products/completeftp/doc/guide/html/history.htmlRelease Notes, Vendor Advisory
https://rhinosecuritylabs.com/application-security/completeftp-server-local-privesc-cve-2019-16116/Exploit, Third Party Advisory

Timeline

Published: Oct 2, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-161176.1Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.p CVE-2019-161186.1Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Option CVE-2019-161199.8SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries CVE-2019-16126.7A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underly CVE-2019-161208.8CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Expo CVE-2019-161237.5In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File Disclosure.CVE-2019-161249.8In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configurati CVE-2019-161259.8In Jobberbase 2.0, the parameter category is not sanitized in public/page_subscribe.php, leading to /subscribe SQL injection.CVE-2019-161266.1Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images.CVE-2019-161279.1Atmel Advanced Software Framework (ASF) 4 has an Integer Overflow.CVE-2019-161286.8Microchip CryptoAuthentication Library CryptoAuthLib prior to 20191122 has a Buffer Overflow (issue 1 of 2).CVE-2019-161296.8Microchip CryptoAuthentication Library CryptoAuthLib prior to 20191122 has a Buffer Overflow (issue 2 of 2).