CVE-2019-16133

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the account names and passwords of all employees in the company can be obtained by an ordinary account. Specifically, the attacker sends a jsessionid value for URIs under app/profile/summary/.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-161377.5An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used. Because memory ordering is mishandled, two writers canCVE-2019-161389.8An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninCVE-2019-161399.8An issue was discovered in the compact_arena crate before 0.4.0 for Rust. Generativity is mishandled, leading to an out-of-bounds write or rCVE-2019-16148.8A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands wiCVE-2019-161409.8An issue was discovered in the chttp crate before 0.1.3 for Rust. There is a use-after-free during buffer conversion.CVE-2019-161417.5An issue was discovered in the once_cell crate before 1.0.1 for Rust. There is a panic during initialization of Lazy.CVE-2019-161429.8An issue was discovered in the renderdoc crate before 0.5.0 for Rust. Multiple exposed methods take self by immutable reference, which is inCVE-2019-161439.8An issue was discovered in the blake2 crate before 0.8.1 for Rust. The BLAKE2b and BLAKE2s algorithms, when used with HMAC, produce incorrecCVE-2019-161447.5An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield_ during API caCVE-2019-161456.1The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.CVE-2019-161464.8Gophish through 0.8.0 allows XSS via a username.CVE-2019-161476.1Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib.
CVE-2019-16133: Medium severity, CVSS 6.5 | Vulnix