CVE-2019-16298

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Open Network Operating System (ONOS) 1.14. In the virtual broadband network gateway application (org.onosproject.virtualbng), the host event listener does not handle the following event types: HOST_MOVED, HOST_REMOVED, HOST_UPDATED. In combination with other applications, this could lead to the absence of intended code execution.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-755

Affected software

No affected versions have been published.

Timeline

Published
Feb 20, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-162997.5An issue was discovered in Open Network Operating System (ONOS) 1.14. In the mobility application (org.onosproject.mobility), the host eventCVE-2019-16305.5A vulnerability in the firmware signature checking program of Cisco Integrated Management Controller (IMC) could allow an authenticated, locCVE-2019-163007.5An issue was discovered in Open Network Operating System (ONOS) 1.14. In the access control application (org.onosproject.acl), the host evenCVE-2019-163017.5An issue was discovered in Open Network Operating System (ONOS) 1.14. In the virtual tenant network application (org.onosproject.vtn), the hCVE-2019-163027.5An issue was discovered in Open Network Operating System (ONOS) 1.14. In the Ethernet VPN application (org.onosproject.evpnopenflow), the hoCVE-2019-163039.8A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of CVE-2019-163058.8In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. A crafted link can trigger a popup asking whether the uCVE-2019-163076.1A Reflected Cross-Site Scripting (XSS) vulnerability in the webEx module in webExMeetingLogin.jsp and deleteWebExMeetingCheck.jsp in Fuji XeCVE-2019-163099.8FlameCMS 3.3.5 has SQL injection in account/login.php via accountName.CVE-2019-16315.3A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remoteCVE-2019-163105.4NIUSHOP V1.11 has XSS via the index.php?s=/admin URI.CVE-2019-163118.8NIUSHOP V1.11 has CSRF via search_info to index.php.