CVE-2019-16700

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The slub_events (aka SLUB: Event Registration) extension through 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver. For versions 1.2.2 and below, this results in Remote Code Execution. In versions later than 1.2.2, this can result in Denial of Service, since the web space can be filled up with arbitrary files.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://extensions.typo3.org/extension/slub_eventsThird Party Advisory
https://typo3.org/security/advisory/typo3-ext-sa-2019-017/Third Party Advisory
https://extensions.typo3.org/extension/slub_eventsThird Party Advisory
https://typo3.org/security/advisory/typo3-ext-sa-2019-017/Third Party Advisory

Timeline

Published: Oct 16, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-167018.8pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing sh CVE-2019-167029.8Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /Logi CVE-2019-167036.1admin/infolist_add.php in PHPMyWind 5.6 has stored XSS.CVE-2019-167044.8admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS.CVE-2019-167059.1Ming (aka libming) 0.4.8 has an out of bounds read vulnerability in the function OpCode() in the decompile.c file in libutil.a.CVE-2019-167068.8kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cms_user_add.php.CVE-2019-167076.5Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.CVE-2019-167086.5ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage.CVE-2019-167096.5ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage.CVE-2019-16716.1A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote atta CVE-2019-167106.5ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in MagickCore/memory.c.CVE-2019-167116.5ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c.