CVE-2019-16767

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The admin sys mode is now conditional and dedicated for the special case. By default, since ezmaster@5.2.11 no instance (container) is launched with advanced capabilities (not launched as root)

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-250

Affected software

Vendor	Product	Versions
Inist-CNRS	ezmaster	>= < 5.2.11, < 5.2.11

References

https://github.com/Inist-CNRS/ezmaster/blob/master/CHANGELOG.md#ezmaster-5211Third Party Advisory
https://github.com/Inist-CNRS/ezmaster/pull/51Patch, Third Party Advisory
https://github.com/Inist-CNRS/ezmaster/security/advisories/GHSA-g654-5qjf-g6cxThird Party Advisory
https://github.com/Inist-CNRS/ezmaster/blob/master/CHANGELOG.md#ezmaster-5211Third Party Advisory
https://github.com/Inist-CNRS/ezmaster/pull/51Patch, Third Party Advisory
https://github.com/Inist-CNRS/ezmaster/security/advisories/GHSA-g654-5qjf-g6cxThird Party Advisory

Timeline

Published: Nov 29, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-167684.3In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Secu CVE-2019-167695.4The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against CVE-2019-16774.6A vulnerability in Cisco Webex Meetings for Android could allow an unauthenticated, local attacker to perform a cross-site scripting attack CVE-2019-167707.5In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a den CVE-2019-167716.5Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject a CVE-2019-167726.1The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsa CVE-2019-167749.8In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.CVE-2019-167756.5Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files o CVE-2019-167768.1Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the inte CVE-2019-167776.5Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binar CVE-2019-167789.8In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this c CVE-2019-167795.9In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as b