CVE-2019-16774

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-502

Affected software

Vendor	Product	Versions
PHPSocialNetwork	phpfastcache	>= < 5.1.3, < 5.1.3

References

https://github.com/PHPSocialNetwork/phpfastcache/commit/c4527205cb7a402b595790c74310791f5b04a1a4Patch, Third Party Advisory
https://github.com/PHPSocialNetwork/phpfastcache/releases/tag/5.0.13Release Notes, Third Party Advisory
https://github.com/PHPSocialNetwork/phpfastcache/security/advisories/GHSA-484f-743f-6jx2Third Party Advisory
https://github.com/PHPSocialNetwork/phpfastcache/commit/c4527205cb7a402b595790c74310791f5b04a1a4Patch, Third Party Advisory
https://github.com/PHPSocialNetwork/phpfastcache/releases/tag/5.0.13Release Notes, Third Party Advisory
https://github.com/PHPSocialNetwork/phpfastcache/security/advisories/GHSA-484f-743f-6jx2Third Party Advisory

Timeline

Published: Dec 12, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-167756.5Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files o CVE-2019-167768.1Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the inte CVE-2019-167776.5Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binar CVE-2019-167789.8In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this c CVE-2019-167795.9In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as b CVE-2019-16784.3A vulnerability in Cisco Meeting Server could allow an authenticated, remote attacker to cause a partial denial of service (DoS) to Cisco Me CVE-2019-167805.4WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is CVE-2019-167815.4In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, whi CVE-2019-167825.9There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 CVE-2019-167847.8In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a soft CVE-2019-167857.5Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and he CVE-2019-167867.5Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunk