CVE-2019-16774

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Dec 12, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-167756.5Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files oCVE-2019-167768.1Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the inteCVE-2019-167776.5Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binarCVE-2019-167789.8In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this cCVE-2019-167795.9In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as bCVE-2019-16784.3A vulnerability in Cisco Meeting Server could allow an authenticated, remote attacker to cause a partial denial of service (DoS) to Cisco MeCVE-2019-167805.4WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is CVE-2019-167815.4In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, whiCVE-2019-167825.9There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 CVE-2019-167847.8In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a softCVE-2019-167857.5Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and heCVE-2019-167867.5Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunk
CVE-2019-16774: Critical severity, CVSS 9.8 | Vulnix