CVE-2019-16906

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. By using plugins/servlet/nfj/PushNotification?username= with a modified username, a different user's notifications can be read without authentication/authorization. These notifications are then no longer displayed to the normal user.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-306 CWE-862

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/154991/Infosysta-Jira-1.6.13_J8-Push-Notification-Authentication-Bypass.htmlThird Party Advisory, VDB Entry
https://seclists.org/bugtraq/2019/Nov/0Mailing List, Third Party Advisory
http://packetstormsecurity.com/files/154991/Infosysta-Jira-1.6.13_J8-Push-Notification-Authentication-Bypass.htmlThird Party Advisory, VDB Entry
https://seclists.org/bugtraq/2019/Nov/0Mailing List, Third Party Advisory

Timeline

Published: Oct 31, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-169075.3An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. It is possible to obtain a list of all val CVE-2019-169085.3An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14_J8 for Jira. It is possible to obtain a list of CVE-2019-169094.3An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14_J8 for Jira. It is possible to obtain a list of CVE-2019-16915.8A vulnerability in the detection engine of Cisco Firepower Threat Defense Software could allow an unauthenticated, remote attacker to cause CVE-2019-169105.3Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for b CVE-2019-169137.8PC Protect Antivirus v4.14.31 installs by default to %PROGRAMFILES(X86)%\PCProtect with very weak folder permissions, granting any user full CVE-2019-169146.1An XSS issue was discovered in pfSense through 2.4.4-p3. In services_captiveportal_mac.php, the username and delmac parameters are displayed CVE-2019-169159.8An issue was discovered in pfSense through 2.4.4-p3. widgets/widgets/picture.widget.php uses the widgetkey parameter directly without saniti CVE-2019-169178.8WiKID Enterprise 2FA (two factor authentication) Enterprise Server through 4.2.0-b2047 is vulnerable to SQL injection through the searchDevi CVE-2019-169197.5Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robo CVE-2019-16925.3A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) Software could allow an u CVE-2019-169209.8Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the