CVE-2019-16907

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. It is possible to obtain a list of all valid Jira usernames without authentication/authorization via the plugins/servlet/nfj/UserFilter?searchQuery=@ URI.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-306 CWE-862

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/154993/Infosysta-Jira-1.6.13_J8-User-Name-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
https://seclists.org/bugtraq/2019/Nov/0Mailing List, Third Party Advisory
http://packetstormsecurity.com/files/154993/Infosysta-Jira-1.6.13_J8-User-Name-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
https://seclists.org/bugtraq/2019/Nov/0Mailing List, Third Party Advisory

Timeline

Published: Oct 31, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-169085.3An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14_J8 for Jira. It is possible to obtain a list of CVE-2019-169094.3An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14_J8 for Jira. It is possible to obtain a list of CVE-2019-16915.8A vulnerability in the detection engine of Cisco Firepower Threat Defense Software could allow an unauthenticated, remote attacker to cause CVE-2019-169105.3Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for b CVE-2019-169137.8PC Protect Antivirus v4.14.31 installs by default to %PROGRAMFILES(X86)%\PCProtect with very weak folder permissions, granting any user full CVE-2019-169146.1An XSS issue was discovered in pfSense through 2.4.4-p3. In services_captiveportal_mac.php, the username and delmac parameters are displayed CVE-2019-169159.8An issue was discovered in pfSense through 2.4.4-p3. widgets/widgets/picture.widget.php uses the widgetkey parameter directly without saniti CVE-2019-169178.8WiKID Enterprise 2FA (two factor authentication) Enterprise Server through 4.2.0-b2047 is vulnerable to SQL injection through the searchDevi CVE-2019-169197.5Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robo CVE-2019-16925.3A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) Software could allow an u CVE-2019-169209.8Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the CVE-2019-169217.5In the Linux kernel before 4.17, hns_roce_alloc_ucontext in drivers/infiniband/hw/hns/hns_roce_main.c does not initialize the resp data stru