CVE-2019-16935

MediumCVSS 6.1/10Last modified Oct 7, 2026

Description

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 28, 2019
Last modified
Oct 7, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-16948.6A vulnerability in the TCP processing engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) SoCVE-2019-169419.8NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns ECVE-2019-169429.8A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globallCVE-2019-169439.8A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globallCVE-2019-169489.8An SSRF issue was discovered in Enghouse Web Chat 6.1.300.31. In any POST request, one can replace the port number at WebServiceLocation=httCVE-2019-169496.5An issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. A user is allowed to send an archive of their chat log to an email aCVE-2019-16956.5A vulnerability in the detection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) SoftwarCVE-2019-169506.1An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion ofCVE-2019-169515.3A remote file include (RFI) issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribute with one's own domCVE-2019-169545.4SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket.CVE-2019-169555.4SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request.CVE-2019-169565.4SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket.