CVE-2019-17393

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP (in cleartext) that can be sniffed by unauthorized actors. Basic authentication is used for the authentication, making it possible to base64 decode the sniffed credentials and discover the username and password.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-319CWE-522

Affected software

No affected versions have been published.

Timeline

Published
Oct 18, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-173949.8In the Seesaw Parent and Family application 6.2.5 for Android, the username and password are stored in the log during authentication, and maCVE-2019-173959.8In the Rapid Gator application 0.7.1 for Android, the username and password are stored in the log during authentication, and may be availablCVE-2019-173969.8In the PowerSchool Mobile application 1.1.8 for Android, the username and password are stored in the log during authentication, and may be aCVE-2019-173979.8In the DoorDash application through 11.5.2 for Android, the username and password are stored in the log during authentication, and may be avCVE-2019-173989.8In the Dark Horse Comics application 1.3.21 for Android, token information (equivalent to the username and password) is stored in the log duCVE-2019-173999.8The Shack Forms Pro extension before 4.0.32 for Joomla! allows path traversal via a file attachment.CVE-2019-17408.6A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS Software and Cisco IOS XE Software could allow an uCVE-2019-174007.5The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.CVE-2019-174013.3libyal liblnk 20191006 has a heap-based buffer over-read in the network_share_name_offset>20 code block of liblnk_location_information_read_CVE-2019-174026.5Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectCVE-2019-174038.8Nokia IMPACT < 18A: An unrestricted File Upload vulnerability was found that may lead to Remote Code Execution.CVE-2019-174044.3Nokia IMPACT < 18A: allows full path disclosure
CVE-2019-17393: Critical severity, CVSS 9.8 | Vulnix