CVE-2019-18346

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests in the name of the user to the application. If the attacked user is an administrator, the attacker could for example add a new admin user.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Dec 4, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-183475.4A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unpr CVE-2019-183486.1An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the at CVE-2019-183499.8HotkeyP through 4.9 r96 allows privilege escalation in the privilege function in Commands.cpp.CVE-2019-18354.4A vulnerability in the CLI of Cisco Aironet Access Points (APs) could allow an authenticated, local attacker to access sensitive information CVE-2019-183506.1In Ant Design Pro 4.0.0, reflected XSS in the user/login redirect GET parameter affects the authorization component, leading to execution of CVE-2019-183528.2Improper access control exists on PHOENIX CONTACT FL NAT 2208 devices before V2.90 and FL NAT 2304-2GC-2SFP devices before V2.90 when using CVE-2019-183559.8An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7.CVE-2019-183566.1An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 1 of 2).CVE-2019-183576.1An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 2 of 2).CVE-2019-183595.5A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The vulnerability causes an application crash, which leads CVE-2019-18367.1A vulnerability in the system shell for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow CVE-2019-183605.3In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery.