First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2019-18355

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://thycotic.force.com/support/s/article/SS-RN-EXT-Secret-Server-10-7-000000-Legacy-Release-NotesRelease Notes, Vendor Advisory
https://thycotic.force.com/support/s/article/SS-RN-EXT-Secret-Server-10-7-000000-Legacy-Release-NotesRelease Notes, Vendor Advisory

Timeline

Published: Oct 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-183566.1An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 1 of 2).CVE-2019-183576.1An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 2 of 2).CVE-2019-183595.5A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The vulnerability causes an application crash, which leads CVE-2019-18367.1A vulnerability in the system shell for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow CVE-2019-183605.3In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery.CVE-2019-183615.3JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code execution.CVE-2019-183625.3JetBrains MPS before 2019.2.2 exposed listening ports to the network.CVE-2019-183635.3In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumsta CVE-2019-183649.8In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution.CVE-2019-183654.3In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages.CVE-2019-183665.3In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission.CVE-2019-183675.3In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions.