CVE-2019-18641

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Rock RMS before 1.8.6 mishandles vCard access control within the People/GetVCard/REST controller.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Mar 20, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-186429.8Rock RMS version before 8.6 is vulnerable to account takeover by tampering with the user ID parameter in the profile update feature. The lacCVE-2019-186439.8Rock RMS versions before 8.10 and versions 9.0 through 9.3 fails to properly validate files uploaded in the application. The only protectionCVE-2019-186445.9The malware scan function in Total Defense Anti-virus 11.5.2.28 is vulnerable to a TOCTOU bug; consequently, symbolic link attacks allow priCVE-2019-186455.5The quarantine restoration function in Total Defense Anti-virus 11.5.2.28 is vulnerable to symbolic link attacks, allowing files to be writtCVE-2019-186467.2The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColumn parameter when loCVE-2019-186477.2The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an admin user.CVE-2019-186484.8When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fCVE-2019-186494.8When logged in as an admin user, the Title input field (under Reports) within Untangle NG firewall 14.2.0 is vulnerable to stored XSS.CVE-2019-18658.8A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated,CVE-2019-186508.8An issue was discovered in Joomla! before 3.9.13. A missing token check in com_template causes a CSRF vulnerability.CVE-2019-186516.5A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute mCVE-2019-186526.1A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript
CVE-2019-18641: Critical severity, CVSS 9.8 | Vulnix