CVE-2019-18958

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Nitro Pro before 13.2 creates a debug.log file in the directory where a .pdf file is located, if the .pdf document was produced by an OCR operation on the JPEG output of a scanner. Reportedly, this can have a security risk if debug.log is later edited and then executed.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://a-man-in-the-cookie.blogspot.com/2019/11/nitro-pro-vulnerability.htmlExploit, Third Party Advisory
https://a-man-in-the-cookie.blogspot.com/2019/11/nitro-pro-vulnerability.htmlExploit, Third Party Advisory

Timeline

Published: Nov 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-18967.2A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote a CVE-2019-189609.8Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0. This can result in potentially exploitable crashes.CVE-2019-18975.3A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote att CVE-2019-189767.5An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invi CVE-2019-189785.3An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access p CVE-2019-189797.8Adaware antivirus 12.6.1005.11662 and 12.7.1055.0 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS director CVE-2019-18985.3A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote att CVE-2019-189807.5On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's o CVE-2019-189819.8Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.CVE-2019-189826.1bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window bec CVE-2019-189859.8Pimcore before 6.2.2 lacks brute force protection for the 2FA token.CVE-2019-189867.5Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns disti