CVE-2019-19381

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

oauth/oauth2/v1/saml/ in Abacus OAuth Login 2019_01_r4_20191021_0000 before prior to R4 (20.11.2019 Hotfix) allows Reflected Cross Site Scripting (XSS) via an error message.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.compass-security.com/en/research/advisories/Third Party Advisory
https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2019-024_Abacus_Cross-Site_Scripting_XSS.txtExploit, Third Party Advisory
https://www.compass-security.com/en/research/advisories/Third Party Advisory
https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2019-024_Abacus_Cross-Site_Scripting_XSS.txtExploit, Third Party Advisory

Timeline

Published: Mar 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-193827.8Max Secure Anti Virus Plus 19.0.4.020 has Insecure Permissions on the installation directory. Local attackers can replace a .exe or .dll fil CVE-2019-193838.8freeFTPd 1.0.8 has a Post-Authentication Buffer Overflow via a crafted SIZE command (this is exploitable even if logging is disabled).CVE-2019-193846.1A cross-site scripting (XSS) vulnerability in app/fax/fax_log_view.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web sc CVE-2019-193856.1A cross-site scripting (XSS) vulnerability in app/dialplans/dialplans.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web CVE-2019-193866.1A cross-site scripting (XSS) vulnerability in app/voicemail_greetings/voicemail_greeting_edit.php in FusionPBX 4.4.1 allows remote attackers CVE-2019-193876.1A cross-site scripting (XSS) vulnerability in app/fifo_list/fifo_interactive.php in FusionPBX 4.4.1 allows remote attackers to inject arbitr CVE-2019-193886.1A cross-site scripting (XSS) vulnerability in app/dialplans/dialplan_detail_edit.php in FusionPBX 4.4.1 allows remote attackers to inject ar CVE-2019-193895.4JetBrains Ktor framework before version 1.2.6 was vulnerable to HTTP Response Splitting.CVE-2019-19398.8A vulnerability in the Cisco Webex Teams client for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands on CVE-2019-193905.4The Search parameter of the Software Catalogue section of Matrix42 Workspace Management 9.1.2.2765 and below accepts unfiltered parameters t CVE-2019-193919.1In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrar CVE-2019-193929.8The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (create) new users with