CVE-2019-19450

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-91

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Sep 20, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-194515.5When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an enCVE-2019-194527.8A buffer overflow was found in Patriot Viper RGB through 1.1 when processing IoControlCode 0x80102040. Local attackers (including low integrCVE-2019-194535.4Wowza Streaming Engine before 4.8.5 allows XSS (issue 1 of 2). An authenticated user, with access to the proxy license editing is able to inCVE-2019-194547.5An arbitrary file download was found in the "Download Log" functionality of Wowza Streaming Engine <= 4.x.x. This issue was resolved in WowzCVE-2019-194557.8Wowza Streaming Engine before 4.8.5 has Insecure Permissions which may allow a local attacker to escalate privileges in / usr / local / WowzCVE-2019-194566.1A Reflected XSS was found in the server selection box inside the login page at: enginemanager/loginfailed.html in Wowza Streaming Engine <= CVE-2019-194575.4SALTO ProAccess SPACE 5.4.3.0 allows XSS.CVE-2019-194588.6SALTO ProAccess SPACE 5.4.3.0 allows Directory Traversal in the Data Export feature.CVE-2019-194599.8An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. An attacker can write arbitrary content to arbitrary files, as demonstrated by CVECVE-2019-19466.5A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticatedCVE-2019-194605.5An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. The product's webserver runs as a Windows service with local SYSTEM permissions byCVE-2019-194615.4Post-authentication Stored XSS in Team Password Manager through 7.93.204 allows attackers to steal other users' credentials by creating a sh