CVE-2019-19788

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Opera for Android before 54.0.2669.49432 is vulnerable to a sandboxed cross-origin iframe bypass attack. By using a service working inside a sandboxed iframe it is possible to bypass the normal sandboxing attributes. This allows an attacker to make forced redirections without any user interaction from a third-party context.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published
Dec 18, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-197896.53S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLCWinNT before V2.4.7.5CVE-2019-197909.8Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with extension .BMP, .EXIF, .CVE-2019-197919.8In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restrict access to SOAP/RESCVE-2019-197926.7A permissions issue in ESET Cyber Security before 6.8.300.0 for macOS allows a local attacker to escalate privileges by appending data to roCVE-2019-197938.8In Cyxtera AppGate SDP Client 4.1.x through 4.3.x before 4.3.2 on Windows, a local or remote user from the same domain can gain privileges.CVE-2019-197945.9The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because mathCVE-2019-197957.8samurai 0.7 has a heap-based buffer overflow in canonpath in util.c via a crafted build file.CVE-2019-197967.8Yabasic 2.86.2 has a heap-based buffer overflow in myformat in function.c via a crafted BASIC source file.CVE-2019-197975.5read_colordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write.CVE-2019-197995.3Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieCVE-2019-19805.3A vulnerability in the protocol detection component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, aCVE-2019-198005.3Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelper
CVE-2019-19788: Medium severity, CVSS 5.5 | Vulnix