CVE-2019-20070

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

On Netis DL4323 devices, XSS exists via the urlFQDN parameter to form2url.cgi (aka the Keyword field of the URL Blocking Configuration).

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Dec 30, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-200716.5On Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs.CVE-2019-200726.1On Netis DL4323 devices, XSS exists via the form2Ddns.cgi hostname parameter (Dynamic DNS Configuration).CVE-2019-200736.1On Netis DL4323 devices, XSS exists via the form2userconfig.cgi username parameter (User Account Configuration).CVE-2019-200748.8On Netis DL4323 devices, any user role can view sensitive information, such as a user password or the FTP password, via the form2saveConf.cgCVE-2019-200756.1On Netis DL4323 devices, pingrtt_v6.html has XSS (Ping6 Diagnostic).CVE-2019-200766.1On Netis DL4323 devices, XSS exists via the form2Ddns.cgi username parameter (DynDns settings of the Dynamic DNS Configuration).CVE-2019-200774.3The Typesetter CMS 5.1 logout functionality is affected by a CSRF vulnerability. The logout function of the admin panel is not protected by CVE-2019-200797.8The autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory.CVE-2019-20087.5In createEffect of AudioFlinger.cpp, there is a possible memory corruption due to a race condition. This could lead to local escalation of pCVE-2019-200829.8ASUS RT-N53 3.0.0.4.376.3754 devices have a buffer overflow via a long lan_dns1_x or lan_dns2_x parameter to Advanced_LAN_Content.asp.CVE-2019-200857.5TVT NVMS-1000 devices allow GET /.. Directory TraversalCVE-2019-200868.8GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_Next in GPMF_parser.c.
CVE-2019-20070: Medium severity, CVSS 6.1 | Vulnix