First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2019-20502

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in EFS Easy Chat Server 3.1. There is a buffer overflow via a long body2.ghp message parameter.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/s1kr10s/EasyChatServer-DOSExploit, Third Party Advisory
https://github.com/s1kr10s/EasyChatServer-DOSExploit, Third Party Advisory

Timeline

Published: Mar 5, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-205036.5usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.CVE-2019-205049.8service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 (6.4.120822) allows a remote attacker to execute code v CVE-2019-20517.5In heap of spaces.h, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosu CVE-2019-205116.1ERPNext 11.1.47 allows blog?blog_category= Frame Injection.CVE-2019-205126.1Open edX Ironwood.1 allows support/certificates?course_id= reflected XSS.CVE-2019-205136.1Open edX Ironwood.1 allows support/certificates?user= reflected XSS.CVE-2019-205146.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.CVE-2019-205156.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.CVE-2019-205166.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI.CVE-2019-205176.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.CVE-2019-205186.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.CVE-2019-205196.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address.