CVE-2019-20504

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 (6.4.120822) allows a remote attacker to execute code via shell metacharacters in the kuid parameter.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Mar 9, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-20517.5In heap of spaces.h, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosuCVE-2019-205116.1ERPNext 11.1.47 allows blog?blog_category= Frame Injection.CVE-2019-205126.1Open edX Ironwood.1 allows support/certificates?course_id= reflected XSS.CVE-2019-205136.1Open edX Ironwood.1 allows support/certificates?user= reflected XSS.CVE-2019-205146.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.CVE-2019-205156.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.CVE-2019-205166.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI.CVE-2019-205176.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.CVE-2019-205186.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.CVE-2019-205196.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address.CVE-2019-20527.5In VisitPointers of heap.cc, there is a possible out-of-bounds read due to type confusion. This could lead to remote information disclosure CVE-2019-205206.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI.
CVE-2019-20504: Critical severity, CVSS 9.8 | Vulnix