CVE-2019-5404

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A remote script injection vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

VendorProductVersions
Hewlett Packard Enterprise (HPE)HPE 3PAR StoreServ Management and Core Software Mediaprior to 3.5.0.1

References

Timeline

Published
Aug 9, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-54057.3A remote authorization bypass vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5CVE-2019-54067.2A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1.CVE-2019-54076.3A remote information disclosure vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3CVE-2019-54086.5Command View Advanced Edition (CVAE) products contain a vulnerability that could expose configuration information of hosts and storage systeCVE-2019-54139.8An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.CVE-2019-54148.1If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of thCVE-2019-54157.5A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the vCVE-2019-54167.5A path traversal vulnerability in localhost-now npm package version 1.0.2 allows the attackers to read content of arbitrary files on the remCVE-2019-54177.5A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbitrary files on the remote servCVE-2019-54187.5There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accepCVE-2019-54197.5There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted aCVE-2019-54209.8A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically gene
CVE-2019-5404: High severity, CVSS 8.8 | Vulnix