CVE-2019-7219

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE: this is a discontinued product. The issue was fixed in later Zarafa Webapp versions; however, some former Zarafa Webapp customers use the related Kopano product instead.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/verifysecurity/CVE-2019-7219Third Party Advisory
https://stash.kopano.io/repos?visibility=publicThird Party Advisory
https://github.com/verifysecurity/CVE-2019-7219Third Party Advisory
https://stash.kopano.io/repos?visibility=publicThird Party Advisory

Timeline

Published: Apr 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-72206.1X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter.CVE-2019-72217.8The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.CVE-2019-72225.5The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.CVE-2019-72235.4InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create CVE-2019-72258.8The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These cred CVE-2019-72268.8The ABB IDAL HTTP server CGI interface contains a URL that allows an unauthenticated attacker to bypass authentication and gain access to pr CVE-2019-72277.3In the ABB IDAL FTP server, an authenticated attacker can traverse to arbitrary directories on the hard disk with "CWD ../" and then use the CVE-2019-72288.8The ABB IDAL HTTP server mishandles format strings in a username or cookie during the authentication process. Attempting to authenticate wit CVE-2019-72298.3The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card t CVE-2019-72308.8The ABB IDAL FTP server mishandles format strings in a username during the authentication process. Attempting to authenticate with the usern CVE-2019-72315.7The ABB IDAL FTP server is vulnerable to a buffer overflow when a long string is sent by an authenticated attacker. This overflow is handled CVE-2019-72328.8The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. The Host header value overflow