CVE-2019-7238

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Mar 21, 2019
Last modified
Jun 17, 2026
Added to CISA KEV
Dec 10, 2021
NVD status
Analyzed

Related CVEs from 2019

CVE-2019-72407.2An issue was discovered in WinRing0x64.sys in Moo0 System Monitor 1.83. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x9C4020CVE-2019-72447.2An issue was discovered in kerneld.sys in AIDA64 before 5.99. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x80112084 and doeCVE-2019-72457.2An issue was discovered in GPU-Z.sys in TechPowerUp GPU-Z before 2.23.0. The vulnerable driver exposes a wrmsr instruction via an IOCTL and CVE-2019-72466.7An issue was discovered in atillk64.sys in AMD ATI Diagnostics Hardware Abstraction Sys/Overclocking Utility 5.11.9.0. The vulnerable driverCVE-2019-72479.8An issue was discovered in AODDriver2.sys in AMD OverDrive. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x81112ee0 and does CVE-2019-72499.8In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one useCVE-2019-72506.1An issue was discovered in the Cross Reference Add-on 36 for Google Docs. Stored XSS in the preview boxes in the configuration panel may allCVE-2019-72516.5An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 anCVE-2019-72529.8Linear eMerge E3-Series devices have Default Credentials.CVE-2019-72539.8Linear eMerge E3-Series devices allow Directory Traversal.CVE-2019-72547.5Linear eMerge E3-Series devices allow File Inclusion.CVE-2019-72556.1Linear eMerge E3-Series devices allow XSS.
CVE-2019-7238: Critical severity, CVSS 9.8 | Vulnix