CVE-2019-7238

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Mar 21, 2019
Last modified
Jun 17, 2026
Added to CISA KEV
Dec 10, 2021
NVD status
Analyzed

Related CVEs from 2019

CVE-2019-72407.2An issue was discovered in WinRing0x64.sys in Moo0 System Monitor 1.83. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x9C4020CVE-2019-72447.2An issue was discovered in kerneld.sys in AIDA64 before 5.99. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x80112084 and doeCVE-2019-72457.2An issue was discovered in GPU-Z.sys in TechPowerUp GPU-Z before 2.23.0. The vulnerable driver exposes a wrmsr instruction via an IOCTL and CVE-2019-72466.7An issue was discovered in atillk64.sys in AMD ATI Diagnostics Hardware Abstraction Sys/Overclocking Utility 5.11.9.0. The vulnerable driverCVE-2019-72479.8An issue was discovered in AODDriver2.sys in AMD OverDrive. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x81112ee0 and does CVE-2019-72499.8In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one useCVE-2019-72506.1An issue was discovered in the Cross Reference Add-on 36 for Google Docs. Stored XSS in the preview boxes in the configuration panel may allCVE-2019-72516.5An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 anCVE-2019-72529.8Linear eMerge E3-Series devices have Default Credentials.CVE-2019-72539.8Linear eMerge E3-Series devices allow Directory Traversal.CVE-2019-72547.5Linear eMerge E3-Series devices allow File Inclusion.CVE-2019-72556.1Linear eMerge E3-Series devices allow XSS.
CVE-2019-7238: Critical severity, CVSS 9.8 | Vulnix