CVE-2019-7306

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
Canonical	byobu	>= unspecified, < 5.128-0ubuntu1

References

https://bugs.launchpad.net/ubuntu/+source/byobu/+bug/1827202Exploit, Third Party Advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7306Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/byobu/+bug/1827202Exploit, Third Party Advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7306Third Party Advisory

Timeline

Published: Apr 17, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-73077.0Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOC CVE-2019-73085.6kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various case CVE-2019-73095.5In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating CVE-2019-73107.8In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remot CVE-2019-73117.8An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. A lack of encryption in how the user login cookie (admin-auth) is stored CVE-2019-73125.3Limited plaintext disclosure exists in PRIMX Zed Entreprise for Windows before 6.1.2240, Zed Entreprise for Windows (ANSSI qualification sub CVE-2019-73136.1www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect param CVE-2019-73149.8liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could CVE-2019-73157.5Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.x are vulnerable to directory traversal via the web interfac CVE-2019-73169.8An issue was discovered in CSS-TRICKS Chat2 through 2015-05-05. The userid parameter in jumpin.php has a SQL injection vulnerability.CVE-2019-73175.3png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.CVE-2019-73198.3An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0. When using one of following authentication backends: LdapBackend, PamBackend, S