CVE-2019-9541

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

: Information Exposure vulnerability in itemlookup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-200 CWE-79

Affected software

Vendor	Product	Versions
Telos	Automated Message Handling System	>= unspecified, < 4.1.5.5

References

https://www.kb.cert.org/vuls/id/873161/Third Party Advisory, US Government Resource
https://www.kb.cert.org/vuls/id/873161/Third Party Advisory, US Government Resource

Timeline

Published: Jan 3, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-95426.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in itemlookup.asp of Telos Automated Me CVE-2019-95438.8An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be CVE-2019-95448.8An issue was discovered in Bento4 1.5.1-628. An out of bounds write occurs in AP4_CttsTableEntry::AP4_CttsTableEntry() located in Core/Ap4Ar CVE-2019-95458.8An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be tri CVE-2019-95469.8SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service.CVE-2019-95475.3In Storage Performance Development Kit (SPDK) before 19.01, a malicious vhost client (i.e., virtual machine) could carefully construct a cir CVE-2019-954810.0Citrix Application Delivery Management (ADM) 12.1.x before 12.1.50.33 has Incorrect Access Control.CVE-2019-95498.8An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=user&act=addnew URI, as demonstrated by adding a lev CVE-2019-95504.8DhCms through 2017-09-18 has admin.php?r=admin/Index/index XSS.CVE-2019-95514.8An issue was discovered in DOYO (aka doyocms) 2.3 through 2015-05-06. It has admin.php XSS.CVE-2019-95529.8Eloan V3.0 through 2018-09-20 allows remote attackers to list files via a direct request to the p2p/api/ or p2p/lib/ or p2p/images/ URI.CVE-2019-95536.1Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933.