CVE-2019-9889

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. The issue results in a require call using a crafted type value, leading to Directory Traversal with File Inclusion. An attacker can leverage this vulnerability to execute code under the context of the web server.

Metrics

CVSS 3.0 2.7/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Mar 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-98909.1An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.CVE-2019-98919.8The function getopt_simple as described in Advanced Bash Scripting Guide (ISBN 978-1435752184) allows privilege escalation and execution of CVE-2019-98926.5An issue was discovered in Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who CVE-2019-98939.8libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), whic CVE-2019-98947.5A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.CVE-2019-98959.8In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding.CVE-2019-98967.8In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same director CVE-2019-98977.5Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.CVE-2019-98989.8Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71.CVE-2019-99008.3When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote at CVE-2019-990110.0Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass a CVE-2019-99036.5PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located