CVE-2019-9920

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to perform an action within the context of the account of another user.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://extensions.joomla.org/extension/je-messenger/Product, Third Party Advisory
https://github.com/azd-cert/CVE/blob/master/CVEs/CVE-2019-9920.mdThird Party Advisory
https://extensions.joomla.org/extension/je-messenger/Product, Third Party Advisory
https://github.com/azd-cert/CVE/blob/master/CVEs/CVE-2019-9920.mdThird Party Advisory

Timeline

Published: Mar 29, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-99216.5An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to read information that should only be acces CVE-2019-99227.5An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. Directory Traversal allows read access to arbitrary files.CVE-2019-99237.5pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extend CVE-2019-99247.8rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with t CVE-2019-99256.1S-CMS PHP v1.0 has XSS in 4.edu.php via the S_id parameter.CVE-2019-99268.8An issue was discovered in LabKey Server 19.1.0. It is possible to force a logged-in administrator to execute code through a /reports-viewSc CVE-2019-99279.8Caret before 2019-02-22 allows Remote Code Execution.CVE-2019-99288.8GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially all CVE-2019-99298.8Northern.tech CFEngine Enterprise 3.12.1 has Insecure Permissions.CVE-2019-99309.8Various Lexmark products have an Integer Overflow.CVE-2019-99317.5Various Lexmark printers contain a denial of service vulnerability in the SNMP service that can be exploited to crash the device.CVE-2019-99329.8Various Lexmark products have a Buffer Overflow (issue 2 of 3).