What’s Vulnerable › Vulnerabilities

CVE-2019-10219

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-11-08 · updated 2026-10-08
• Weakness: CWE-79

Description

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

Affected products

• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• NetApp Element: all versions
• NetApp Management Services For Element Software And Netapp Hci: all versions
• NetApp SnapCenter Plugin for VMware vSphere: all versions
• Oracle Corporation Oracle Access Manager: 11.1.2.3.0, 12.2.1.3.0, 12.2.1.4.0
• Oracle Corporation Oracle Agile Engineering Data Management: 6.2.1.0
• Oracle Agile Product Lifecycle Analytics: 3.6.1
• Oracle Corporation Oracle Agile PLM: 9.3.3, 9.3.6
• Oracle Agile Product Lifecycle Management Integration Pack: 3.6
• Oracle Airlines Data Model: 12.1.1.0.0, 12.2.0.1.0
• Oracle Corporation Application Express: 21.1.4
• Oracle Corporation APM - Application Performance Management: 13.4.1.0, 13.5.1.0
• Oracle Corporation Oracle Application Testing Suite: 13.3.0.1
• Oracle Argus Analytics: 8.2.1, 8.2.2, 8.2.3, 8.21
• Oracle Argus Insight: 8.2.1, 8.2.2, 8.2.3
• Oracle Corporation Argus Safety: 8.2.1, 8.2.2, 8.2.3
• Oracle Banking Apis: 18.1, 18.2, 18.3, 19.1, 19.2, 20.1 (+1)
• Oracle Banking Deposits And Lines Of Credit Servicing: 2.12.0
• Oracle Corporation Banking Digital Experience: 17.2, 18.1, 18.3, 19.1, 19.2, 20.1 (+1)
• Oracle Banking Enterprise Default Management: 2.6.2, 2.7.0, 2.7.1, 2.10.0, 2.12.0
• Oracle Banking Enterprise Default Managment: from 2.3.0 through 2.4.0
• Oracle Banking Loans Servicing: 2.12.0
• Oracle Banking Party Management: 2.7.0
• Oracle Banking Platform: from 2.3.0 through 2.4.1; 2.6.2, 2.7.0, 2.7.1
• Oracle Corporation Oracle BI Publisher: 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
• Oracle Big Data Spatial And Graph: 23.1
• Oracle Business Activity Monitoring: 12.2.1.4.0
• Oracle Corporation Oracle Business Intelligence Enterprise Edition: 5.5.0.0.0, 5.9.0.0.0, 12.2.1.3.0, 12.2.1.4.0
• Oracle Corporation Oracle Business Process Management Suite: 12.2.1.3.0, 12.2.1.4.0
• Oracle Clinical: 5.2.1, 5.2.2

References

• https://access.redhat.com/errata/RHSA-2020:0159
• https://access.redhat.com/errata/RHSA-2020:0160
• https://access.redhat.com/errata/RHSA-2020:0161
• https://access.redhat.com/errata/RHSA-2020:0164
• https://access.redhat.com/errata/RHSA-2020:0445
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219
• https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56cee
• https://github.com/hibernate/hibernate-validator/commit/20d729548511ac5cff6fd459f93de137195420fe
• https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-10219
• https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Origin/CVE-2019-10219/exploit
• https://lists.apache.org/thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6%40%3Cnotifications.accumulo.apache.org%3E
• https://lists.apache.org/thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba09114897d%40%3Cnotifications.accumulo.apache.org%3E

Get alerted when CVE-2019-10219 or the next vulnerability affects your stack