CVE-2019-10181

It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.

• CWE-345
• CWE-345

• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.htmlThird Party Advisory
• http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.htmlThird Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10181Issue Tracking, Third Party Advisory
• https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327Third Party Advisory
• https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/09/msg00008.htmlThird Party Advisory
• https://seclists.org/bugtraq/2019/Oct/5Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202107-51Patch, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.htmlThird Party Advisory
• http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.htmlThird Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10181Issue Tracking, Third Party Advisory
• https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327Third Party Advisory
• https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/09/msg00008.htmlThird Party Advisory
• https://seclists.org/bugtraq/2019/Oct/5Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202107-51Patch, Third Party Advisory

Published

Jul 31, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10176A flaw was found in OpenShift Container Platform, versions 3…4.2
• CVE-2019-10177A stored cross-site scripting (XSS) vulnerability was found …6.5
• CVE-2019-10178It was found that the Token Processing Service (TPS) did not…6.1
• CVE-2019-10179A vulnerability was found in all pki-core 10.x.x versions, w…6.1
• CVE-2019-1018An elevation of privilege vulnerability exists when DirectX …7
• CVE-2019-10180A vulnerability was found in all pki-core 10.x.x version, wh…4.8
• CVE-2019-10182It was found that icedtea-web though 1.7.2 and 1.8.2 did not…8.2
• CVE-2019-10183Virt-install(1) utility used to provision new virtual machin…3.2
• CVE-2019-10184undertow before version 2.0.23.Final is vulnerable to an inf…7.5
• CVE-2019-10185It was found that icedtea-web up to and including 1.7.2 and …8.6
• CVE-2019-10186A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5…8.8
• CVE-2019-10187A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5…4.3