CVE-2019-10182

It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user.

• CWE-22
• CWE-94
• CWE-22

• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.html
• http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10182Issue Tracking, Third Party Advisory
• https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327Patch, Third Party Advisory
• https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/09/msg00008.html
• https://seclists.org/bugtraq/2019/Oct/5
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.html
• http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10182Issue Tracking, Third Party Advisory
• https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327Patch, Third Party Advisory
• https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/09/msg00008.html
• https://seclists.org/bugtraq/2019/Oct/5

Published

Jul 31, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10177A stored cross-site scripting (XSS) vulnerability was found …6.5
• CVE-2019-10178It was found that the Token Processing Service (TPS) did not…6.1
• CVE-2019-10179A vulnerability was found in all pki-core 10.x.x versions, w…6.1
• CVE-2019-1018An elevation of privilege vulnerability exists when DirectX …7
• CVE-2019-10180A vulnerability was found in all pki-core 10.x.x version, wh…4.8
• CVE-2019-10181It was found that in icedtea-web up to and including 1.7.2 a…8.1
• CVE-2019-10183Virt-install(1) utility used to provision new virtual machin…3.2
• CVE-2019-10184undertow before version 2.0.23.Final is vulnerable to an inf…7.5
• CVE-2019-10185It was found that icedtea-web up to and including 1.7.2 and …8.6
• CVE-2019-10186A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5…8.8
• CVE-2019-10187A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5…4.3
• CVE-2019-10188A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5…4.3