CVE-2019-10767

An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adapter file. **Note:** The attacker has to be logged in if the authentication is enabled (by default isn't enabled).

• CWE-22

• https://github.com/ioBroker/ioBroker.js-controller/commit/f6e292c6750a491a5000d0f851b2fede4f9e2fdaPatch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-IOBROKERJSCONTROLLER-534881Exploit, Third Party Advisory
• https://github.com/ioBroker/ioBroker.js-controller/commit/f6e292c6750a491a5000d0f851b2fede4f9e2fdaPatch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-IOBROKERJSCONTROLLER-534881Exploit, Third Party Advisory

Published

Nov 21, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10761This affects the package vm2 before 3.6.11. It is possible t…8.3
• CVE-2019-10762columnQuote in medoo before 1.7.5 allows remote attackers to…9.8
• CVE-2019-10763pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection.…6.5
• CVE-2019-10764In elliptic-php versions priot to 1.0.6, Timing attacks migh…7.4
• CVE-2019-10765iobroker.admin before 3.6.12 allows attacker to include file…9.8
• CVE-2019-10766Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 al…9.8
• CVE-2019-10768In AngularJS before 1.7.9 the function `merge()` could be tr…7.5
• CVE-2019-10769safer-eval is a npm package to sandbox the he evaluation of …9.8
• CVE-2019-1077An elevation of privilege vulnerability exists when the Visu…
• CVE-2019-10770All versions of io.ratpack:ratpack-core from 0.9.10 inclusiv…6.1
• CVE-2019-10771Characters in the GET url path are not properly escaped and …6.1
• CVE-2019-10772It is possible to bypass enshrined/svg-sanitize before 0.13.…6.1