CVE-2019-10904

Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.

• CWE-79

• http://www.openwall.com/lists/oss-security/2019/04/07/1Exploit, Mailing List, Third Party Advisory
• https://bugs.python.org/issue36391Exploit, Vendor Advisory
• https://github.com/python/bugs.python.org/issues/34Exploit, Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/04/msg00009.htmlMailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2019/04/05/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/04/07/1Exploit, Mailing List, Third Party Advisory
• https://bugs.python.org/issue36391Exploit, Vendor Advisory
• https://github.com/python/bugs.python.org/issues/34Exploit, Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/04/msg00009.htmlMailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2019/04/05/1Mailing List, Third Party Advisory

Published

Apr 6, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10899In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the…7.5
• CVE-2019-1090An elevation of privilege vulnerability exists in the way th…
• CVE-2019-10900In Wireshark 3.0.0, the Rbm dissector could go into an infin…
• CVE-2019-10901In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the…7.5
• CVE-2019-10902In Wireshark 3.0.0, the TSDNS dissector could crash. This wa…
• CVE-2019-10903In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the…7.5
• CVE-2019-10905Parsedown before 1.7.2, when safe mode is used and HTML mark…
• CVE-2019-10906In Pallets Jinja before 2.10.1, str.format_map allows a sand…8.6
• CVE-2019-10907Airsonic 10.2.1 uses Spring's default remember-me mechanism …
• CVE-2019-10908In Airsonic 10.2.1, RecoverController.java generates passwor…
• CVE-2019-10909In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.…5.4
• CVE-2019-1091An information disclosure vulnerability exists when Unistore…