CVE-2019-12270

OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by default on Windows. During installation, a displaylistcache file share is created on the Windows server with full read and write permissions for the Everyone group at both the NTFS and Share levels. The share is used to retrieve documents for processing, and to store processed documents for display in the browser. The only required share level access is read/write by the JobProcessor service account. At the local filesystem level, the only additional required permissions would be read/write from the servlet engine, such as Tomcat. (The affected server components are not installed with Content Server by default, and must be installed separately.) NOTE: the vendor's position is that customers are not supposed to use this default setting without consulting the documentation.

• CWE-732

• https://packetstormsecurity.com/files/150125/Brava-Enterprise-Server-16.4-Information-Disclosure.htmlMitigation, Third Party Advisory, VDB Entry
• https://packetstormsecurity.com/files/150125/Brava-Enterprise-Server-16.4-Information-Disclosure.htmlMitigation, Third Party Advisory, VDB Entry

Published

May 21, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12263Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in th…8.1
• CVE-2019-12264Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has …7.1
• CVE-2019-12265Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a…5.3
• CVE-2019-12266Stack-based Buffer Overflow vulnerability in Wyze Cam Pan v2…9.8
• CVE-2019-12269Enigmail before 2.0.11 allows PGP signature spoofing: for an…
• CVE-2019-1227An information disclosure vulnerability exists when the Wind…5.5
• CVE-2019-12271Sandline Centraleyezer (On Premises) allows unrestricted Fil…9.8
• CVE-2019-12272In OpenWrt LuCI through 0.10, the endpoints admin/status/rea…
• CVE-2019-12273OutSystems Platform 10 through 11 allows ImageResourceDetail…6.5
• CVE-2019-12274In Rancher 1 and 2 through 2.2.3, unprivileged users (if all…
• CVE-2019-12276A Path Traversal vulnerability in Controllers/LetsEncryptCon…
• CVE-2019-12277Blogifier 2.3 before 2019-05-11 does not properly restrict A…