CVE-2019-12816

Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading a module with a crafted name.

• CWE-20

• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00037.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00018.html
• https://github.com/znc/znc/commit/8de9e376ce531fe7f3c8b0aa4876d15b479b7311Patch, Third Party Advisory
• https://github.com/znc/znc/compare/be1b6bc...d1997d6Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/06/msg00017.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4O24TQOB73X57GACLZVMRVUK4UKHLE5G/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHR6OD52FQAG5ZPZ42NJM2T765C3V2XC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEESIGRNFLZUWXZPDGXAZ7JZTHYBDJ7G/
• https://seclists.org/bugtraq/2019/Jun/23Third Party Advisory
• https://security.gentoo.org/glsa/201908-15
• https://usn.ubuntu.com/4044-1/
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00037.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00018.html
• https://github.com/znc/znc/commit/8de9e376ce531fe7f3c8b0aa4876d15b479b7311Patch, Third Party Advisory
• https://github.com/znc/znc/compare/be1b6bc...d1997d6Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/06/msg00017.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4O24TQOB73X57GACLZVMRVUK4UKHLE5G/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHR6OD52FQAG5ZPZ42NJM2T765C3V2XC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEESIGRNFLZUWXZPDGXAZ7JZTHYBDJ7G/
• https://seclists.org/bugtraq/2019/Jun/23Third Party Advisory
• https://security.gentoo.org/glsa/201908-15
• https://usn.ubuntu.com/4044-1/

Published

Jun 15, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12810A memory corruption vulnerability exists in the .PSD parsing…
• CVE-2019-12811ActiveX Control in MyBuilder before 6.2.2019.814 allow an at…9.8
• CVE-2019-12812MyBuilder viewer before 6.2.2019.814 allow an attacker to ex…9.8
• CVE-2019-12813An issue was discovered in Digital Persona U.are.U 4500 Fing…
• CVE-2019-12814A Polymorphic Typing issue was discovered in FasterXML jacks…5.9
• CVE-2019-12815An arbitrary file copy vulnerability in mod_copy in ProFTPD …9.8
• CVE-2019-12817arch/powerpc/mm/mmu_context_book3s64.c in the Linux kernel b…7
• CVE-2019-12818An issue was discovered in the Linux kernel before 4.20.15. …
• CVE-2019-12819An issue was discovered in the Linux kernel before 5.0. The …
• CVE-2019-1282An information disclosure exists in the Windows Common Log F…5.5
• CVE-2019-12820A vulnerability was found in the app 2.0 of the Shenzhen Jis…
• CVE-2019-12821A vulnerability was found in the app 2.0 of the Shenzhen Jis…