CVE-2019-13021

The administrative passwords for all versions of Bond JetSelect are stored within an unprotected file on the filesystem, rather than encrypted within the MySQL database. This backup copy of the passwords is made as part of the installation script, after the administrator has generated a password using ENCtool.jar (see CVE-2019-13022). This allows any low-privilege user who can read this file to trivially obtain the passwords for the administrative accounts of the JetSelect application. The path to the file containing the encoded password hash is /opt/JetSelect/SFC/resources/sfc-general-properties.

• CWE-312

• https://labs.nettitude.com/blog/cve-2019-13021-22-23-jetselect-network-segregation-application/Exploit, Third Party Advisory
• https://labs.nettitude.com/blog/cve-2019-13021-22-23-jetselect-network-segregation-application/Exploit, Third Party Advisory

Published

May 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-13011An issue was discovered in GitLab Enterprise Edition 8.11.0 …4.3
• CVE-2019-13012The keyfile settings backend in GNOME GLib (aka glib2.0) bef…
• CVE-2019-13013Little Snitch versions 4.3.0 to 4.3.2 have a local privilege…5.5
• CVE-2019-13014Little Snitch versions 4.4.0 fixes a vulnerability in a priv…5.5
• CVE-2019-1302An elevation of privilege vulnerability exists when a ASP.NE…8.8
• CVE-2019-13020The fetch API in Tightrope Media Carousel before 7.1.3 has C…
• CVE-2019-13022Bond JetSelect (all versions) has an issue in the Java class…9.8
• CVE-2019-13023An issue was discovered in all versions of Bond JetSelect. W…6.5
• CVE-2019-13024Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centr…
• CVE-2019-13025Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices ha…9.8
• CVE-2019-13026OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows …
• CVE-2019-13027Realization Concerto Critical Chain Planner (aka CCPM) 5.10.…