CVE-2019-14251

An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a document on the server once successfully authenticated. However, an attacker can leverage downloadDocServer() to traverse the file system and access files or directories that are outside of the restricted directory because WealthT24/GetImage is used with the docDownloadPath and uploadLocation parameters.

• CWE-22

• https://github.com/kmkz/exploit/blob/master/CVE-2019-14251-TEMENOS-T24.txtExploit, Third Party Advisory
• https://github.com/kmkz/exploit/blob/master/CVE-2019-14251-TEMENOS-T24.txtExploit, Third Party Advisory

Published

Dec 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14246In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851,…6.5
• CVE-2019-14247The scan() function in mad.c in mpg321 0.3.2 allows remote a…
• CVE-2019-14248In libnasm.a in Netwide Assembler (NASM) 2.14.xx, asm/pragma…
• CVE-2019-14249dwarf_elf_load_headers.c in libdwarf before 2019-07-05 allow…
• CVE-2019-1425An elevation of privilege vulnerability exists when Visual S…6.5
• CVE-2019-14250An issue was discovered in GNU libiberty, as distributed in …5.5
• CVE-2019-14252An issue was discovered in the secure portal in Publisure 2.…7.2
• CVE-2019-14253An issue was discovered in servletcontroller in the secure p…6.5
• CVE-2019-14254An issue was discovered in the secure portal in Publisure 2.…9.8
• CVE-2019-14255A Server Side Request Forgery (SSRF) vulnerability in go-cam…
• CVE-2019-14257pyraw in Zenoss 2.5.3 allows local privilege escalation by m…
• CVE-2019-14258The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks tha…