CVE-2019-18954

Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via a conflicting name. Hence, a malicious attacker can manipulate internal attributes by adding additional attributes to user input.

• CWE-668

• https://github.com/NetEase/pomelo/issues/1149Issue Tracking, Third Party Advisory
• https://github.com/cl0udz/vulnerabilities/tree/master/pomelo-critical-state-manipulationExploit, Third Party Advisory
• https://github.com/NetEase/pomelo/issues/1149Issue Tracking, Third Party Advisory
• https://github.com/cl0udz/vulnerabilities/tree/master/pomelo-critical-state-manipulationExploit, Third Party Advisory

Published

Nov 14, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18947Micro Focus Solutions Business Manager Application Repositor…3.5
• CVE-2019-18948An issue was found in Arista EOS. Specific malformed ARP pac…7.5
• CVE-2019-18949SnowHaze before 2.6.6 is sometimes too late to honor a per-s…7.5
• CVE-2019-1895A vulnerability in the Virtual Network Computing (VNC) conso…9.8
• CVE-2019-18951SibSoft Xfilesharing through 2.5.1 allows op=page&tmpl=../ d…7.5
• CVE-2019-18952SibSoft Xfilesharing through 2.5.1 allows cgi-bin/up.cgi arb…9.8
• CVE-2019-18955The web console in Lansweeper 7.2.105.2 has XSS via the URL …6.1
• CVE-2019-18956Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.…9.8
• CVE-2019-18957Microstrategy Library in MicroStrategy before 2019 before 11…6.1
• CVE-2019-18958Nitro Pro before 13.2 creates a debug.log file in the direct…7.8
• CVE-2019-1896A vulnerability in the web-based management interface of Cis…7.2
• CVE-2019-18960Firecracker vsock implementation buffer overflow in versions…9.8