CVE-2019-18956

Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, SparkSpace 1.0 < 1.0.30, 1.1 < 1.1.2, and 1.2 < 1.2.4, and Proxia PHR 1.0 < 1.0.30 and 1.1 < 1.1.2 allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a seria1.0lized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a serialized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. Affected products include Proxia Premium Edition 2017 and Sparkspace.

• CWE-502

• https://github.com/blackarrowsec/advisories/tree/master/2019/CVE-2019-18956Exploit, Third Party Advisory
• https://github.com/blackarrowsec/advisories/tree/master/2019/CVE-2019-18956Exploit, Third Party Advisory

Published

Dec 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18949SnowHaze before 2.6.6 is sometimes too late to honor a per-s…7.5
• CVE-2019-1895A vulnerability in the Virtual Network Computing (VNC) conso…9.8
• CVE-2019-18951SibSoft Xfilesharing through 2.5.1 allows op=page&tmpl=../ d…7.5
• CVE-2019-18952SibSoft Xfilesharing through 2.5.1 allows cgi-bin/up.cgi arb…9.8
• CVE-2019-18954Pomelo v2.2.5 allows external control of critical state data…5.3
• CVE-2019-18955The web console in Lansweeper 7.2.105.2 has XSS via the URL …6.1
• CVE-2019-18957Microstrategy Library in MicroStrategy before 2019 before 11…6.1
• CVE-2019-18958Nitro Pro before 13.2 creates a debug.log file in the direct…7.8
• CVE-2019-1896A vulnerability in the web-based management interface of Cis…7.2
• CVE-2019-18960Firecracker vsock implementation buffer overflow in versions…9.8
• CVE-2019-18961Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-18962Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…