CVE-2019-19328

ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT.

• CWE-79

• https://gerrit.wikimedia.org/g/wikidata/query/gui/+/270f833cff8fdc1e050230ecc9f7dfc4d090d90dMailing List, Patch, Vendor Advisory
• https://gerrit.wikimedia.org/r/#/c/553311/Mailing List, Patch, Vendor Advisory
• https://lists.wikimedia.org/pipermail/wikidata-tech/2019-November/001503.htmlMailing List, Patch, Vendor Advisory
• https://gerrit.wikimedia.org/g/wikidata/query/gui/+/270f833cff8fdc1e050230ecc9f7dfc4d090d90dMailing List, Patch, Vendor Advisory
• https://gerrit.wikimedia.org/r/#/c/553311/Mailing List, Patch, Vendor Advisory
• https://lists.wikimedia.org/pipermail/wikidata-tech/2019-November/001503.htmlMailing List, Patch, Vendor Advisory

Published

Nov 27, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19319In the Linux kernel before 5.2, a setxattr operation, after …6.5
• CVE-2019-1932A vulnerability in Cisco Advanced Malware Protection (AMP) f…6.7
• CVE-2019-19324Xmidt cjwt through 1.0.1 before 2019-11-25 maps unsupported …7.5
• CVE-2019-19325SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5…6.1
• CVE-2019-19326Silverstripe CMS sites through 4.4.4 which have opted into H…5.9
• CVE-2019-19327ui/ResultView.js in Wikibase Wikidata Query Service GUI befo…6.1
• CVE-2019-19329In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT…6.1
• CVE-2019-1933A vulnerability in the email message scanning of Cisco Async…5.8
• CVE-2019-19330The HTTP/2 implementation in HAProxy before 2.0.10 mishandle…9.8
• CVE-2019-19331knot-resolver before version 4.3.0 is vulnerable to denial o…7.5
• CVE-2019-19332An out-of-bounds memory write issue was found in the Linux K…6.1
• CVE-2019-19333In all versions of libyang before 1.0-r5, a stack-based buff…9.8