CVE-2019-19450

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

• CWE-91

• https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.mdRelease Notes
• https://lists.debian.org/debian-lts-announce/2023/09/msg00037.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHMCB2GJQKFMGVO5RWHN222NQL5XYPHZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HADPTB3SBU7IVRMDK7OL6WSQRU5AFWDZ/
• https://pastebin.com/5MicRrr4Third Party Advisory
• https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.mdRelease Notes
• https://lists.debian.org/debian-lts-announce/2023/09/msg00037.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHMCB2GJQKFMGVO5RWHN222NQL5XYPHZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HADPTB3SBU7IVRMDK7OL6WSQRU5AFWDZ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHMCB2GJQKFMGVO5RWHN222NQL5XYPHZ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HADPTB3SBU7IVRMDK7OL6WSQRU5AFWDZ/
• https://pastebin.com/5MicRrr4Third Party Advisory

Published

Sep 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1944Multiple vulnerabilities in the smart tunnel functionality o…7.3
• CVE-2019-19441HUAWEI P30 smart phones with versions earlier than 10.0.0.16…6.5
• CVE-2019-19447In the Linux kernel 5.0.21, mounting a crafted ext4 filesyst…7.8
• CVE-2019-19448In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted bt…7.8
• CVE-2019-19449In the Linux kernel 5.0.21, mounting a crafted f2fs filesyst…7.8
• CVE-2019-1945Multiple vulnerabilities in the smart tunnel functionality o…6.7
• CVE-2019-19451When GNOME Dia before 2019-11-27 is launched with a filename…5.5
• CVE-2019-19452A buffer overflow was found in Patriot Viper RGB through 1.1…7.8
• CVE-2019-19453Wowza Streaming Engine before 4.8.5 allows XSS (issue 1 of 2…5.4
• CVE-2019-19454An arbitrary file download was found in the "Download Log" f…7.5
• CVE-2019-19455Wowza Streaming Engine before 4.8.5 has Insecure Permissions…7.8
• CVE-2019-19456A Reflected XSS was found in the server selection box inside…6.1