CVE-2019-19459

An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. An attacker can write arbitrary content to arbitrary files, as demonstrated by CVE-2019-19458 files under the web root, or .bat files that will be used with auto start. This allows an attacker to execute arbitrary commands on the server.

• CWE-22

• https://packetstormsecurity.com/files/155525/SALTO-ProAccess-SPACE-5.5-Traversal-File-Write-XSS-Bypass.htmlThird Party Advisory, VDB Entry
• https://sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-salto-proaccess-space/Exploit, Third Party Advisory
• https://packetstormsecurity.com/files/155525/SALTO-ProAccess-SPACE-5.5-Traversal-File-Write-XSS-Bypass.htmlThird Party Advisory, VDB Entry
• https://sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-salto-proaccess-space/Exploit, Third Party Advisory

Published

Dec 3, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19453Wowza Streaming Engine before 4.8.5 allows XSS (issue 1 of 2…5.4
• CVE-2019-19454An arbitrary file download was found in the "Download Log" f…7.5
• CVE-2019-19455Wowza Streaming Engine before 4.8.5 has Insecure Permissions…7.8
• CVE-2019-19456A Reflected XSS was found in the server selection box inside…6.1
• CVE-2019-19457SALTO ProAccess SPACE 5.4.3.0 allows XSS.5.4
• CVE-2019-19458SALTO ProAccess SPACE 5.4.3.0 allows Directory Traversal in …8.6
• CVE-2019-1946A vulnerability in the web-based management interface of Cis…6.5
• CVE-2019-19460An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. Th…5.5
• CVE-2019-19461Post-authentication Stored XSS in Team Password Manager thro…5.4
• CVE-2019-19462relay_open in kernel/relay.c in the Linux kernel through 5.4…5.5
• CVE-2019-19463The Anhui Huami Mi Fit application before 4.0.11 for Android…5.3
• CVE-2019-19464The CBC Gem application before 9.24.1 for Android and before…5.3