CVE-2019-7727

In NICE Engage through 6.5, the default configuration binds an unauthenticated JMX/RMI interface to all network interfaces, without restricting registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol by using the JMX connector. The observed affected TCP port is 6338 but, based on the product's configuration, a different one could be vulnerable.

• CWE-306

• http://seclists.org/fulldisclosure/2019/Apr/4Mailing List, Third Party Advisory
• https://redtimmysec.wordpress.com/2019/03/26/jmx-rmi-multiple-applications-rce/Mitigation, Third Party Advisory
• https://seclists.org/bugtraq/2019/Apr/2Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2019/Apr/4Mailing List, Third Party Advisory
• https://redtimmysec.wordpress.com/2019/03/26/jmx-rmi-multiple-applications-rce/Mitigation, Third Party Advisory
• https://seclists.org/bugtraq/2019/Apr/2Mailing List, Third Party Advisory

Published

Apr 23, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-7719Nibbleblog 4.0.5 allows eval injection by placing PHP code i…
• CVE-2019-7720taocms through 2014-05-24 allows eval injection by placing P…
• CVE-2019-7721lib/NCCms.class.php in nc-cms 3.5 allows upload of .php file…
• CVE-2019-7722PMD 5.8.1 and earlier processes XML external entities in rul…
• CVE-2019-7725includes/core/is_user.php in NukeViet before 4.3.04 deserial…9.8
• CVE-2019-7726modules/banners/funcs/click.php in NukeViet before 4.3.04 ha…9.8
• CVE-2019-7728An issue was discovered in the Bosch Smart Camera App before…
• CVE-2019-7729An issue was discovered in the Bosch Smart Camera App before…
• CVE-2019-7730MyWebSQL 3.7 has a Cross-site request forgery (CSRF) vulnera…
• CVE-2019-7731MyWebSQL 3.7 has a remote code execution (RCE) vulnerability…
• CVE-2019-7732In Live555 0.95, a setup packet can cause a memory leak lead…
• CVE-2019-7733In Live555 0.95, there is a buffer overflow via a large inte…