CVE Feed

    Dashboard / CVE / CVE-2019-10219

    CVE-2019-10219

    A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

    Published:Aug 28, 2019
    Last Modified:Aug 25, 2026
    EPS:Nov 8, 2019
    EPSS Score:0.02167
    CVSS Score:6.1

    Affected Products

    Vendor
    Netapp
    Product
    Active Iq Unified Manager
    Vendor
    Netapp
    Product
    Element
    Vendor
    Netapp
    Product
    Management Services For Element Software And Netapp Hci
    Vendor
    Netapp
    Product
    Snapcenter Plug-in
    Vendor
    Oracle
    Product
    Access Manager
    Vendor
    Oracle
    Product
    Agile Engineering Data Management
    Vendor
    Oracle
    Product
    Agile Product Lifecycle Analytics
    Vendor
    Oracle
    Product
    Agile Product Lifecycle Management
    Vendor
    Oracle
    Product
    Agile Product Lifecycle Management Integration Pack
    Vendor
    Oracle
    Product
    Airlines Data Model
    Vendor
    Oracle
    Product
    Application Express
    Vendor
    Oracle
    Product
    Application Performance Management
    Vendor
    Oracle
    Product
    Application Testing Suite
    Vendor
    Oracle
    Product
    Argus Analytics
    Vendor
    Oracle
    Product
    Argus Insight
    Vendor
    Oracle
    Product
    Argus Safety
    Vendor
    Oracle
    Product
    Banking Apis
    Vendor
    Oracle
    Product
    Banking Deposits And Lines Of Credit Servicing
    Vendor
    Oracle
    Product
    Banking Digital Experience
    Vendor
    Oracle
    Product
    Banking Enterprise Default Management
    Vendor
    Oracle
    Product
    Banking Enterprise Default Managment
    Vendor
    Oracle
    Product
    Banking Loans Servicing
    Vendor
    Oracle
    Product
    Banking Party Management
    Vendor
    Oracle
    Product
    Banking Platform
    Vendor
    Oracle
    Product
    Bi Publisher
    Vendor
    Oracle
    Product
    Big Data Spatial And Graph
    Vendor
    Oracle
    Product
    Business Activity Monitoring
    Vendor
    Oracle
    Product
    Business Intelligence
    Vendor
    Oracle
    Product
    Business Process Management Suite
    Vendor
    Oracle
    Product
    Clinical
    Vendor
    Oracle
    Product
    Commerce Guided Search
    Vendor
    Oracle
    Product
    Commerce Platform
    Vendor
    Oracle
    Product
    Communications Application Session Controller
    Vendor
    Oracle
    Product
    Communications Billing And Revenue Management
    Vendor
    Oracle
    Product
    Communications Billing And Revenue Management Elastic Charging Engine
    Vendor
    Oracle
    Product
    Communications Calendar Server
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Automated Test Suite
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Binding Support Function
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Console
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Network Function Cloud Native Environment
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Network Repository Function
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Policy
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Security Edge Protection Proxy
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Service Communication Proxy
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Unified Data Repository
    Vendor
    Oracle
    Product
    Communications Contacts Server
    Vendor
    Oracle
    Product
    Communications Converged Application Server - Service Controller
    Vendor
    Oracle
    Product
    Communications Convergence
    Vendor
    Oracle
    Product
    Communications Convergent Charging Controller
    Vendor
    Oracle
    Product
    Communications Data Model
    Vendor
    Oracle
    Product
    Communications Design Studio
    Vendor
    Oracle
    Product
    Communications Diameter Signaling Route
    Vendor
    Oracle
    Product
    Communications Eagle Application Processor
    Vendor
    Oracle
    Product
    Communications Instant Messaging Server
    Vendor
    Oracle
    Product
    Communications Interactive Session Recorder
    Vendor
    Oracle
    Product
    Communications Messaging Server
    Vendor
    Oracle
    Product
    Communications Metasolv Solution
    Vendor
    Oracle
    Product
    Communications Network Charging And Control
    Vendor
    Oracle
    Product
    Communications Network Integrity
    Vendor
    Oracle
    Product
    Communications Offline Mediation Controller
    Vendor
    Oracle
    Product
    Communications Operations Monitor
    Vendor
    Oracle
    Product
    Communications Pricing Design Center
    Vendor
    Oracle
    Product
    Communications Service Broker
    Vendor
    Oracle
    Product
    Communications Services Gatekeeper
    Vendor
    Oracle
    Product
    Communications Session Border Controller
    Vendor
    Oracle
    Product
    Communications Unified Inventory Management
    Vendor
    Oracle
    Product
    Communications Webrtc Session Controller
    Vendor
    Oracle
    Product
    Data Integrator
    Vendor
    Oracle
    Product
    Database Server
    Vendor
    Oracle
    Product
    Demantra Demand Management
    Vendor
    Oracle
    Product
    Documaker
    Vendor
    Oracle
    Product
    E-business Suite
    Vendor
    Oracle
    Product
    Enterprise Communications Broker
    Vendor
    Oracle
    Product
    Enterprise Data Quality
    Vendor
    Oracle
    Product
    Enterprise Manager Base Platform
    Vendor
    Oracle
    Product
    Enterprise Manager Ops Center
    Vendor
    Oracle
    Product
    Enterprise Session Border Controller
    Vendor
    Oracle
    Product
    Essbase
    Vendor
    Oracle
    Product
    Essbase Administration Services
    Vendor
    Oracle
    Product
    Financial Services Analytical Applications Infrastructure
    Vendor
    Oracle
    Product
    Financial Services Behavior Detection Platform
    Vendor
    Oracle
    Product
    Financial Services Enterprise Case Management
    Vendor
    Oracle
    Product
    Financial Services Foreign Account Tax Compliance Act Management
    Vendor
    Oracle
    Product
    Financial Services Model Management And Governance
    Vendor
    Oracle
    Product
    Financial Services Trade-based Anti Money Laundering
    Vendor
    Oracle
    Product
    Flexcube Investor Servicing
    Vendor
    Oracle
    Product
    Flexcube Private Banking
    Vendor
    Oracle
    Product
    Fujitsu M10-1
    Vendor
    Oracle
    Product
    Fujitsu M10-1 Firmware
    Vendor
    Oracle
    Product
    Fujitsu M10-4
    Vendor
    Oracle
    Product
    Fujitsu M10-4 Firmware
    Vendor
    Oracle
    Product
    Fujitsu M10-4s
    Vendor
    Oracle
    Product
    Fujitsu M10-4s Firmware
    Vendor
    Oracle
    Product
    Fujitsu M12-1
    Vendor
    Oracle
    Product
    Fujitsu M12-1 Firmware
    Vendor
    Oracle
    Product
    Fujitsu M12-2
    Vendor
    Oracle
    Product
    Fujitsu M12-2 Firmware
    Vendor
    Oracle
    Product
    Fujitsu M12-2s
    Vendor
    Oracle
    Product
    Fujitsu M12-2s Firmware
    Vendor
    Oracle
    Product
    Fusion Middleware
    Vendor
    Oracle
    Product
    Fusion Middleware Mapviewer
    Vendor
    Oracle
    Product
    Goldengate
    Vendor
    Oracle
    Product
    Goldengate Application Adapters
    Vendor
    Oracle
    Product
    Graalvm
    Vendor
    Oracle
    Product
    Graph Server And Client
    Vendor
    Oracle
    Product
    Health Sciences Clinical Development Analytics
    Vendor
    Oracle
    Product
    Health Sciences Inform Crf Submit
    Vendor
    Oracle
    Product
    Health Sciences Information Manager
    Vendor
    Oracle
    Product
    Healthcare Data Repository
    Vendor
    Oracle
    Product
    Healthcare Foundation
    Vendor
    Oracle
    Product
    Healthcare Translational Research
    Vendor
    Oracle
    Product
    Hospitality Cruise Shipboard Property Management System
    Vendor
    Oracle
    Product
    Hospitality Opera 5 Property Services
    Vendor
    Oracle
    Product
    Hospitality Reporting And Analytics
    Vendor
    Oracle
    Product
    Hospitality Suite8
    Vendor
    Oracle
    Product
    Http Server
    Vendor
    Oracle
    Product
    Hyperion Financial Management
    Vendor
    Oracle
    Product
    Hyperion Ilearning
    Vendor
    Oracle
    Product
    Hyperion Infrastructure Technology
    Vendor
    Oracle
    Product
    Instantis Enterprisetrack
    Vendor
    Oracle
    Product
    Insurance Data Gateway
    Vendor
    Oracle
    Product
    Insurance Insbridge Rating And Underwriting
    Vendor
    Oracle
    Product
    Insurance Policy Administration
    Vendor
    Oracle
    Product
    Insurance Policy Administration J2ee
    Vendor
    Oracle
    Product
    Insurance Rules Palette
    Vendor
    Oracle
    Product
    Java Se
    Vendor
    Oracle
    Product
    Jd Edwards Enterpriseone Orchestrator
    Vendor
    Oracle
    Product
    Jdk
    Vendor
    Oracle
    Product
    Managed File Transfer
    Vendor
    Oracle
    Product
    Mysql Cluster
    Vendor
    Oracle
    Product
    Mysql Connectors
    Vendor
    Oracle
    Product
    Mysql Server
    Vendor
    Oracle
    Product
    Mysql Workbench
    Vendor
    Oracle
    Product
    Nosql Database
    Vendor
    Oracle
    Product
    Oss Support Tools
    Vendor
    Oracle
    Product
    Peoplesoft Enterprise Cs Sa Integration Pack
    Vendor
    Oracle
    Product
    Peoplesoft Enterprise Peopletools
    Vendor
    Oracle
    Product
    Policy Automation
    Vendor
    Oracle
    Product
    Primavera Analytics
    Vendor
    Oracle
    Product
    Primavera Data Warehouse
    Vendor
    Oracle
    Product
    Primavera Gateway
    Vendor
    Oracle
    Product
    Primavera P6 Enterprise Project Portfolio Management
    Vendor
    Oracle
    Product
    Primavera P6 Professional Project Management
    Vendor
    Oracle
    Product
    Primavera Portfolio Management
    Vendor
    Oracle
    Product
    Primavera Unifier
    Vendor
    Oracle
    Product
    Rapid Planning
    Vendor
    Oracle
    Product
    Real-time Decision Server
    Vendor
    Oracle
    Product
    Real User Experience Insight
    Vendor
    Oracle
    Product
    Rest Data Services
    Vendor
    Oracle
    Product
    Retail Allocation
    Vendor
    Oracle
    Product
    Retail Analytics
    Vendor
    Oracle
    Product
    Retail Assortment Planning
    Vendor
    Oracle
    Product
    Retail Back Office
    Vendor
    Oracle
    Product
    Retail Central Office
    Vendor
    Oracle
    Product
    Retail Customer Insights
    Vendor
    Oracle
    Product
    Retail Customer Management And Segmentation Foundation
    Vendor
    Oracle
    Product
    Retail Eftlink
    Vendor
    Oracle
    Product
    Retail Extract Transform And Load
    Vendor
    Oracle
    Product
    Retail Financial Integration
    Vendor
    Oracle
    Product
    Retail Fiscal Management
    Vendor
    Oracle
    Product
    Retail Integration Bus
    Vendor
    Oracle
    Product
    Retail Invoice Matching
    Vendor
    Oracle
    Product
    Retail Merchandising System
    Vendor
    Oracle
    Product
    Retail Order Broker
    Vendor
    Oracle
    Product
    Retail Order Management System
    Vendor
    Oracle
    Product
    Retail Point-of-sale
    Vendor
    Oracle
    Product
    Retail Predictive Application Server
    Vendor
    Oracle
    Product
    Retail Price Management
    Vendor
    Oracle
    Product
    Retail Returns Management
    Vendor
    Oracle
    Product
    Retail Service Backbone
    Vendor
    Oracle
    Product
    Retail Size Profile Optimization
    Vendor
    Oracle
    Product
    Retail Xstore Point Of Service
    Vendor
    Oracle
    Product
    Sd-wan Aware
    Vendor
    Oracle
    Product
    Sd-wan Edge
    Vendor
    Oracle
    Product
    Secure Backup
    Vendor
    Oracle
    Product
    Siebel Applications
    Vendor
    Oracle
    Product
    Solaris
    Vendor
    Oracle
    Product
    Spatial Studio
    Vendor
    Oracle
    Product
    Thesaurus Management System
    Vendor
    Oracle
    Product
    Timesten In-memory Database
    Vendor
    Oracle
    Product
    Utilities Framework
    Vendor
    Oracle
    Product
    Utilities Testing Accelerator
    Vendor
    Oracle
    Product
    Vm Virtualbox
    Vendor
    Oracle
    Product
    Webcenter Portal
    Vendor
    Oracle
    Product
    Weblogic Server
    Vendor
    Oracle
    Product
    Zfs Storage Appliance Kit
    Vendor
    Oracle
    Product
    Zfs Storage Application Integration Engineering Software
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Fuse
    Vendor
    Redhat
    Product
    Hibernate Validator
    Vendor
    Redhat
    Product
    Jboss Data Grid
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform
    Vendor
    Redhat
    Product
    Jboss Fuse
    Vendor
    Redhat
    Product
    Jboss Single Sign On
    Vendor
    Redhat
    Product
    Openshift Application Runtimes
    Vendor
    Redhat
    Product
    Satellite
    Vendor
    Redhat
    Product
    Satellite Capsule
    Vendor
    Redhat
    Product
    Single Sign-on

    Exploits

    https://github.com/dawetmaster/CVE-2019-10219-hibernate-validator-vulnerablehttps://github.com/shoucheng3/hibernate__hibernate-validator_CVE-2019-10219_6-0-17-Finalhttps://github.com/shoucheng3/hibernate__hibernate-validator_CVE-2019-10219_6_0_18_Final_fixed

    Related CVEs

    CVE-2025-30722 (CVSS 5.3) — Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions …
    CVE-2025-31672 (CVSS 5.3) — Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files lik…
    CVE-2025-24928 (CVSS 7.8) — libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in va…
    CVE-2024-56171 (CVSS 7.8) — libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSche…
    CVE-2025-26465 (CVSS 6.8) — A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle atta…
    CVE-2025-1181 (CVSS 2.3) — A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function…
    CVE-2025-1178 (CVSS 6.3) — A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerab…
    CVE-2025-24970 (CVSS 7.5) — Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.…
    CVE-2025-0411 (CVSS 7) — 7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-t…
    CVE-2025-21492 (CVSS 4.9) — Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions …

    References

    https://access.redhat.com/errata/RHSA-2020:0159
    https://access.redhat.com/errata/RHSA-2020:0160
    https://access.redhat.com/errata/RHSA-2020:0161
    https://access.redhat.com/errata/RHSA-2020:0164
    https://access.redhat.com/errata/RHSA-2020:0445
    https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219
    https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56cee
    https://github.com/hibernate/hibernate-validator/commit/20d729548511ac5cff6fd459f93de137195420fe
    https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-10219
    https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Origin/CVE-2019-10219/exploit
    https://lists.apache.org/thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6%40%3Cnotifications.accumulo.apache.org%3E
    https://lists.apache.org/thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba09114897d%40%3Cnotifications.accumulo.apache.org%3E
    https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf%40%3Cnotifications.accumulo.apache.org%3E
    https://lists.apache.org/thread.html/rb8dca19a4e52b60dab0ab21e2ff9968d78f4b84e4033824db1dd24b4%40%3Cpluto-scm.portals.apache.org%3E
    https://lists.apache.org/thread.html/rd418deda6f0ebe658c2015f43a14d03acb8b8c2c093c5bf6b880cd7c%40%3Cpluto-dev.portals.apache.org%3E
    https://lists.apache.org/thread.html/rf9c17c3efc4a376a96e9e2777eee6acf0bec28e2200e4b35da62de4a%40%3Cpluto-dev.portals.apache.org%3E
    https://security.netapp.com/advisory/ntap-20220210-0024/
    https://www.oracle.com/security-alerts/cpujan2022.html
    https://access.redhat.com/errata/RHSA-2020:0159
    https://access.redhat.com/errata/RHSA-2020:0160
    https://access.redhat.com/errata/RHSA-2020:0161
    https://access.redhat.com/errata/RHSA-2020:0164
    https://access.redhat.com/errata/RHSA-2020:0445
    https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219
    https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56ceee
    https://github.com/hibernate/hibernate-validator/commit/20d729548511ac5cff6fd459f93de137195420fe
    https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-10219
    https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Origin/CVE-2019-10219/exploit
    https://lists.apache.org/thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6%40%3Cnotifications.accumulo.apache.org%3E
    https://lists.apache.org/thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba09114897d%40%3Cnotifications.accumulo.apache.org%3E
    https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf%40%3Cnotifications.accumulo.apache.org%3E
    https://lists.apache.org/thread.html/rb8dca19a4e52b60dab0ab21e2ff9968d78f4b84e4033824db1dd24b4%40%3Cpluto-scm.portals.apache.org%3E
    https://lists.apache.org/thread.html/rd418deda6f0ebe658c2015f43a14d03acb8b8c2c093c5bf6b880cd7c%40%3Cpluto-dev.portals.apache.org%3E
    https://lists.apache.org/thread.html/rf9c17c3efc4a376a96e9e2777eee6acf0bec28e2200e4b35da62de4a%40%3Cpluto-dev.portals.apache.org%3E
    https://security.netapp.com/advisory/ntap-20220210-0024/
    https://www.oracle.com/security-alerts/cpujan2022.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High