{"id":"CVE-2019-10219","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-10219","generatedAt":"2026-10-29T00:58:58.591Z","title":"A vulnerability was found in Hibernate-Validator.","description":"A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.","published":"2019-11-08T15:15:11.000Z","lastModified":"2026-10-08T22:16:49.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["redhat/hibernate validator","redhat/fuse","redhat/jboss data grid","redhat/jboss enterprise application platform","redhat/openshift application runtimes","redhat/single sign-on","netapp/active iq unified manager","netapp/management services for element software and netapp hci","netapp/snapcenter plug-in","netapp/element","oracle/access manager","oracle/agile engineering data management","oracle/agile product lifecycle analytics","oracle/agile product lifecycle management","oracle/agile product lifecycle management integration pack","oracle/airlines data model","oracle/application express","oracle/application performance management","oracle/application testing suite","oracle/argus analytics","oracle/argus insight","oracle/argus safety","oracle/banking apis","oracle/banking deposits and lines of credit servicing","oracle/banking digital experience","oracle/banking enterprise default management","oracle/banking enterprise default managment","oracle/banking loans servicing","oracle/banking party management","oracle/banking platform","oracle/bi publisher","oracle/big data spatial and graph","oracle/business activity monitoring","oracle/business intelligence","oracle/business process management suite","oracle/clinical","oracle/commerce guided search","oracle/commerce platform","oracle/communications application session controller","oracle/communications billing and revenue management","oracle/communications billing and revenue management elastic charging engine","oracle/communications calendar server","oracle/communications cloud native core automated test suite","oracle/communications cloud native core binding support function","oracle/communications cloud native core console","oracle/communications cloud native core network function cloud native environment","oracle/communications cloud native core network repository function","oracle/communications cloud native core policy","oracle/communications cloud native core security edge protection proxy","oracle/communications cloud native core service communication proxy","oracle/communications cloud native core unified data repository","oracle/communications contacts server","oracle/communications converged application server - service controller","oracle/communications convergence","oracle/communications convergent charging controller","oracle/communications data model","oracle/communications design studio","oracle/communications diameter signaling route","oracle/communications eagle application processor","oracle/communications instant messaging server"],"epss":{"score":0.02157,"percentile":0.82092,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (2.16%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2020:0159","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2020:0160","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2020:0161","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2020:0164","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2020:0445","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219","tags":["Issue Tracking","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56cee","source":"secalert@redhat.com"},{"url":"https://github.com/hibernate/hibernate-validator/commit/20d729548511ac5cff6fd459f93de137195420fe","source":"secalert@redhat.com"},{"url":"https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-10219","source":"secalert@redhat.com"},{"url":"https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Origin/CVE-2019-10219/exploit","source":"secalert@redhat.com"},{"url":"https://lists.apache.org/thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6%40%3Cnotifications.accumulo.apache.org%3E","source":"secalert@redhat.com"},{"url":"https://lists.apache.org/thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba09114897d%40%3Cnotifications.accumulo.apache.org%3E","source":"secalert@redhat.com"},{"url":"https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf%40%3Cnotifications.accumulo.apache.org%3E","source":"secalert@redhat.com"},{"url":"https://lists.apache.org/thread.html/rb8dca19a4e52b60dab0ab21e2ff9968d78f4b84e4033824db1dd24b4%40%3Cpluto-scm.portals.apache.org%3E","source":"secalert@redhat.com"},{"url":"https://lists.apache.org/thread.html/rd418deda6f0ebe658c2015f43a14d03acb8b8c2c093c5bf6b880cd7c%40%3Cpluto-dev.portals.apache.org%3E","source":"secalert@redhat.com"},{"url":"https://lists.apache.org/thread.html/rf9c17c3efc4a376a96e9e2777eee6acf0bec28e2200e4b35da62de4a%40%3Cpluto-dev.portals.apache.org%3E","source":"secalert@redhat.com"},{"url":"https://security.netapp.com/advisory/ntap-20220210-0024/","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2020:0159","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0160","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0161","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0164","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0445","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219","tags":["Issue Tracking","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56ceee","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/hibernate/hibernate-validator/commit/20d729548511ac5cff6fd459f93de137195420fe","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-10219","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Origin/CVE-2019-10219/exploit","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6%40%3Cnotifications.accumulo.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba09114897d%40%3Cnotifications.accumulo.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf%40%3Cnotifications.accumulo.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/rb8dca19a4e52b60dab0ab21e2ff9968d78f4b84e4033824db1dd24b4%40%3Cpluto-scm.portals.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/rd418deda6f0ebe658c2015f43a14d03acb8b8c2c093c5bf6b880cd7c%40%3Cpluto-dev.portals.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/rf9c17c3efc4a376a96e9e2777eee6acf0bec28e2200e4b35da62de4a%40%3Cpluto-dev.portals.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20220210-0024/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-10219","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}