{"id":"CVE-2019-10678","details":"Domoticz before 4.10579 neglects to categorize \\n and \\r as insecure argument options.","modified":"2026-07-08T23:59:03.368060Z","published":"2019-03-31T21:29:00.200Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:domoticz:domoticz:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"4.10579"}],"source":"CPE_RANGE","vendor_product":"domoticz:domoticz"},{"extracted_events":[{"fixed":"4.10579"}],"source":"DESCRIPTION"}]},"references":[{"type":"FIX","url":"https://github.com/domoticz/domoticz/commit/2119afbe74ee0c914c1d5c4c859c594c08b0ad42"},{"type":"EVIDENCE","url":"http://packetstormsecurity.com/files/152678/Domoticz-4.10577-Unauthenticated-Remote-Command-Execution.html"},{"type":"EVIDENCE","url":"https://www.exploit-db.com/exploits/46773/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/domoticz/domoticz","events":[{"introduced":"0"},{"fixed":"2119afbe74ee0c914c1d5c4c859c594c08b0ad42"}],"database_specific":{"source":"REFERENCES"}}],"database_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/domoticz/domoticz/commit/2119afbe74ee0c914c1d5c4c859c594c08b0ad42","target":{"file":"main/Helper.cpp"},"deprecated":false,"digest":{"line_hashes":["74400263139303292541042905941121580087","58449022438561187271251443905869638162","105773221344332857631466185116022338757","295820779245057703330105003374258619797"],"threshold":0.9},"id":"CVE-2019-10678-1d226bba"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10678.json","vanir_signatures_modified":"2026-07-08T23:59:03Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}