CVE-2019-0729

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An Elevation of Privilege vulnerability exists in the way Azure IoT Java SDK generates symmetric keys for encryption, allowing an attacker to predict the randomness of the key, aka 'Azure IoT Java SDK Elevation of Privilege Vulnerability'.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-330

Affected software

Vendor	Product	Versions
Microsoft	Java SDK for Azure IoT	unspecified

References

http://www.securityfocus.com/bid/106966Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0729Patch, Vendor Advisory
http://www.securityfocus.com/bid/106966Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0729Patch, Vendor Advisory

Timeline

Published: Mar 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-07307.8An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation CVE-2019-07317.8An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation CVE-2019-07327.8A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard when Windows improperly handl CVE-2019-07335.3A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC e CVE-2019-07348.1An elevation of privilege vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully decode and rep CVE-2019-07357.8An elevation of privilege vulnerability exists when the Windows Client Server Run-Time Subsystem (CSRSS) fails to properly handle objects in CVE-2019-07369.8A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client. An CVE-2019-07397.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scriptin CVE-2019-07417.5An information disclosure vulnerability exists in the way Azure IoT Java SDK logs sensitive information, aka 'Azure IoT Java SDK Information CVE-2019-07425.4A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foun CVE-2019-07435.4A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foun CVE-2019-07466.5An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka '