CVE-2019-0757

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected software

VendorProductVersions
MicrosoftMicrosoft Visual Studio2017 for Mac
Microsoft.NET Core SDK1.1 on .NET Core 1.0; 2.1.500 on .NET Core 2.1; 2.2.100 on .NET Core 2.2; 1.1 on .NET Core 1.1
MicrosoftNuget4.3.1; 4.4.2; 4.5.2; 4.6.3; 4.7.2; 4.8.2; 4.9.4
MicrosoftMono Framework5.18.0.223; 5.20.0

References

Timeline

Published
Apr 9, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-07586.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows CVE-2019-07595.5An information disclosure vulnerability exists when the Windows Print Spooler does not properly handle objects in memory, aka 'Windows PrintCVE-2019-07616.5A security feature bypass vulnerability exists when Internet Explorer fails to validate the correct Security Zone of requests for specific UCVE-2019-07624.3A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins, aka 'Microsoft BrowsCVE-2019-07637.5A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory CorCVE-2019-07646.5A tampering vulnerability exists when Microsoft browsers do not properly validate input under specific conditions, aka 'Microsoft Browsers TCVE-2019-07658.8A remote code execution vulnerability exists in the way that comctl32.dll handles objects in memory, aka 'Comctl32 Remote Code Execution VulCVE-2019-07667.8An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations. To exploiCVE-2019-07675.5An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.To exploit this vulnerabilitCVE-2019-07684.3A security feature bypass vulnerability exists when Internet Explorer VBScript execution policy does not properly restrict VBScript under spCVE-2019-07697.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinCVE-2019-07707.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scriptin
CVE-2019-0757: Medium severity, CVSS 6.5 | Vulnix