CVE-2019-10038

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Evernote 7.9 on macOS allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as the /Applications/Calculator.app/Contents/MacOS/Calculator file.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://drive.google.com/file/d/1cmWixK1vAh7oZ2y3Y3ZtVeSoTRp8c1Ts/view?usp=sharingBroken Link
https://evernote.com/security/updatesVendor Advisory
https://www.inputzero.io/2019/04/evernote-cve-2019-10038.htmlThird Party Advisory
https://drive.google.com/file/d/1cmWixK1vAh7oZ2y3Y3ZtVeSoTRp8c1Ts/view?usp=sharingBroken Link
https://evernote.com/security/updatesVendor Advisory
https://www.inputzero.io/2019/04/evernote-cve-2019-10038.htmlThird Party Advisory

Timeline

Published: May 31, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-100399.8The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_lo CVE-2019-10047.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip CVE-2019-100409.8The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_lo CVE-2019-100419.8The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_lo CVE-2019-100427.5The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_lo CVE-2019-100448.8Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph atta CVE-2019-100456.5The "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scr CVE-2019-100465.3An unauthenticated attacker can obtain information about the Pydio 8.2.2 configuration including session timeout, libraries, and license inf CVE-2019-100475.4A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file p CVE-2019-100487.2The ImageMagick plugin that is installed by default in Pydio through 8.2.2 does not perform the appropriate validation and sanitization of u CVE-2019-100497.3It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an administrator user into op CVE-2019-10057.5A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerabil