CVE-2019-10149

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jun 5, 2019
Last modified: Jun 17, 2026
Added to CISA KEV: Jan 10, 2022
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-10154.7An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker w CVE-2019-101505.9It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authenticati CVE-2019-101527.2A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attac CVE-2019-101535.0A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields woul CVE-2019-101547.5A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversation CVE-2019-101553.1The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity CVE-2019-101565.4A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of CVE-2019-101575.5It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its back CVE-2019-101589.8A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Ses CVE-2019-101594.3cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration CVE-2019-10164.7An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker w CVE-2019-101609.8A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7