CVE-2019-1072

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Azure DevOps Server and Team Foundation Server Remote Code Execution Vulnerability'.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
MicrosoftTeam Foundation Server 2012Update 4
MicrosoftTeam Foundation Server 2013 Update 5unspecified
MicrosoftTeam Foundation Server 2018Update 1.2; Update 3.2
MicrosoftTeam Foundation Server2017 Update 3.1
MicrosoftTeam Foundation Server 2015Update 4.2
MicrosoftAzure DevOps Server2019.0.1
MicrosoftTeam Foundation Server 2010SP1 (x86); SP1 (x64)

References

Timeline

Published
Jul 15, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-107208.8BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. NOTE: thisCVE-2019-107216.1BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/SecuritCVE-2019-107235.5An issue was discovered in PoDoFo 0.9.6. The PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp has an attempted excessive memory allocatiCVE-2019-107246.5There is a vulnerability with the Dolby DAX2 API system services in which a low-privileged user can terminate arbitrary processes that are rCVE-2019-10735.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationCVE-2019-107324.3In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email.CVE-2019-107344.3In KDE Trojita 0.7, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email.CVE-2019-107354.3In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart emaiCVE-2019-10745.5An elevation of privilege vulnerability exists in Microsoft Windows where certain folders, with local service privilege, are vulnerable to sCVE-2019-107404.3In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted CVE-2019-107414.3K-9 Mail v5.600 can include the original quoted HTML code of a specially crafted, benign looking, email within (digitally signed) reply messCVE-2019-107427.5Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after
CVE-2019-1072: Critical severity, CVSS 9.8 | Vulnix