CVE-2019-1077

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

An elevation of privilege vulnerability exists when the Visual Studio updater service improperly handles file permissions, aka 'Visual Studio Elevation of Privilege Vulnerability'.

Metrics

CVSS 3.0 5.0/10CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jul 15, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-107706.1All versions of io.ratpack:ratpack-core from 0.9.10 inclusive and before 1.7.6 are vulnerable to Cross-site Scripting (XSS). This affects th CVE-2019-107716.1Characters in the GET url path are not properly escaped and can be reflected in the server response.CVE-2019-107726.1It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by CVE-2019-107737.8In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specia CVE-2019-107749.8php-shellcommand versions before 1.6.1 have a command injection vulnerability. Successful exploitation could lead to arbitrary code executio CVE-2019-107757.5ecstatic have a denial of service vulnerability. Successful exploitation could lead to crash of an application.CVE-2019-107769.8In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-dif CVE-2019-107779.8In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function wi CVE-2019-107789.8devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The var CVE-2019-107796.1All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cross-site Scripting. An CVE-2019-10785.5An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory. An attacker who suc CVE-2019-107809.8BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open