CVE-2019-1079

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability exists when Visual Studio improperly parses XML input in certain settings files, aka 'Visual Studio Information Disclosure Vulnerability'.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Microsoft	Microsoft Visual Studio	2010 Service Pack 1; 2012 Update 5; 2013 Update 5; 2015 Update 3

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1079Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1079Patch, Vendor Advisory

Timeline

Published: Jul 15, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-107907.5taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-i CVE-2019-107919.8promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be CVE-2019-107926.3bodymen before 1.1.1 is vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Obje CVE-2019-107936.3dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Objec CVE-2019-107946.3All versions of component-flatten are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties CVE-2019-107956.3undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of Object CVE-2019-107969.8rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of CVE-2019-107976.5Netty in WSO2 transport-http before v6.3.1 is vulnerable to HTTP Response Splitting due to HTTP Header validation being disabled.CVE-2019-107985.3rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.prototype.add method co CVE-2019-107998.2compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExit(cssPath)" within "dist/index.js" is exe CVE-2019-10807.5A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerabil CVE-2019-108006.5This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to