CVE-2019-1084

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
MicrosoftMicrosoft Exchange Server2010 Service Pack 3
MicrosoftMicrosoft Outlook2010 Service Pack 2 (32-bit editions); 2010 Service Pack 2 (64-bit editions); 2016 (32-bit edition); 2016 (64-bit edition); 2013 Service Pack 1 (32-bit editions); 2013 Service Pack 1 (64-bit editions)
MicrosoftMicrosoft Office2013 Service Pack 1 (32-bit editions); 2013 Service Pack 1 (64-bit editions); 2013 RT Service Pack 1; 2016 for Mac; 2016 (32-bit edition); 2016 (64-bit edition); 2019 for 32-bit editions; 2019 for 64-bit editions; 2019 for Mac
MicrosoftMicrosoft Lync2013 Service Pack 1 (32-bit); 2013 Service Pack 1 (64-bit)
MicrosoftMicrosoft Lync Basic2013 Service Pack 1 (32-bit); 2013 Service Pack 1 (64-bit)
MicrosoftMicrosoft Outlook for Androidunspecified
MicrosoftSkype for Business2016 (32-bit); 2016 (64-bit)
MicrosoftSkype for Business Basic2016 (32-bit); 2016 (64-bit)
MicrosoftOffice 365 ProPlus32-bit Systems; 64-bit Systems
MicrosoftMicrosoft Exchange Server 2016Cumulative Update 12; Cumulative Update 13
MicrosoftMicrosoft Exchange Server 2019Cumulative Update 1; Cumulative Update 2
MicrosoftMicrosoft Exchange Server 2013Cumulative Update 23
MicrosoftMail and Calendarunspecified
MicrosoftOutlook for iOSunspecified

References

Timeline

Published
Jul 15, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-108429.8Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3, when downloaded from rubygems.org. An unauthenticatedCVE-2019-108449.8nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries (aka nnabla) through v1.0.14 relies on the HOME environment variable, which CVE-2019-108456.5An issue was discovered in Uniqkey Password Manager 1.14. When entering new credentials to a site that isn't registered within this product,CVE-2019-108466.1Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and password reset page via tCVE-2019-108478.8Computrols CBAS 18.0.0 allows Cross-Site Request Forgery.CVE-2019-108485.3Computrols CBAS 18.0.0 allows Username Enumeration.CVE-2019-108497.5Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure.CVE-2019-10857.8An elevation of privilege vulnerability exists in the way that the wlansvc.dll handles objects in memory, aka 'Windows WLAN Service ElevatioCVE-2019-108509.8Computrols CBAS 18.0.0 has Default Credentials.CVE-2019-108516.5Computrols CBAS 18.0.0 has hard-coded encryption keys.CVE-2019-108528.8Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=startCVE-2019-108538.1Computrols CBAS 18.0.0 allows Authentication Bypass.