CVE-2019-1084

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jul 15, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-108429.8Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3, when downloaded from rubygems.org. An unauthenticated CVE-2019-108449.8nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries (aka nnabla) through v1.0.14 relies on the HOME environment variable, which CVE-2019-108456.5An issue was discovered in Uniqkey Password Manager 1.14. When entering new credentials to a site that isn't registered within this product,CVE-2019-108466.1Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and password reset page via t CVE-2019-108478.8Computrols CBAS 18.0.0 allows Cross-Site Request Forgery.CVE-2019-108485.3Computrols CBAS 18.0.0 allows Username Enumeration.CVE-2019-108497.5Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure.CVE-2019-10857.8An elevation of privilege vulnerability exists in the way that the wlansvc.dll handles objects in memory, aka 'Windows WLAN Service Elevatio CVE-2019-108509.8Computrols CBAS 18.0.0 has Default Credentials.CVE-2019-108516.5Computrols CBAS 18.0.0 has hard-coded encryption keys.CVE-2019-108528.8Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=start CVE-2019-108538.1Computrols CBAS 18.0.0 allows Authentication Bypass.