CVE-2019-11074

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A Write to Arbitrary Location in Disk vulnerability exists in PRTG Network Monitor 19.1.49 and below that allows attackers to place files in arbitrary locations with SYSTEM privileges (although not controlling the contents of such files) due to insufficient sanitisation when passing arguments to the phantomjs.exe binary. In order to exploit the vulnerability, remote authenticated administrators need to create a new HTTP Full Web Page Sensor and set specific settings when executing the sensor.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Mar 17, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-110769.8Cribl UI 1.5.0 allows remote attackers to run arbitrary commands via an unauthenticated web request.CVE-2019-110778.8FastAdmin V1.0.0.20190111_beta has a CSRF vulnerability to add a new admin user via the admin/auth/admin/add?dialog=1 URI.CVE-2019-110788.8MKCMS V5.0 has a CSRF vulnerability to add a new admin user via the ucenter/userinfo.php URI.CVE-2019-11086.5An information disclosure vulnerability exists when the Windows RDP client improperly discloses the contents of its memory, aka 'Remote DeskCVE-2019-110808.8Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticaCVE-2019-110819.8A default username and password in Dentsply Sirona Sidexis 4.3.1 and earlier allows an attacker to gain administrative access to the applicaCVE-2019-110827.5core/api/datasets/internal/actions/Explode.java in the Dataset API in DKPro Core through 1.10.0 allows Directory Traversal, resulting in theCVE-2019-110846.1GAuth 0.9.9 beta has stored XSS that shows a popup repeatedly and discloses cookies.CVE-2019-110857.8Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0 may allow an authenticated user tCVE-2019-110866.8Insufficient input validation in subsystem for Intel(R) AMT before version 12.0.45 may allow an unauthenticated user to potentially enable eCVE-2019-110876.7Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; CVE-2019-110888.8Insufficient input validation in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthentica