CVE-2019-12812

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

MyBuilder viewer before 6.2.2019.814 allow an attacker to execute arbitrary command via specifically crafted configuration file. This can be leveraged for code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
ACTIVESOFT	MyBuilder	prior to 6.2.2019.814

References

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35155Third Party Advisory, VDB Entry
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35155Third Party Advisory, VDB Entry

Timeline

Published: Oct 7, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-128135.9An issue was discovered in Digital Persona U.are.U 4500 Fingerprint Reader v24. The key and salt used for obfuscating the fingerprint image CVE-2019-128145.9A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally o CVE-2019-128159.8An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without CVE-2019-128168.8Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading CVE-2019-128177.0arch/powerpc/mm/mmu_context_book3s64.c in the Linux kernel before 5.1.15 for powerpc has a bug where unrelated processes may be able to read CVE-2019-128187.5An issue was discovered in the Linux kernel before 4.20.15. The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If t CVE-2019-128195.5An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_register() in drivers/net/phy/mdio_bus.c calls put_device(), CVE-2019-12825.5An information disclosure exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle sandbox checks, aka 'W CVE-2019-128205.6A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. Actions performed on the app such as changing a pa CVE-2019-128214.8A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-co CVE-2019-128227.5In http.c in Embedthis GoAhead before 4.1.1 and 5.x before 5.0.1, a header parsing vulnerability causes a memory assertion, out-of-bounds me CVE-2019-128236.1Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.