CVE-2019-12841

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity. The issue was fixed in TeamCity 2018.2.2.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Jul 3, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-128426.1A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.2.CVE-2019-128436.1A possible stored JavaScript injection requiring a deliberate server administrator action was detected. The issue was fixed in JetBrains TeaCVE-2019-128446.1A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.3.CVE-2019-128455.3The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCCVE-2019-128464.3A user without the required permissions could gain access to some JetBrains TeamCity settings. The issue was fixed in TeamCity 2018.2.2.CVE-2019-128477.2In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user. It is onCVE-2019-12857.8An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k CVE-2019-128509.8A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168.CVE-2019-128518.8A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852.CVE-2019-128529.8An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168.CVE-2019-128547.5Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protectCVE-2019-128557.4In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an atta
CVE-2019-12841: High severity, CVSS 7.5 | Vulnix