CVE-2019-1296

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1257, CVE-2019-1295.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Microsoft	Microsoft SharePoint Foundation	2013 Service Pack 1
Microsoft	Microsoft SharePoint Enterprise Server	2016
Microsoft	Microsoft SharePoint Server	2019

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1296Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1296Patch, Vendor Advisory

Timeline

Published: Sep 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-129609.8LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in functions.internal.build.inc.php via the parameter p_dt_s_d.CVE-2019-129618.8LiveZilla Server before 8.0.1.1 is vulnerable to CSV Injection in the Export Function.CVE-2019-129626.1LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header.CVE-2019-129636.1LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the chat.php Create Ticket Action.CVE-2019-129646.1LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the ticket.php Subject.CVE-2019-129669.8FeHelper through 2019-06-19 allows arbitrary code execution during a JSON format operation, as demonstrated by the {"a":(function(){confirm(CVE-2019-129676.5Stephan Mooltipass Moolticute through 0.42.1 (and possibly earlier versions) has Incorrect Access Control.CVE-2019-129685.3A vulnerability was found in the Sonic Robo Blast 2 (SRB2) plugin (EP_Versions 9 to 11 inclusive) distributed with Doomseeker 1.1 and 1.2. A CVE-2019-12978.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'CVE-2019-129706.1XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the CVE-2019-129719.8BKS EBK Ethernet-Buskoppler Pro before 3.01 allows Unrestricted Upload of a File with a Dangerous Type.CVE-2019-129725.5An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based