CVE-2019-1305

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Microsoft	Team Foundation Server	2017 Update 3.1
Microsoft	Team Foundation Server 2018	Update 1.2; Update 3.2
Microsoft	Team Foundation Server 2015	Update 4.2
Microsoft	Azure DevOps Server	2019.0.1

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1305Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1305Patch, Vendor Advisory

Timeline

Published: Sep 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-130507.5Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a Gn CVE-2019-130518.8Pi-Hole 4.3 allows Command Injection.CVE-2019-130526.5Logitech Unifying devices allow live decryption if the pairing of a keyboard to a receiver is sniffed.CVE-2019-130536.5Logitech Unifying devices allow keystroke injection, bypassing encryption. The attacker must press a "magic" key combination while sniffing CVE-2019-130546.5The Logitech R500 presentation clicker allows attackers to determine the AES key, leading to keystroke injection. On Windows, any text may b CVE-2019-130556.5Certain Logitech Unifying devices allow attackers to dump AES keys and addresses, leading to the capability of live decryption of Radio Freq CVE-2019-130568.8An issue was discovered in CyberPanel through 1.8.4. On the user edit page, an attacker can edit the administrator's e-mail and password bec CVE-2019-130574.9An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges CVE-2019-13069.8A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to validate input properly CVE-2019-130637.5Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on th CVE-2019-130666.1Sahi Pro 8.0.0 has a script manager arena located at _s_/dyn/pro/DBReports with many different areas that are vulnerable to reflected XSS, b CVE-2019-130679.8njs through 0.3.3, used in NGINX, has a buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c. This issue occurs after the fix for CVE-2019-