CVE-2019-1337

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability exists when Windows Update Client fails to properly handle objects in memory, aka 'Windows Update Client Information Disclosure Vulnerability'.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Microsoft	Windows	10 Version 1809 for 32-bit Systems; 10 Version 1809 for x64-based Systems; 10 Version 1809 for ARM64-based Systems
Microsoft	Windows Server	2019; 2019 (Core installation)
Microsoft	Windows 10 Version 1903 for 32-bit Systems	unspecified
Microsoft	Windows 10 Version 1903 for x64-based Systems	unspecified
Microsoft	Windows 10 Version 1903 for ARM64-based Systems	unspecified
Microsoft	Windows Server, version 1903 (Server Core installation)	unspecified

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1337Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1337Patch, Vendor Advisory

Timeline

Published: Oct 10, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-133708.8index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator.CVE-2019-133729.8/web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arb CVE-2019-133739.8An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validated and arbitrary SQL CVE-2019-133746.1A cross-site scripting (XSS) vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100 CVE-2019-133759.8A SQL Injection was discovered in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 in PayAction.class.php with the index.php/Pay CVE-2019-133766.5phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The C CVE-2019-133775.9The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a result of o CVE-2019-133798.8On AVTECH Room Alert 3E devices before 2.2.5, an attacker with access to the device's web interface may escalate privileges from an unauthen CVE-2019-13385.9A security feature bypass vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTL CVE-2019-133806.1KEYNTO Team Password Manager 1.5.0 allows XSS because data saved from websites is mishandled in the online vault.CVE-2019-133827.8UploaderService in SnagIT 2019.1.2 allows elevation of privilege by placing an invalid presentation file in %PROGRAMDATA%\TechSmith\TechSmit CVE-2019-133835.3In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by read