CVE-2019-1390

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Microsoft	Internet Explorer 9	Windows Server 2008 for 32-bit Systems Service Pack 2; Windows Server 2008 for x64-based Systems Service Pack 2
Microsoft	Internet Explorer 11	Windows 7 for 32-bit Systems Service Pack 1; Windows 7 for x64-based Systems Service Pack 1; Windows Server 2008 R2 for x64-based Systems Service Pack 1; Windows 8.1 for 32-bit systems; Windows 8.1 for x64-based systems; Windows Server 2012 R2; Windows RT 8.1; Windows 10 for 32-bit Systems; Windows 10 for x64-based Systems; Windows Server 2016; Windows 10 Version 1607 for 32-bit Systems; Windows 10 Version 1607 for x64-based Systems; Windows 10 Version 1709 for 32-bit Systems; Windows 10 Version 1709 for x64-based Systems; Windows 10 Version 1803 for 32-bit Systems; Windows 10 Version 1803 for x64-based Systems; Windows 10 Version 1803 for ARM64-based Systems; Windows 10 Version 1809 for 32-bit Systems; Windows 10 Version 1809 for x64-based Systems; Windows 10 Version 1809 for ARM64-based Systems
Microsoft	Internet Explorer 11 on Windows Server 2012	unspecified
Microsoft	Internet Explorer 11 on Windows 10 Version 1903 for 32-bit Systems	unspecified
Microsoft	Internet Explorer 11 on Windows 10 Version 1903 for x64-based Systems	unspecified
Microsoft	Internet Explorer 11 on Windows 10 Version 1903 for ARM64-based Systems	unspecified
Microsoft	Internet Explorer 10	Windows Server 2012

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1390Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1390Patch, Vendor Advisory

Timeline

Published: Nov 12, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-13915.5A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. T CVE-2019-139157.5b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files. First, the attacker can write code in the editor, and compi CVE-2019-139168.8An issue was discovered in Cypress (formerly Broadcom) WICED Studio 6.2 CYW20735B1 and CYW20819A1. As a Bluetooth Low Energy (BLE) packet is CVE-2019-139179.8Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion CVE-2019-139189.8A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). The web interface has no means to prevent pas CVE-2019-139194.3A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some pages that should only be accessible by CVE-2019-13927.8An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Eleva CVE-2019-139204.3A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some parts of the web application are not pro CVE-2019-139217.5A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions < SP3 Update 1). Affected versions of the software contain a CVE-2019-139222.7A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). An attacker with administrative privileges ca CVE-2019-139239.6A vulnerability has been identified in IE/WSN-PA Link WirelessHART Gateway (All versions). The integrated configuration web server of the af CVE-2019-139245.4A vulnerability has been identified in SCALANCE S602 (All versions < V4.1), SCALANCE S612 (All versions < V4.1), SCALANCE S623 (All versions