CVE-2019-1427

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1426, CVE-2019-1428, CVE-2019-1429.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Nov 12, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-142707.1Comodo Antivirus through 12.0.0.6870, Comodo Firewall through 12.0.0.6870, and Comodo Internet Security Premium through 12.0.0.6870, with th CVE-2019-142719.8In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamical CVE-2019-142725.4In SilverStripe asset-admin 4.0, there is XSS in file titles managed through the CMS.CVE-2019-142735.3In SilverStripe assets 4.0, there is broken access control on files.CVE-2019-142745.5MCPP 2.7.2 has a heap-based buffer overflow in the do_msg() function in support.c.CVE-2019-142755.5Xfig fig2dev 3.2.7a has a stack-based buffer overflow in the calc_arrow function in bound.c.CVE-2019-142766.5WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body.CVE-2019-142779.8Axway SecureTransport 5.x through 5.3 (or 5.x through 5.5 with certain API configuration) is vulnerable to unauthenticated blind XML injecti CVE-2019-142785.3In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page.CVE-2019-14287.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), CVE-2019-142805.3In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured CVE-2019-142819.8The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.