CVE-2019-14319

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The TikTok (formerly Musical.ly) application 12.2.0 for Android and iOS performs unencrypted transmission of images, videos, and likes. This allows an attacker to extract private sensitive information by sniffing network traffic.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://p16.muscdn.com/img/musically-maliva-obj/1626792871331845~c5_100x100.jpegNot Applicable
http://p16.muscdn.com/img/tos-maliva-p-0068/d9e7889f4f2d43028b41947cb0950c32~noop.imageNot Applicable
https://github.com/MelroyB/CVE-2019-14319/blob/master/CVE%202019-14319%20.pdfThird Party Advisory
https://play.google.com/store/apps/details?id=com.zhiliaoapp.musically&hl=en_USProduct
http://p16.muscdn.com/img/musically-maliva-obj/1626792871331845~c5_100x100.jpegNot Applicable
http://p16.muscdn.com/img/tos-maliva-p-0068/d9e7889f4f2d43028b41947cb0950c32~noop.imageNot Applicable
https://github.com/MelroyB/CVE-2019-14319/blob/master/CVE%202019-14319%20.pdfThird Party Advisory
https://play.google.com/store/apps/details?id=com.zhiliaoapp.musically&hl=en_USProduct

Timeline

Published: Sep 4, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-14326.5An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Informatio CVE-2019-143227.5In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.CVE-2019-143237.5SSDP Responder 1.x through 1.5 mishandles incoming network messages, leading to a stack-based buffer overflow by 1 byte. This results in a c CVE-2019-143267.8An issue was discovered in AndyOS Andy versions up to 46.11.113. By default, it starts telnet and ssh (ports 22 and 23) with root privileges CVE-2019-143276.5A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings.CVE-2019-143288.8The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.CVE-2019-143296.1An issue was discovered in EspoCRM before 5.6.6. There is stored XSS due to lack of filtration of user-supplied data in Create Task. A malic CVE-2019-14337.8An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphi CVE-2019-143306.1An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create Case. A malicio CVE-2019-143316.1An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create User. A malicio CVE-2019-143327.8An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is use of weak ciphers for SSH such as diffie CVE-2019-143335.5An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a pre-authenticated denial of service atta