CVE-2019-1720

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

A vulnerability in the XML API of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to improper handling of the XML input. An attacker could exploit this vulnerability by sending a specifically crafted XML payload. A successful exploit could allow the attacker to exhaust CPU resources, resulting in a DoS condition until the system is manually rebooted. Software versions prior to X12.5.1 are affected.

Metrics

CVSS 3.0 4.9/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Apr 18, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-172017.8FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to AdministratCVE-2019-172027.8FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to AdministratCVE-2019-172035.4TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder.CVE-2019-172045.4TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item.CVE-2019-172056.1TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the lCVE-2019-172069.8Uncontrolled deserialization of a pickled object in models.py in Frost Ming rediswrapper (aka Redis Wrapper) before 0.3.0 allows attackers tCVE-2019-172075.4A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11CVE-2019-17216.5A vulnerability in the phone book feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an CVE-2019-172107.5A denial-of-service issue was discovered in the MQTT library in Arm Mbed OS 2017-11-02. The function readMQTTLenString() is called by the fuCVE-2019-172119.8An integer overflow was discovered in the CoAP library in Arm Mbed OS 5.14.0. The function sn_coap_builder_calc_needed_packet_data_size_2() CVE-2019-172129.8Buffer overflows were discovered in the CoAP library in Arm Mbed OS 5.14.0. The CoAP parser is responsible for parsing received CoAP packetsCVE-2019-172136.1The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header.