CVE-2019-19115

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An escalation of privilege vulnerability in Nahimic APO Software Component Driver 1.4.2, 1.5.0, 1.5.1, 1.6.1 and 1.6.2 allows an attacker to execute code with SYSTEM privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://safebreach.com/Post/Nahimic-APO-Software-Component-Driver-Deployed-with-MSI-Computers-DLL-Search-Order-Hijacking-and-Potential-Abuses-CVE-2019-19115Exploit, Third Party Advisory
https://safebreach.com/Post/Nahimic-APO-Software-Component-Driver-Deployed-with-MSI-Computers-DLL-Search-Order-Hijacking-and-Potential-Abuses-CVE-2019-19115Exploit, Third Party Advisory

Timeline

Published: Oct 8, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-191178.8/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2(PSG1218) V22.5.9.163 devices allows remote authenticated users to execute a CVE-2019-191186.5Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where CVE-2019-191195.5An issue was discovered in PRTG 7.x through 19.4.53. Due to insufficient access control on local registry keys for the Core Server Service, CVE-2019-19129.1A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote att CVE-2019-191263.3On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable duri CVE-2019-191278.1An authentication bypass vulnerability is present in the standalone SITS:Vision 9.7.0 component of Tribal SITS in its default configuration,CVE-2019-191296.1Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name.CVE-2019-19139.8Multiple vulnerabilities in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, r CVE-2019-191336.1The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails CVE-2019-191346.1The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter bec CVE-2019-191357.4In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.O CVE-2019-191387.5Ivanti Workspace Control before 10.4.50.0 allows attackers to degrade integrity.