Risk | High |
Patch available | YES |
Number of vulnerabilities | 9 |
CVE-ID | CVE-2019-1389 CVE-2019-0721 CVE-2019-0719 CVE-2019-0712 CVE-2019-1309 CVE-2019-1310 CVE-2019-1397 CVE-2019-1398 CVE-2019-1399 |
CWE-ID | CWE-20 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Windows Operating systems & Components / Operating system Windows Server Operating systems & Components / Operating system |
Vendor | Microsoft |
Security Bulletin
This security bulletin contains information about 9 vulnerabilities.
EUVDB-ID: #VU22688
Risk: Low
CVSSv3.1: 6.6 [CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-1389
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to insufficient validation of user-supplied input when Microsoft Hyper-V Network Switch on a host server does not properly validate input from a privileged user on a guest operating system. An administrator on adjacent network can execute arbitrary code on the target system.
Install updates from vendor's website.
Vulnerable software versionsWindows: 7 - 10 1803
Windows Server: 2008 - 2019 1803
External linkshttp://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1389
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU22694
Risk: High
CVSSv3.1: 7 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-0721
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to insufficient validation of user-supplied input when Microsoft Hyper-V Network Switch on a host server does not properly validate input from a privileged user on a guest operating system. A remote administrator can use a speciallly crafted application and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsWindows: 10 1709 - 10 1903
Windows Server: 2019 - 2019 1903
External linkshttp://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0721
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU22690
Risk: High
CVSSv3.1: 7 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-0719
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to insufficient validation of user-supplied input when Microsoft Hyper-V Network Switch on a host server does not properly validate input from a privileged user on a guest operating system. A remote administrator can use a speciallly crafted application and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsWindows Server: 2008 - 2019 1903
Windows: 8.1 - 10 1903
External linkshttp://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0719
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU22686
Risk: Medium
CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-0712
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when Microsoft Hyper-V Network Switch on a host server does not properly validate input from a privileged user on a guest operating system.
Successful exploitation of the vulnerability may result denial of service (DoS) attack against the host system.
MitigationInstall update from vendor's website.
Vulnerable software versionsWindows: 7 - 10 1903
Windows Server: 2008 - 2019 1903
External linkshttp://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0712
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU22684
Risk: Medium
CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-1309
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when Microsoft Hyper-V Network Switch on a host server does not properly validate input from a privileged user on a guest operating system.
Successful exploitation of the vulnerability may result denial of service (DoS) attack against the host system.
MitigationInstall update from vendor's website.
Vulnerable software versionsWindows: 10 1709 - 10 1903
Windows Server: 2019 - 2019 1903
External linkshttp://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1309
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU22683
Risk: Medium
CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-1310
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when Microsoft Hyper-V Network Switch on a host server does not properly validate input from a privileged user on a guest operating system.
Successful exploitation of the vulnerability may result denial of service (DoS) attack against the host system.
MitigationInstall update from vendor's website.
Vulnerable software versionsWindows: 10 1803 - 10 1903
Windows Server: 2019 - 2019 1903
External linkshttp://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1310
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU22653
Risk: Low
CVSSv3.1: 6.6 [CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-1397
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to insufficient validation of user-supplied input when Microsoft Hyper-V on a host server does not properly validate input from a privileged user on a guest operating system.
Successful exploitation of the vulnerability may result arbitrary code execution on the host system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsWindows: 7 - 10 1903
Windows Server: 2008 - 2019 1903
External linkshttp://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1397
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU22652
Risk: Low
CVSSv3.1: 6.6 [CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-1398
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to insufficient validation of user-supplied input when Microsoft Hyper-V on a host server does not properly validate input from a privileged user on a guest operating system.
Successful exploitation of the vulnerability may result arbitrary code execution on the host system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsWindows: 10 1709 - 10 1903
Windows Server: 2019 - 2019 1903
External linkshttp://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1398
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU22651
Risk: Low
CVSSv3.1: 4.7 [CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-1399
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when Microsoft Hyper-V on a host server does not properly validate input from a privileged user on a guest operating system.
Successful exploitation of the vulnerability may result denial of service (DoS) attack against the host system.
MitigationInstall update from vendor's website.
Vulnerable software versionsWindows: 7 - 10 1903
Windows Server: 2008 - 2019 1903
External linkshttp://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1399
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.