CVE-2019-11029

Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, leading to Directory Traversal. An attacker could use ..\ with this method to iterate over lists of interesting system files and download them without previous authentication. This includes SAM-database backups, Web.config files, etc. and might cause a serious impact on confidentiality.

• CWE-22

• https://www.kyberturvallisuuskeskus.fi/en/vulnerabilities-mirasys-vms-video-management-solutionThird Party Advisory
• https://www.kyberturvallisuuskeskus.fi/en/vulnerabilities-mirasys-vms-video-management-solutionThird Party Advisory

Published

Aug 22, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11023The agroot() function in cgraph\obj.c in libcgraph.a in Grap…
• CVE-2019-11024The load_pnm function in frompnm.c in libsixel.a in libsixel…
• CVE-2019-11025In clearFilter() in utilities.php in Cacti before 1.2.3, no …5.4
• CVE-2019-11026FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 …6.5
• CVE-2019-11027Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely e…
• CVE-2019-11028GAT-Ship Web Module before 1.40 suffers from a vulnerability…
• CVE-2019-1103A remote code execution vulnerability exists in the way that…
• CVE-2019-11030Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles t…
• CVE-2019-11031Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles t…
• CVE-2019-11032In EasyToRecruit (E2R) before 2.11, the upload feature and t…6.1
• CVE-2019-11033Applaud HCM 4.0.42+ uses HTML tag fields for HTML inputs in …
• CVE-2019-11034When processing certain files, PHP EXIF extension in version…9.1