CVE-2019-13637

In LogMeIn join.me before 3.16.0.5505, an attacker could execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used by the application URI that is defined in Windows. An attacker could exploit this vulnerability by convincing a targeted user to follow a malicious link. Successful exploitation could cause the application to load libraries from the directory targeted by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileges of the targeted user if the attacker can place a crafted library in a directory that is accessible to the vulnerable system.

• CWE-426

• https://github.com/active-labs/Advisories/blob/master/ACTIVE-2019-009.mdThird Party Advisory
• https://github.com/active-labs/Advisories/blob/master/ACTIVE-2019-009.mdThird Party Advisory

Published

Jul 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-13629MatrixSSL 4.2.1 and earlier contains a timing side channel i…5.9
• CVE-2019-1363An information disclosure vulnerability exists in the way th…5.5
• CVE-2019-13631In parse_hid_report_descriptor in drivers/input/tablet/gtco.…
• CVE-2019-13633Blinger.io v.1.0.2519 is vulnerable to Blind/Persistent XSS.…6.1
• CVE-2019-13635The WP Fastest Cache plugin through 0.8.9.5 for WordPress al…
• CVE-2019-13636In GNU patch through 2.7.6, the following of symlinks is mis…
• CVE-2019-13638GNU patch through 2.7.6 is vulnerable to OS shell command in…
• CVE-2019-1364An elevation of privilege vulnerability exists in Windows wh…7.8
• CVE-2019-13640In qBittorrent before 4.1.7, the function Application::runEx…
• CVE-2019-13643Stored XSS in EspoCRM before 5.6.4 allows remote attackers t…
• CVE-2019-13644Firefly III before 4.7.17.1 is vulnerable to stored XSS due …5.4
• CVE-2019-13645Firefly III before 4.7.17.3 is vulnerable to stored XSS due …