CVE-2019-1689

A vulnerability in the client application for iOS of Cisco Webex Teams could allow an authenticated, remote attacker to upload arbitrary files within the scope of the iOS application. The vulnerability is due to improper input validation in the client application. An attacker could exploit this vulnerability by sending a malicious file to a targeted user and persuading the user to manually open it. An exploit could allow the attacker to overwrite sensitive application files and eventually cause a denial of service (DoS) condition by foreclosing future access to the system to the targeted user. This vulnerability is fixed in version 3.13.26920.

• CWE-20
• CWE-20

• http://www.securityfocus.com/bid/107101Broken Link, Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-webx-ios-fileExploit, Vendor Advisory
• http://www.securityfocus.com/bid/107101Broken Link, Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-webx-ios-fileExploit, Vendor Advisory

Published

Feb 25, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16881An issue was discovered in the portaudio-rs crate through 0.…9.8
• CVE-2019-16882An issue was discovered in the string-interner crate before …7.5
• CVE-2019-16884runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce…7.5
• CVE-2019-16885In OkayCMS through 2.3.4, an unauthenticated attacker can ac…9.8
• CVE-2019-16887In IrfanView 4.53, Data from a Faulting Address controls a s…7.8
• CVE-2019-16889Ubiquiti EdgeMAX devices before 2.0.3 allow remote attackers…7.5
• CVE-2019-16890Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to a…5.4
• CVE-2019-16891Liferay Portal CE 6.2.5 allows remote command execution beca…9.8
• CVE-2019-16892In Rubyzip before 1.3.0, a crafted ZIP file can bypass appli…5.5
• CVE-2019-16893The Web Management of TP-Link TP-SG105E V4 1.0.0 Build 20181…7.5
• CVE-2019-16894download.php in inoERP 4.15 allows SQL injection through ins…9.8
• CVE-2019-16895Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…