CVE-2019-7590

ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' have an unquoted service path. If an authenticated user is able to insert code in their system root path it potentially can be executed during the application startup. This could allow the authenticated user to elevate privileges on the system. This issue affects: Exacq Technologies, Inc. exacqVision Server 9.6; 9.8. This issue does not affect: Exacq Technologies, Inc. exacqVision Server version 9.4 and prior versions; 19.03. It is not known whether this issue affects: Exacq Technologies, Inc. exacqVision Server versions prior to 8.4.

• CWE-428
• CWE-428

• http://www.securityfocus.com/bid/109307Third Party Advisory, VDB Entry
• https://gallery.technet.microsoft.com/scriptcenter/Windows-Unquoted-Service-190f0341Patch, Third Party Advisory
• https://packetstormsecurity.com/files/152128/exacqVision-9.8-Unquoted-Service-Path-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
• https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesMitigation, Vendor Advisory
• https://www.us-cert.gov/ics/advisories/icsa-19-199-01Third Party Advisory, US Government Resource
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5515.phpThird Party Advisory
• http://www.securityfocus.com/bid/109307Third Party Advisory, VDB Entry
• https://gallery.technet.microsoft.com/scriptcenter/Windows-Unquoted-Service-190f0341Patch, Third Party Advisory
• https://packetstormsecurity.com/files/152128/exacqVision-9.8-Unquoted-Service-Path-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
• https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesMitigation, Vendor Advisory
• https://www.us-cert.gov/ics/advisories/icsa-19-199-01Third Party Advisory, US Government Resource
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5515.phpThird Party Advisory

Published

Jul 19, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-7581The parseSWF_ACTIONRECORD function in util/parser.c in libmi…
• CVE-2019-7582The readBytes function in util/read.c in libming through 0.4…
• CVE-2019-7585An issue was discovered in Waimai Super Cms 20150505. web/Li…
• CVE-2019-7587Bo-blog Wind through 1.6.0-r allows SQL Injection via the ad…
• CVE-2019-7588A vulnerability in the exacqVision Enterprise System Manager…6.7
• CVE-2019-7589A vulnerability with the SmartService API Service option exi…9.8
• CVE-2019-7593Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.…6.8
• CVE-2019-7594Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.…6.8
• CVE-2019-7608Kibana versions before 5.6.15 and 6.6.1 had a cross-site scr…
• CVE-2019-7609Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary…10
• CVE-2019-7610Kibana versions before 6.6.1 contain an arbitrary code execu…
• CVE-2019-7611A permission issue was found in Elasticsearch versions befor…8.1