CVE-2019-8385

An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358. An unauthenticated directory traversal and local file inclusion vulnerability in the ThomsonReuters.Desktop.Service.exe and ThomsonReuters.Desktop.exe allows a remote attacker to list or enumerate sensitive contents of files via a \.. to port 6677. Additionally, this could allow for privilege escalation by dumping the affected machine's SAM and SYSTEM database files, as well as remote code execution.

• CWE-22

• http://packetstormsecurity.com/files/152298/Thomson-Reuters-Concourse-And-Firm-Central-Local-File-Inclusion-Directory-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• https://www.thomsonreuters.com/en/products-services.htmlVendor Advisory
• http://packetstormsecurity.com/files/152298/Thomson-Reuters-Concourse-And-Firm-Central-Local-File-Inclusion-Directory-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• https://www.thomsonreuters.com/en/products-services.htmlVendor Advisory

Published

Jun 5, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-8378An issue was discovered in Bento4 1.5.1-628. A heap-based bu…
• CVE-2019-8379An issue was discovered in AdvanceCOMP through 2.1. A NULL p…7.8
• CVE-2019-8380An issue was discovered in Bento4 1.5.1-628. A NULL pointer …
• CVE-2019-8381An issue was discovered in Tcpreplay 4.3.1. An invalid memor…7.8
• CVE-2019-8382An issue was discovered in Bento4 1.5.1-628. A NULL pointer …
• CVE-2019-8383An issue was discovered in AdvanceCOMP through 2.1. An inval…7.8
• CVE-2019-8387MASTER IPCAMERA01 3.3.4.2103 devices allow Remote Command Ex…
• CVE-2019-8389A file-read vulnerability was identified in the Wi-Fi transf…8.1
• CVE-2019-8390qdPM 9.1 suffers from Cross-site Scripting (XSS) in the sear…
• CVE-2019-8391qdPM 9.1 suffers from Cross-site Scripting (XSS) via configu…
• CVE-2019-8392An issue was discovered on D-Link DIR-823G devices with firm…
• CVE-2019-8393Hotels_Server through 2018-11-05 has SQL Injection via the A…