# Vulnerabilities published in 2019


- [CVE-2019-15878](https://insights.sbomify.com/CVE-2019-15878/): Use after free in FreeBSD (high 7.8)
- [CVE-2019-15877](https://insights.sbomify.com/CVE-2019-15877/): Missing authorization in FreeBSD (medium 5.5)
- [CVE-2019-15876](https://insights.sbomify.com/CVE-2019-15876/): Missing authorization in FreeBSD (medium 5.5)
- [CVE-2019-15875](https://insights.sbomify.com/CVE-2019-15875/): Information disclosure in FreeBSD (low 3.3)
- [CVE-2019-15874](https://insights.sbomify.com/CVE-2019-15874/): Use after free in FreeBSD (critical 9.8)
- [CVE-2019-15873](https://insights.sbomify.com/CVE-2019-15873/): Code injection in metagauss:profilegrid (high 8.8)
- [CVE-2019-15872](https://insights.sbomify.com/CVE-2019-15872/): SQL injection in wpbrigade:loginpress (critical 9.8)
- [CVE-2019-15871](https://insights.sbomify.com/CVE-2019-15871/): Missing authorization in wpbrigade:loginpress (medium 4.3)
- [CVE-2019-15870](https://insights.sbomify.com/CVE-2019-15870/): Cross-site scripting in scriptsbundle:carspot (medium 5.4)
- [CVE-2019-1587](https://insights.sbomify.com/CVE-2019-1587/): Information disclosure in Cisco Application Policy Infrastructure Controller (APIC) (medium 4.3)
- [CVE-2019-15869](https://insights.sbomify.com/CVE-2019-15869/): Cross-site scripting in jobcareer project:jobcareer (medium 5.4)
- [CVE-2019-15868](https://insights.sbomify.com/CVE-2019-15868/): Cross-site request forgery in wpaffiliatemanager:affiliates manager (high 8.8)
- [CVE-2019-15867](https://insights.sbomify.com/CVE-2019-15867/): Hardcoded credentials in omaksolutions:slick-popup (high 8.8)
- [CVE-2019-15866](https://insights.sbomify.com/CVE-2019-15866/): File upload in crelly slider project:crelly slider (high 8.8)
- [CVE-2019-15865](https://insights.sbomify.com/CVE-2019-15865/): Cross-site request forgery in holest:breadcrumbs by menu (high 8.8)
- [CVE-2019-15864](https://insights.sbomify.com/CVE-2019-15864/): Cross-site scripting in holest:breadcrumbs by menu (medium 6.1)
- [CVE-2019-15863](https://insights.sbomify.com/CVE-2019-15863/): Business logic in convertplug:convertplus (high 7.5)
- [CVE-2019-15862](https://insights.sbomify.com/CVE-2019-15862/): File upload in cksource:ckfinder (high 7.5)
- [CVE-2019-15860](https://insights.sbomify.com/CVE-2019-15860/): Null dereference in glyphandcog:xpdfreader (medium 5.5)
- [CVE-2019-1586](https://insights.sbomify.com/CVE-2019-1586/): Cisco Application Policy Infrastructure Controller Recoverable Encryption Key Vulnerability (medium 4.6)
- [CVE-2019-15859](https://insights.sbomify.com/CVE-2019-15859/): Information disclosure in socomec:diris a-40 firmware (critical 9.8)
- [CVE-2019-15858](https://insights.sbomify.com/CVE-2019-15858/): Missing authorization in webcraftic:woody ad snippets (high 8.8)
- [CVE-2019-15855](https://insights.sbomify.com/CVE-2019-15855/): Path traversal in maarch:maarch rm (critical 9.1)
- [CVE-2019-15854](https://insights.sbomify.com/CVE-2019-15854/): Privilege escalation in maarch:maarch rm (high 8.8)
- [CVE-2019-15850](https://insights.sbomify.com/CVE-2019-15850/): Missing authorization in eq-3:homematic ccu3 firmware (high 8.8)
- [CVE-2019-1585](https://insights.sbomify.com/CVE-2019-1585/): Cisco Nexus 9000 Series Fabric Switches Application-Centric Infrastructure Mode Privilege Escalation Vulnerability (medium 6.7)
- [CVE-2019-15849](https://insights.sbomify.com/CVE-2019-15849/): Auth bypass in eq-3:homematic ccu3 firmware (high 7.3)
- [CVE-2019-15848](https://insights.sbomify.com/CVE-2019-15848/): Cross-site scripting in jetbrains:teamcity (medium 6.1)
- [CVE-2019-15847](https://insights.sbomify.com/CVE-2019-15847/): Weak cryptography in gnu:gcc (high 7.5)
- [CVE-2019-15846](https://insights.sbomify.com/CVE-2019-15846/): Command injection in debian:debian linux (critical 9.8)
- [CVE-2019-15845](https://insights.sbomify.com/CVE-2019-15845/): Path traversal in canonical:ubuntu linux (medium 6.5)
- [CVE-2019-15843](https://insights.sbomify.com/CVE-2019-15843/): File upload in mi:xiaomi millet firmware (high 7.4)
- [CVE-2019-15842](https://insights.sbomify.com/CVE-2019-15842/): Cross-site scripting in easy pdf restaurant menu upload project:easy pdf restaurant menu upload (medium 6.1)
- [CVE-2019-15841](https://insights.sbomify.com/CVE-2019-15841/): Cross-site request forgery in facebook:facebook for woocommerce (high 8.8)
- [CVE-2019-15840](https://insights.sbomify.com/CVE-2019-15840/): Cross-site request forgery in facebook:facebook for woocommerce (high 8.8)
- [CVE-2019-1584](https://insights.sbomify.com/CVE-2019-1584/): Command injection in Palo Alto Networks Zingbox Inspector (critical 9.8)
- [CVE-2019-15839](https://insights.sbomify.com/CVE-2019-15839/): Path traversal in sinaextra:sina extension for elementor (high 7.5)
- [CVE-2019-15838](https://insights.sbomify.com/CVE-2019-15838/): Cross-site scripting in kunalnagar:custom 404 pro (medium 6.1)
- [CVE-2019-15837](https://insights.sbomify.com/CVE-2019-15837/): Cross-site scripting in bitwise-it:webp express (medium 5.4)
- [CVE-2019-15836](https://insights.sbomify.com/CVE-2019-15836/): Cross-site scripting in bootstrapped:wp ultimate recipe (medium 5.4)
- [CVE-2019-15835](https://insights.sbomify.com/CVE-2019-15835/): Cross-site request forgery in wp better permalinks project:wp better permalinks (high 8.8)
- [CVE-2019-15834](https://insights.sbomify.com/CVE-2019-15834/): Cross-site request forgery in webp converter for media project:webp converter for media (high 8.8)
- [CVE-2019-15833](https://insights.sbomify.com/CVE-2019-15833/): Cross-site scripting in simple mail address encoder project:simple mail address encoder (medium 6.1)
- [CVE-2019-15832](https://insights.sbomify.com/CVE-2019-15832/): Cross-site request forgery in wp-buy:visitor traffic real time statistics (high 8.8)
- [CVE-2019-15831](https://insights.sbomify.com/CVE-2019-15831/): Cross-site request forgery in wp-buy:visitor traffic real time statistics (high 8.8)
- [CVE-2019-15830](https://insights.sbomify.com/CVE-2019-15830/): Cross-site scripting in icegram:icegram engage (medium 5.4)
- [CVE-2019-1583](https://insights.sbomify.com/CVE-2019-1583/): Cross-site scripting in Palo Alto Networks Twistlock (high 8.0)
- [CVE-2019-15829](https://insights.sbomify.com/CVE-2019-15829/): Cross-site scripting in greentreelabs:gallery photoblocks (medium 4.8)
- [CVE-2019-15828](https://insights.sbomify.com/CVE-2019-15828/): Cross-site request forgery in tribulant:one click ssl (high 8.8)
- [CVE-2019-15827](https://insights.sbomify.com/CVE-2019-15827/): Cross-site scripting in onesignal:onesignal-free-web-push-notifications (medium 5.4)
- [CVE-2019-15826](https://insights.sbomify.com/CVE-2019-15826/): Security feature bypass in wpserveur:wps hide login (critical 9.8)
- [CVE-2019-15825](https://insights.sbomify.com/CVE-2019-15825/): Security feature bypass in wpserveur:wps hide login (critical 9.8)
- [CVE-2019-15824](https://insights.sbomify.com/CVE-2019-15824/): Security feature bypass in wpserveur:wps hide login (critical 9.8)
- [CVE-2019-15823](https://insights.sbomify.com/CVE-2019-15823/): Security feature bypass in wpserveur:wps hide login (critical 9.8)
- [CVE-2019-15822](https://insights.sbomify.com/CVE-2019-15822/): Path traversal in wpserveur:wps child theme generator (critical 9.8)
- [CVE-2019-15821](https://insights.sbomify.com/CVE-2019-15821/): Missing authorization in bold-themes:bold page builder (high 7.5)
- [CVE-2019-15820](https://insights.sbomify.com/CVE-2019-15820/): Missing authorization in login or logout menu item project:login or logout menu item (medium 6.1)
- [CVE-2019-1582](https://insights.sbomify.com/CVE-2019-1582/): Memory corruption in Palo Alto Networks PAN-OS (high 7.2)
- [CVE-2019-15819](https://insights.sbomify.com/CVE-2019-15819/): Missing authorization in restaurant reservations project:restaurant reservations (critical 9.8)
- [CVE-2019-15818](https://insights.sbomify.com/CVE-2019-15818/): Missing authorization in webcraftic:simple 301 redirects (medium 6.1)
- [CVE-2019-15817](https://insights.sbomify.com/CVE-2019-15817/): Cross-site scripting in realestateconnected:easy property listings (medium 6.1)
- [CVE-2019-15816](https://insights.sbomify.com/CVE-2019-15816/): Missing authorization in wpexpertdeveloper:wp private content plus (high 7.5)
- [CVE-2019-15815](https://insights.sbomify.com/CVE-2019-15815/): Missing authorization in zyxel:2.00\(abbx.3\) (medium 6.5)
- [CVE-2019-15814](https://insights.sbomify.com/CVE-2019-15814/): Cross-site scripting in sentrifugo:sentrifugo (medium 5.4)
- [CVE-2019-15813](https://insights.sbomify.com/CVE-2019-15813/): File upload in sentrifugo:sentrifugo (high 8.8)
- [CVE-2019-15811](https://insights.sbomify.com/CVE-2019-15811/): Cross-site scripting in domainmod:domainmod (medium 6.1)
- [CVE-2019-15810](https://insights.sbomify.com/CVE-2019-15810/): Cross-site scripting in netdisco:netdisco (medium 6.1)
- [CVE-2019-1581](https://insights.sbomify.com/CVE-2019-1581/): PAN-OS: Remote code execution vulnerability in the PAN-OS SSH device management interface (critical 9.8)
- [CVE-2019-15809](https://insights.sbomify.com/CVE-2019-15809/): Weak cryptography in athena-scs:idprotect (medium 4.7)
- [CVE-2019-15807](https://insights.sbomify.com/CVE-2019-15807/): Denial of service in debian:debian linux (medium 4.7)
- [CVE-2019-15806](https://insights.sbomify.com/CVE-2019-15806/): Information disclosure in commscope:tr4400 firmware (critical 9.8)
- [CVE-2019-15805](https://insights.sbomify.com/CVE-2019-15805/): Information disclosure in commscope:tr4400 firmware (critical 9.8)
- [CVE-2019-15804](https://insights.sbomify.com/CVE-2019-15804/): Security feature bypass in zyxel:gs1900-10hp firmware (high 7.5)
- [CVE-2019-15803](https://insights.sbomify.com/CVE-2019-15803/): Auth bypass in zyxel:gs1900-10hp firmware (critical 9.1)
- [CVE-2019-15802](https://insights.sbomify.com/CVE-2019-15802/): Hardcoded credentials in zyxel:gs1900-10hp firmware (medium 5.9)
- [CVE-2019-15801](https://insights.sbomify.com/CVE-2019-15801/): Hardcoded credentials in zyxel:gs1900-10hp firmware (high 7.5)
- [CVE-2019-15800](https://insights.sbomify.com/CVE-2019-15800/): Command injection in zyxel:gs1900-10hp firmware (critical 9.8)
- [CVE-2019-1580](https://insights.sbomify.com/CVE-2019-1580/): Memory corruption in Palo Alto Networks PAN-OS (critical 9.8)
- [CVE-2019-15799](https://insights.sbomify.com/CVE-2019-15799/): Privilege escalation in zyxel:gs1900-10hp firmware (high 8.8)
- [CVE-2019-15796](https://insights.sbomify.com/CVE-2019-15796/): python-apt downloads from untrusted sources (medium 4.7)
- [CVE-2019-15795](https://insights.sbomify.com/CVE-2019-15795/): python-apt uses MD5 for validation (medium 4.7)
- [CVE-2019-15794](https://insights.sbomify.com/CVE-2019-15794/): Reference counting error in overlayfs/shiftfs error path when used in conjuction with aufs (high 7.1)
- [CVE-2019-15793](https://insights.sbomify.com/CVE-2019-15793/): Mishandling of file-system uid/gid with namespaces in shiftfs (medium 6.5)
- [CVE-2019-15792](https://insights.sbomify.com/CVE-2019-15792/): Type confusion in shiftfs (high 7.1)
- [CVE-2019-15791](https://insights.sbomify.com/CVE-2019-15791/): Reference count underflow in shiftfs (high 7.1)
- [CVE-2019-15790](https://insights.sbomify.com/CVE-2019-15790/): Apport reads PID files with elevated privileges (low 2.8)
- [CVE-2019-1579](https://insights.sbomify.com/CVE-2019-1579/): Palo Alto Networks PAN-OS Remote Code Execution (high 8.1, exploited in the wild)
- [CVE-2019-15789](https://insights.sbomify.com/CVE-2019-15789/): Microk8s Privilege Escalation Vulnerability (high 8.8)
- [CVE-2019-15788](https://insights.sbomify.com/CVE-2019-15788/): Integer overflow in nvidia:clara genomics analysis (critical 9.8)
- [CVE-2019-15787](https://insights.sbomify.com/CVE-2019-15787/): Integer overflow in libzetta-rs project:libzetta-rs (high 7.5)
- [CVE-2019-15786](https://insights.sbomify.com/CVE-2019-15786/): Memory corruption in robotis:dynamixel sdk (critical 9.8)
- [CVE-2019-15785](https://insights.sbomify.com/CVE-2019-15785/): Memory corruption in fontforge:fontforge (critical 9.8)
- [CVE-2019-15784](https://insights.sbomify.com/CVE-2019-15784/): Memory corruption in srtalliance:secure reliable transport (critical 9.8)
- [CVE-2019-15783](https://insights.sbomify.com/CVE-2019-15783/): Memory corruption in lute-tab project:lute-tab (critical 9.8)
- [CVE-2019-15782](https://insights.sbomify.com/CVE-2019-15782/): Cross-Site Scripting in webtorrent (medium 6.1)
- [CVE-2019-15781](https://insights.sbomify.com/CVE-2019-15781/): Cross-site request forgery in weblizar:social likebox \& feed (high 8.8)
- [CVE-2019-15780](https://insights.sbomify.com/CVE-2019-15780/): Deserialization in strategy11:formidable form builder (critical 9.8)
- [CVE-2019-1578](https://insights.sbomify.com/CVE-2019-1578/): Cross-site scripting in MineMeld (medium 6.1)
- [CVE-2019-15779](https://insights.sbomify.com/CVE-2019-15779/): Cross-site request forgery in quadlayers:wp social feed gallery (high 8.8)
- [CVE-2019-15778](https://insights.sbomify.com/CVE-2019-15778/): Cross-site scripting in getwooplugins:additional variation images for woocommerce (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/103/