# Vulnerabilities published in 2019


- [CVE-2019-15563](https://insights.sbomify.com/CVE-2019-15563/): OHDSI WebAPI vulnerable to SQL Injection (critical 9.8)
- [CVE-2019-15562](https://insights.sbomify.com/CVE-2019-15562/): SQL injection in gorm:gorm (critical 9.8)
- [CVE-2019-15561](https://insights.sbomify.com/CVE-2019-15561/): SQL injection in flashlingo project:flashlingo (critical 9.8)
- [CVE-2019-15560](https://insights.sbomify.com/CVE-2019-15560/): SQL injection in reviews module project:reviews module (critical 9.8)
- [CVE-2019-15559](https://insights.sbomify.com/CVE-2019-15559/): SQL injection in hawn project:hawn (critical 9.8)
- [CVE-2019-15558](https://insights.sbomify.com/CVE-2019-15558/): SQL injection in xm-online:xm\^online 2 - common utils and endpoints (critical 9.8)
- [CVE-2019-15557](https://insights.sbomify.com/CVE-2019-15557/): SQL injection in xm-online:xm\^online 2 user account and authentication server (critical 9.8)
- [CVE-2019-15556](https://insights.sbomify.com/CVE-2019-15556/): SQL injection in social network project:social network (critical 9.8)
- [CVE-2019-15555](https://insights.sbomify.com/CVE-2019-15555/): SQL injection in wellness project:wellness (critical 9.8)
- [CVE-2019-15554](https://insights.sbomify.com/CVE-2019-15554/): Memory corruption in smallvec (critical 9.8)
- [CVE-2019-15553](https://insights.sbomify.com/CVE-2019-15553/): Exposure of uninitialized memory in memoffset (high 7.5)
- [CVE-2019-15552](https://insights.sbomify.com/CVE-2019-15552/): Use after free in libflate (critical 9.8)
- [CVE-2019-15551](https://insights.sbomify.com/CVE-2019-15551/): Double free in smallvec (critical 9.8)
- [CVE-2019-15550](https://insights.sbomify.com/CVE-2019-15550/): Out of bounds read in simd-json (high 7.5)
- [CVE-2019-15549](https://insights.sbomify.com/CVE-2019-15549/): Memory exhaustion in asn1_der (high 7.5)
- [CVE-2019-15548](https://insights.sbomify.com/CVE-2019-15548/): Buffer overflow and format vulnerabilities in ncurses (critical 9.8)
- [CVE-2019-15547](https://insights.sbomify.com/CVE-2019-15547/): Mishandling of format strings in ncurses (high 7.5)
- [CVE-2019-15546](https://insights.sbomify.com/CVE-2019-15546/): Format string vulnerabilities in pancurses (high 7.5)
- [CVE-2019-15545](https://insights.sbomify.com/CVE-2019-15545/): Failure to properly verify ed25519 signatures in libp2p-core (high 7.5)
- [CVE-2019-15544](https://insights.sbomify.com/CVE-2019-15544/): Uncontrolled memory consumption in protobuf (high 7.5)
- [CVE-2019-15543](https://insights.sbomify.com/CVE-2019-15543/): Out of bounds write in slice-deque (critical 9.8)
- [CVE-2019-15542](https://insights.sbomify.com/CVE-2019-15542/): Uncontrolled recursion in ammonia (high 7.5)
- [CVE-2019-15541](https://insights.sbomify.com/CVE-2019-15541/): Denial of service in rustls project:rustls (high 7.5)
- [CVE-2019-15540](https://insights.sbomify.com/CVE-2019-15540/): Memory corruption in cdemu:libmirage (high 7.8)
- [CVE-2019-15539](https://insights.sbomify.com/CVE-2019-15539/): MantisBT XSS when uploading an attachment (medium 6.1)
- [CVE-2019-15538](https://insights.sbomify.com/CVE-2019-15538/): Denial of service in canonical:ubuntu linux (high 7.5)
- [CVE-2019-15537](https://insights.sbomify.com/CVE-2019-15537/): SQL Injection in SimpleSAMLphp (critical 9.8)
- [CVE-2019-15536](https://insights.sbomify.com/CVE-2019-15536/): SQL injection in youracclaim:acclaim (critical 9.8)
- [CVE-2019-15535](https://insights.sbomify.com/CVE-2019-15535/): SQL injection in hostosm:tasking manager (critical 9.8)
- [CVE-2019-15534](https://insights.sbomify.com/CVE-2019-15534/): SQL injection in raml-module-builder project:raml-module-builder (critical 9.8)
- [CVE-2019-15533](https://insights.sbomify.com/CVE-2019-15533/): SQL injection in xayr:xenfcoresharp (critical 9.8)
- [CVE-2019-15532](https://insights.sbomify.com/CVE-2019-15532/): Cross-Site Scripting in cyberchef (medium 6.1)
- [CVE-2019-15531](https://insights.sbomify.com/CVE-2019-15531/): Memory corruption in debian:debian linux (medium 6.5)
- [CVE-2019-15530](https://insights.sbomify.com/CVE-2019-15530/): Command injection in dlink:dir-823g firmware (high 8.8)
- [CVE-2019-15529](https://insights.sbomify.com/CVE-2019-15529/): Command injection in dlink:dir-823g firmware (high 8.8)
- [CVE-2019-15528](https://insights.sbomify.com/CVE-2019-15528/): Command injection in dlink:dir-823g firmware (high 8.8)
- [CVE-2019-15527](https://insights.sbomify.com/CVE-2019-15527/): Command injection in dlink:dir-823g firmware (high 8.8)
- [CVE-2019-15526](https://insights.sbomify.com/CVE-2019-15526/): Command injection in dlink:dir-823g firmware (high 8.8)
- [CVE-2019-15525](https://insights.sbomify.com/CVE-2019-15525/): Security feature bypass in pw3270 project:pw3270 (high 8.1)
- [CVE-2019-15524](https://insights.sbomify.com/CVE-2019-15524/): File upload in cszcms:csz cms (critical 9.8)
- [CVE-2019-15523](https://insights.sbomify.com/CVE-2019-15523/): Other in debian:debian linux (medium 5.3)
- [CVE-2019-15522](https://insights.sbomify.com/CVE-2019-15522/): Security feature bypass in linbit:csync2 (critical 9.8)
- [CVE-2019-15521](https://insights.sbomify.com/CVE-2019-15521/): Spoon Library as used in Fork CMS allows PHP object injection (critical 9.8)
- [CVE-2019-15520](https://insights.sbomify.com/CVE-2019-15520/): Path traversal in comelz:quark (medium 5.3)
- [CVE-2019-1552](https://insights.sbomify.com/CVE-2019-1552/): Windows builds with insecure path defaults (low 3.3)
- [CVE-2019-15519](https://insights.sbomify.com/CVE-2019-15519/): Path traversal in power-response project:power-response (critical 9.8)
- [CVE-2019-15518](https://insights.sbomify.com/CVE-2019-15518/): Path traversal in swoole:swoole (medium 5.3)
- [CVE-2019-15517](https://insights.sbomify.com/CVE-2019-15517/): Path traversal in jc21:nginx proxy manager (medium 5.5)
- [CVE-2019-15516](https://insights.sbomify.com/CVE-2019-15516/): Path traversal in cuberite:cuberite (high 7.5)
- [CVE-2019-15515](https://insights.sbomify.com/CVE-2019-15515/): Cross-site request forgery in discourse:discourse (medium 6.5)
- [CVE-2019-15514](https://insights.sbomify.com/CVE-2019-15514/): Information disclosure in telegram:telegram (medium 5.3)
- [CVE-2019-15513](https://insights.sbomify.com/CVE-2019-15513/): Denial of service in motorola:c1 mwr03 firmware (high 7.5)
- [CVE-2019-15511](https://insights.sbomify.com/CVE-2019-15511/): Privilege escalation in gog:galaxy (high 7.8)
- [CVE-2019-15510](https://insights.sbomify.com/CVE-2019-15510/): Cross-site scripting in zohocorp:manageengine desktop central (medium 6.1)
- [CVE-2019-1551](https://insights.sbomify.com/CVE-2019-1551/): rsaz_512_sqr overflow bug on x86_64 (medium 5.3)
- [CVE-2019-15508](https://insights.sbomify.com/CVE-2019-15508/): Information disclosure in octopus:server (medium 6.5)
- [CVE-2019-15507](https://insights.sbomify.com/CVE-2019-15507/): Information disclosure in octopus:server (medium 6.5)
- [CVE-2019-15506](https://insights.sbomify.com/CVE-2019-15506/): Missing authorization in kaseya:virtual system administrator (high 7.5)
- [CVE-2019-15505](https://insights.sbomify.com/CVE-2019-15505/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2019-15504](https://insights.sbomify.com/CVE-2019-15504/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2019-15503](https://insights.sbomify.com/CVE-2019-15503/): Command injection in altavoz:prontuscms (critical 9.8)
- [CVE-2019-15502](https://insights.sbomify.com/CVE-2019-15502/): Denial of service in teamspeak:teamspeak (high 7.5)
- [CVE-2019-15501](https://insights.sbomify.com/CVE-2019-15501/): Cross-site scripting in lsoft:listserv (medium 6.1)
- [CVE-2019-15499](https://insights.sbomify.com/CVE-2019-15499/): Cross-site scripting in hackmd:codimd (medium 6.1)
- [CVE-2019-15498](https://insights.sbomify.com/CVE-2019-15498/): Command injection in getvera:vera edge firmware (high 8.8)
- [CVE-2019-15497](https://insights.sbomify.com/CVE-2019-15497/): Hardcoded credentials in blackbox:icompel firmware (critical 9.8)
- [CVE-2019-15496](https://insights.sbomify.com/CVE-2019-15496/): Cross-site request forgery in manageyourteam:myt project management (high 8.8)
- [CVE-2019-15494](https://insights.sbomify.com/CVE-2019-15494/): Server-side request forgery in it-novum:openitcockpit (critical 9.8)
- [CVE-2019-15493](https://insights.sbomify.com/CVE-2019-15493/): Other in it-novum:openitcockpit (high 7.5)
- [CVE-2019-15492](https://insights.sbomify.com/CVE-2019-15492/): Cross-site scripting in it-novum:openitcockpit (medium 6.1)
- [CVE-2019-15491](https://insights.sbomify.com/CVE-2019-15491/): Cross-site request forgery in it-novum:openitcockpit (high 8.8)
- [CVE-2019-15490](https://insights.sbomify.com/CVE-2019-15490/): Command injection in it-novum:openitcockpit (critical 9.8)
- [CVE-2019-1549](https://insights.sbomify.com/CVE-2019-1549/): Fork Protection (medium 5.3)
- [CVE-2019-15489](https://insights.sbomify.com/CVE-2019-15489/): laracom Cross-site Scripting (medium 6.1)
- [CVE-2019-15488](https://insights.sbomify.com/CVE-2019-15488/): Cross-site Scripting in Ignite Realtime Openfire (medium 6.1)
- [CVE-2019-15487](https://insights.sbomify.com/CVE-2019-15487/): Cross-site scripting in schoolexperience:department for education school experience (medium 6.1)
- [CVE-2019-15486](https://insights.sbomify.com/CVE-2019-15486/): Cross-site Scripting in django-js-reverse (medium 6.1)
- [CVE-2019-15485](https://insights.sbomify.com/CVE-2019-15485/): Cross-site Scripting in Bolt (medium 6.1)
- [CVE-2019-15484](https://insights.sbomify.com/CVE-2019-15484/): Bolt Cross-site Scripting (XSS) via an image's alt or title field (medium 6.1)
- [CVE-2019-15483](https://insights.sbomify.com/CVE-2019-15483/): Bolt Cross-site Scripting (XSS) via a title that is mishandled in the system log (medium 6.1)
- [CVE-2019-15482](https://insights.sbomify.com/CVE-2019-15482/): Cross-Site Scripting in selectize-plugin-a11y (medium 6.1)
- [CVE-2019-15481](https://insights.sbomify.com/CVE-2019-15481/): Kimai v2 is vulnerable to Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2019-15480](https://insights.sbomify.com/CVE-2019-15480/): Domoticz 4.10717 has XSS via item.Name. (medium 5.4)
- [CVE-2019-15479](https://insights.sbomify.com/CVE-2019-15479/): Status Board vulnerable to Cross-Site Scripting before v1.1.82 (medium 6.1)
- [CVE-2019-15478](https://insights.sbomify.com/CVE-2019-15478/): Cross-Site Scripting in status-board (medium 6.1)
- [CVE-2019-15477](https://insights.sbomify.com/CVE-2019-15477/): Cross-site Scripting in Jooby (medium 6.1)
- [CVE-2019-15476](https://insights.sbomify.com/CVE-2019-15476/): Cross-site scripting in former project:former (medium 6.1)
- [CVE-2019-15475](https://insights.sbomify.com/CVE-2019-15475/): Missing authorization in mi:a3 firmware (medium 5.5)
- [CVE-2019-15474](https://insights.sbomify.com/CVE-2019-15474/): Missing authorization in mi:cepheus firmware (medium 5.5)
- [CVE-2019-15473](https://insights.sbomify.com/CVE-2019-15473/): Missing authorization in mi:a2 lite firmware (medium 5.5)
- [CVE-2019-15472](https://insights.sbomify.com/CVE-2019-15472/): Missing authorization in mi:a2 lite firmware (medium 5.5)
- [CVE-2019-15471](https://insights.sbomify.com/CVE-2019-15471/): Missing authorization in mi:mix 2s firmware (medium 5.5)
- [CVE-2019-15470](https://insights.sbomify.com/CVE-2019-15470/): Missing authorization in mi:redmi note 6 pro firmware (medium 5.5)
- [CVE-2019-1547](https://insights.sbomify.com/CVE-2019-1547/): ECDSA remote timing attack (medium 4.7)
- [CVE-2019-15469](https://insights.sbomify.com/CVE-2019-15469/): Missing authorization in mi:pad 4 firmware (medium 5.5)
- [CVE-2019-15468](https://insights.sbomify.com/CVE-2019-15468/): Missing authorization in mi:a2 lite firmware (medium 5.5)
- [CVE-2019-15467](https://insights.sbomify.com/CVE-2019-15467/): Missing authorization in mi:mix 2s firmware (low 3.3)
- [CVE-2019-15466](https://insights.sbomify.com/CVE-2019-15466/): Missing authorization in mi:redmi 6 pro firmware (low 3.3)
- [CVE-2019-15465](https://insights.sbomify.com/CVE-2019-15465/): Missing authorization in samsung:galaxy j7 pro firmware (high 7.8)
- [CVE-2019-15464](https://insights.sbomify.com/CVE-2019-15464/): Missing authorization in samsung:galaxy j7 pro firmware (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/106/