# Vulnerabilities published in 2019


- [CVE-2019-15364](https://insights.sbomify.com/CVE-2019-15364/): Missing authorization in dexp:bl250 firmware (medium 5.5)
- [CVE-2019-15363](https://insights.sbomify.com/CVE-2019-15363/): Missing authorization in leagoo:power 5 firmware (medium 5.5)
- [CVE-2019-15362](https://insights.sbomify.com/CVE-2019-15362/): Missing authorization in lavamobiles:iris 88 firmware (medium 5.5)
- [CVE-2019-15361](https://insights.sbomify.com/CVE-2019-15361/): Missing authorization in infinixmobility:note 5 firmware (medium 5.5)
- [CVE-2019-15360](https://insights.sbomify.com/CVE-2019-15360/): Missing authorization in hisense:infinity u965 firmware (medium 5.5)
- [CVE-2019-15359](https://insights.sbomify.com/CVE-2019-15359/): Missing authorization in haier:a6 firmware (medium 5.5)
- [CVE-2019-15358](https://insights.sbomify.com/CVE-2019-15358/): Missing authorization in dexp:z250 firmware (medium 5.5)
- [CVE-2019-15357](https://insights.sbomify.com/CVE-2019-15357/): Missing authorization in advandigital:i6a firmware (medium 5.5)
- [CVE-2019-15356](https://insights.sbomify.com/CVE-2019-15356/): Missing authorization in lavamobiles:flair z1 firmware (medium 5.5)
- [CVE-2019-15355](https://insights.sbomify.com/CVE-2019-15355/): Missing authorization in tecno-mobile:camon iclick firmware (medium 5.5)
- [CVE-2019-15354](https://insights.sbomify.com/CVE-2019-15354/): Missing authorization in ulefone:armor 5 firmware (medium 5.5)
- [CVE-2019-15353](https://insights.sbomify.com/CVE-2019-15353/): Missing authorization in coolpad:n3c firmware (medium 5.5)
- [CVE-2019-15352](https://insights.sbomify.com/CVE-2019-15352/): Missing authorization in coolpad:mega 5 firmware (medium 5.5)
- [CVE-2019-15351](https://insights.sbomify.com/CVE-2019-15351/): Command injection in tecno-mobile:tecno\/h622\/tecno-id5b\ (high 7.8)
- [CVE-2019-15350](https://insights.sbomify.com/CVE-2019-15350/): Privilege escalation in tecno-mobile:tecno\/h622\/tecno-id5b\ (high 7.8)
- [CVE-2019-15349](https://insights.sbomify.com/CVE-2019-15349/): Privilege escalation in tecno-mobile:tecno\/h612\/tecno-id5a\ (high 7.8)
- [CVE-2019-15348](https://insights.sbomify.com/CVE-2019-15348/): Command injection in tecno-mobile:tecno\/h612\/tecno-id5a\ (high 7.8)
- [CVE-2019-15347](https://insights.sbomify.com/CVE-2019-15347/): Command injection in tecno-mobile:camon iclick 2 firmware (high 7.8)
- [CVE-2019-15346](https://insights.sbomify.com/CVE-2019-15346/): Privilege escalation in tecno-mobile:camon iclick 2 firmware (high 7.8)
- [CVE-2019-15345](https://insights.sbomify.com/CVE-2019-15345/): Privilege escalation in tecno-mobile:camon iclick firmware (high 7.8)
- [CVE-2019-15344](https://insights.sbomify.com/CVE-2019-15344/): Command injection in tecno-mobile:camon iclick firmware (high 8.1)
- [CVE-2019-15343](https://insights.sbomify.com/CVE-2019-15343/): Command injection in tecno-mobile:camon iclick firmware (high 7.8)
- [CVE-2019-15342](https://insights.sbomify.com/CVE-2019-15342/): Command injection in tecno-mobile:camon iair 2\+ firmware (high 7.8)
- [CVE-2019-15341](https://insights.sbomify.com/CVE-2019-15341/): Privilege escalation in tecno-mobile:camon iair 2\+ firmware (high 7.8)
- [CVE-2019-15340](https://insights.sbomify.com/CVE-2019-15340/): Missing authorization in mi:redmi 6 firmware (low 3.3)
- [CVE-2019-15339](https://insights.sbomify.com/CVE-2019-15339/): Missing authorization in lavamobiles:z60s firmware (low 3.3)
- [CVE-2019-15338](https://insights.sbomify.com/CVE-2019-15338/): Missing authorization in lavamobiles:iris 88 firmware (low 3.3)
- [CVE-2019-15337](https://insights.sbomify.com/CVE-2019-15337/): Missing authorization in lavamobiles:z81 firmware (low 3.3)
- [CVE-2019-15336](https://insights.sbomify.com/CVE-2019-15336/): Missing authorization in lavamobiles:z61 firmware (low 3.3)
- [CVE-2019-15335](https://insights.sbomify.com/CVE-2019-15335/): Missing authorization in lavamobiles:z92 firmware (low 3.3)
- [CVE-2019-15334](https://insights.sbomify.com/CVE-2019-15334/): Missing authorization in lavamobiles:iris 88 firmware (low 3.3)
- [CVE-2019-15333](https://insights.sbomify.com/CVE-2019-15333/): Missing authorization in lavamobiles:flair z1 firmware (low 3.3)
- [CVE-2019-15332](https://insights.sbomify.com/CVE-2019-15332/): Missing authorization in lavamobiles:z61 firmware (low 3.3)
- [CVE-2019-15331](https://insights.sbomify.com/CVE-2019-15331/): Cross-site scripting in wpsupportplus:wp support plus responsive ticket system (medium 6.1)
- [CVE-2019-15330](https://insights.sbomify.com/CVE-2019-15330/): Path traversal in webp express project:webp express (high 7.5)
- [CVE-2019-15329](https://insights.sbomify.com/CVE-2019-15329/): Cross-site request forgery in codection:import users from csv with meta (high 8.8)
- [CVE-2019-15328](https://insights.sbomify.com/CVE-2019-15328/): Cross-site scripting in codection:import users from csv with meta (medium 6.1)
- [CVE-2019-15327](https://insights.sbomify.com/CVE-2019-15327/): Cross-site scripting in codection:import users from csv with meta (medium 6.1)
- [CVE-2019-15326](https://insights.sbomify.com/CVE-2019-15326/): Path traversal in codection:import users from csv with meta (high 7.5)
- [CVE-2019-15325](https://insights.sbomify.com/CVE-2019-15325/): Security feature bypass in galliumos:galliumos (high 7.5)
- [CVE-2019-15324](https://insights.sbomify.com/CVE-2019-15324/): Code injection in ad inserter project:ad inserter (high 8.8)
- [CVE-2019-15323](https://insights.sbomify.com/CVE-2019-15323/): Path traversal in ad inserter project:ad inserter (high 7.5)
- [CVE-2019-15322](https://insights.sbomify.com/CVE-2019-15322/): Path traversal in wpmadeasy:shortcode factory (critical 9.8)
- [CVE-2019-15321](https://insights.sbomify.com/CVE-2019-15321/): Deserialization in optiontree project:optiontree (critical 9.8)
- [CVE-2019-15320](https://insights.sbomify.com/CVE-2019-15320/): Deserialization in optiontree project:optiontree (critical 9.8)
- [CVE-2019-15319](https://insights.sbomify.com/CVE-2019-15319/): Deserialization in optiontree project:optiontree (critical 9.8)
- [CVE-2019-15318](https://insights.sbomify.com/CVE-2019-15318/): Code injection in yikesinc:easy forms for mailchimp (critical 9.8)
- [CVE-2019-15317](https://insights.sbomify.com/CVE-2019-15317/): Cross-site scripting in givewp:givewp (medium 5.4)
- [CVE-2019-15316](https://insights.sbomify.com/CVE-2019-15316/): Privilege escalation in valvesoftware:steam client (high 7.0)
- [CVE-2019-15315](https://insights.sbomify.com/CVE-2019-15315/): Privilege escalation in valvesoftware:steam client (high 7.8)
- [CVE-2019-15314](https://insights.sbomify.com/CVE-2019-15314/): Cross-site scripting in tiki:tikiwiki cms\/groupware (medium 5.4)
- [CVE-2019-15313](https://insights.sbomify.com/CVE-2019-15313/): Cross-site scripting in zimbra:collaboration server (medium 6.1)
- [CVE-2019-15312](https://insights.sbomify.com/CVE-2019-15312/): Other in linkplay:linkplay (high 8.8)
- [CVE-2019-15311](https://insights.sbomify.com/CVE-2019-15311/): Command injection in linkplay:linkplay (critical 9.8)
- [CVE-2019-15310](https://insights.sbomify.com/CVE-2019-15310/): Hardcoded credentials in linkplay:linkplay (critical 9.8)
- [CVE-2019-15304](https://insights.sbomify.com/CVE-2019-15304/): Hardcoded credentials in progradegrill:wifi grilling thermometer firmware (critical 9.1)
- [CVE-2019-15302](https://insights.sbomify.com/CVE-2019-15302/): Business logic in xwiki:cryptpad (medium 6.5)
- [CVE-2019-15301](https://insights.sbomify.com/CVE-2019-15301/): SQL injection in terrasoft:bpm online crm system sdk (critical 9.8)
- [CVE-2019-15300](https://insights.sbomify.com/CVE-2019-15300/): SQL injection in centreon:centreon web (high 8.8)
- [CVE-2019-15299](https://insights.sbomify.com/CVE-2019-15299/): Auth bypass in centreon:centreon web (high 8.8)
- [CVE-2019-15298](https://insights.sbomify.com/CVE-2019-15298/): Command injection in centreon:centreon web (high 8.8)
- [CVE-2019-15297](https://insights.sbomify.com/CVE-2019-15297/): Null dereference in digium:asterisk (medium 6.5)
- [CVE-2019-15296](https://insights.sbomify.com/CVE-2019-15296/): Memory corruption in audiocoding:freeware advanced audio decoder 2 (high 7.8)
- [CVE-2019-15295](https://insights.sbomify.com/CVE-2019-15295/): Other in bitdefender:antivirus 2020 (high 7.8)
- [CVE-2019-15294](https://insights.sbomify.com/CVE-2019-15294/): Information disclosure in gallagher:command centre (critical 9.8)
- [CVE-2019-15293](https://insights.sbomify.com/CVE-2019-15293/): Memory corruption in acdsee:photo studio (high 7.8)
- [CVE-2019-15292](https://insights.sbomify.com/CVE-2019-15292/): Use after free in canonical:ubuntu linux (medium 4.7)
- [CVE-2019-15291](https://insights.sbomify.com/CVE-2019-15291/): Null dereference in linux:linux kernel (medium 4.6)
- [CVE-2019-15289](https://insights.sbomify.com/CVE-2019-15289/): Cisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service Vulnerabilities (high 7.5)
- [CVE-2019-15288](https://insights.sbomify.com/CVE-2019-15288/): Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Privilege Escalation Vulnerability (high 8.8)
- [CVE-2019-15287](https://insights.sbomify.com/CVE-2019-15287/): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (high 7.8)
- [CVE-2019-15286](https://insights.sbomify.com/CVE-2019-15286/): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (high 7.8)
- [CVE-2019-15285](https://insights.sbomify.com/CVE-2019-15285/): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (high 7.8)
- [CVE-2019-15284](https://insights.sbomify.com/CVE-2019-15284/): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (high 7.8)
- [CVE-2019-15283](https://insights.sbomify.com/CVE-2019-15283/): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (high 7.8)
- [CVE-2019-15282](https://insights.sbomify.com/CVE-2019-15282/): Cisco Identity Services Engine Information Disclosure Vulnerability (medium 4.3)
- [CVE-2019-15281](https://insights.sbomify.com/CVE-2019-15281/): Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability (medium 4.8)
- [CVE-2019-15280](https://insights.sbomify.com/CVE-2019-15280/): Cisco Firepower Management Center Software Stored Cross-Site Scripting Vulnerability (medium 4.8)
- [CVE-2019-15278](https://insights.sbomify.com/CVE-2019-15278/): Cisco Finesse Cross-Site Scripting Vulnerability (medium 6.1)
- [CVE-2019-15277](https://insights.sbomify.com/CVE-2019-15277/): Cisco TelePresence Collaboration Endpoint Software Privilege Escalation Vulnerability (medium 6.4)
- [CVE-2019-15276](https://insights.sbomify.com/CVE-2019-15276/): Cisco Wireless LAN Controller HTTP Parsing Engine Denial of Service Vulnerability (high 7.7)
- [CVE-2019-15275](https://insights.sbomify.com/CVE-2019-15275/): Cisco TelePresence Collaboration Endpoint Software Privilege Escalation Vulnerability (medium 6.7)
- [CVE-2019-15274](https://insights.sbomify.com/CVE-2019-15274/): Cisco TelePresence Collaboration Endpoint Software Command Injection Vulnerability (medium 6.4)
- [CVE-2019-15273](https://insights.sbomify.com/CVE-2019-15273/): Cisco TelePresence Collaboration Endpoint Software Arbitrary File Overwrite Vulnerabilities (medium 6.0)
- [CVE-2019-15272](https://insights.sbomify.com/CVE-2019-15272/): Cisco Unified Communications Manager Security Bypass Vulnerability (medium 6.5)
- [CVE-2019-15271](https://insights.sbomify.com/CVE-2019-15271/): Cisco RV Series Routers Deserialization of Untrusted Data (high 8.8, exploited in the wild)
- [CVE-2019-15270](https://insights.sbomify.com/CVE-2019-15270/): Cisco Firepower Management Center Stored Cross-Site Scripting Vulnerability (medium 5.4)
- [CVE-2019-15269](https://insights.sbomify.com/CVE-2019-15269/): Cisco Firepower Management Center Multiple Cross-Site Scripting Vulnerabilities (medium 4.8)
- [CVE-2019-15268](https://insights.sbomify.com/CVE-2019-15268/): Cisco Firepower Management Center Multiple Cross-Site Scripting Vulnerabilities (medium 4.8)
- [CVE-2019-15266](https://insights.sbomify.com/CVE-2019-15266/): Cisco Wireless LAN Controller Path Traversal Vulnerability (medium 4.4)
- [CVE-2019-15265](https://insights.sbomify.com/CVE-2019-15265/): Cisco Aironet Access Points Bridge Protocol Data Unit Port Disable Denial of Service Vulnerability (high 7.4)
- [CVE-2019-15264](https://insights.sbomify.com/CVE-2019-15264/): Cisco Aironet Access Points and Catalyst 9100 Access Points CAPWAP Denial of Service Vulnerability (high 7.4)
- [CVE-2019-15262](https://insights.sbomify.com/CVE-2019-15262/): Cisco Wireless LAN Controller Secure Shell Denial of Service Vulnerability (high 8.6)
- [CVE-2019-15261](https://insights.sbomify.com/CVE-2019-15261/): Cisco Aironet Access Points Point-to-Point Tunneling Protocol Denial of Service Vulnerability (high 8.6)
- [CVE-2019-15260](https://insights.sbomify.com/CVE-2019-15260/): Cisco Aironet Access Points Unauthorized Access Vulnerability (critical 9.8)
- [CVE-2019-15259](https://insights.sbomify.com/CVE-2019-15259/): Cisco Unified Contact Center Express HTTP Response Splitting Vulnerability (medium 6.1)
- [CVE-2019-15258](https://insights.sbomify.com/CVE-2019-15258/): Cisco SPA100 Series Analog Telephone Adapters Web Management Interface Denial of Service Vulnerability (medium 6.5)
- [CVE-2019-15257](https://insights.sbomify.com/CVE-2019-15257/): Cisco SPA100 Series Analog Telephone Adapters Running Configuration Information Disclosure Vulnerability (medium 6.5)
- [CVE-2019-15256](https://insights.sbomify.com/CVE-2019-15256/): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software IKEv1 Denial of Service Vulnerability (high 8.6)
- [CVE-2019-15255](https://insights.sbomify.com/CVE-2019-15255/): Cisco Identity Services Engine Authorization Bypass Vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/108/