# Vulnerabilities published in 2019


- [CVE-2019-15090](https://insights.sbomify.com/CVE-2019-15090/): Memory corruption in canonical:ubuntu linux (medium 6.7)
- [CVE-2019-15089](https://insights.sbomify.com/CVE-2019-15089/): Cross-site request forgery in prise:adas (high 8.8)
- [CVE-2019-15088](https://insights.sbomify.com/CVE-2019-15088/): Auth bypass in prise:adas (critical 9.8)
- [CVE-2019-15087](https://insights.sbomify.com/CVE-2019-15087/): Code injection in prise:adas (high 7.2)
- [CVE-2019-15086](https://insights.sbomify.com/CVE-2019-15086/): Cross-site scripting in prise:adas (medium 6.1)
- [CVE-2019-15085](https://insights.sbomify.com/CVE-2019-15085/): Information disclosure in prise:adas (high 7.5)
- [CVE-2019-15084](https://insights.sbomify.com/CVE-2019-15084/): Misconfiguration in maxx:waves maxx audio (high 7.8)
- [CVE-2019-15083](https://insights.sbomify.com/CVE-2019-15083/): Cross-site scripting in zohocorp:manageengine servicedesk plus (medium 6.1)
- [CVE-2019-15082](https://insights.sbomify.com/CVE-2019-15082/): Cross-site scripting in yofla:360 product rotation (medium 6.1)
- [CVE-2019-15081](https://insights.sbomify.com/CVE-2019-15081/): Cross-site scripting in opencart:opencart (medium 4.8)
- [CVE-2019-15080](https://insights.sbomify.com/CVE-2019-15080/): Business logic in morph project:morph (high 7.5)
- [CVE-2019-15079](https://insights.sbomify.com/CVE-2019-15079/): Business logic in eai project:eai (high 7.5)
- [CVE-2019-15078](https://insights.sbomify.com/CVE-2019-15078/): Business logic in xbornid:xbornid (high 7.5)
- [CVE-2019-15075](https://insights.sbomify.com/CVE-2019-15075/): Hardcoded credentials in inextrix:astpp (high 7.5)
- [CVE-2019-15074](https://insights.sbomify.com/CVE-2019-15074/): MantisBT allows cross-site scripting (XSS) via crafted filename (critical 9.6)
- [CVE-2019-15073](https://insights.sbomify.com/CVE-2019-15073/): Openfind MAIL2000 Webmail Pre-Auth Open Redirect (medium 6.1)
- [CVE-2019-15072](https://insights.sbomify.com/CVE-2019-15072/): Openfind MAIL2000 Webmail Post-Auth Cross-Site Scripting (medium 6.1)
- [CVE-2019-15071](https://insights.sbomify.com/CVE-2019-15071/): Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting (medium 6.1)
- [CVE-2019-15069](https://insights.sbomify.com/CVE-2019-15069/): An unsafe authentication interface was discovered in Smart Battery A4 (critical 9.8)
- [CVE-2019-15068](https://insights.sbomify.com/CVE-2019-15068/): A broken access control vulnerability discovered in Smart Battery A4 (critical 9.8)
- [CVE-2019-15067](https://insights.sbomify.com/CVE-2019-15067/): An authentication bypass vulnerability discovered in Smart Battery A2-25DE (critical 9.8)
- [CVE-2019-15066](https://insights.sbomify.com/CVE-2019-15066/): A remote command execution vulnerability was discovered in HiNet GPON firmware < I040GWR190731 port 6998 (critical 10.0)
- [CVE-2019-15065](https://insights.sbomify.com/CVE-2019-15065/): A vulnerability was discovered in HiNet GPON firmware < I040GWR190731 that allows an attacker to read arbitrary files (critical 9.3)
- [CVE-2019-15064](https://insights.sbomify.com/CVE-2019-15064/): HiNet GPON firmware version < I040GWR190731 allows a user login to device without any authentication (critical 9.8)
- [CVE-2019-15062](https://insights.sbomify.com/CVE-2019-15062/): Dolibarr Cross-Site Request Forgery (CSRF) (high 8.0)
- [CVE-2019-15060](https://insights.sbomify.com/CVE-2019-15060/): Command injection in tp-link:tl-wr840n firmware (high 8.8)
- [CVE-2019-15059](https://insights.sbomify.com/CVE-2019-15059/): Missing authorization in lispbx project:lispbx (high 7.5)
- [CVE-2019-15058](https://insights.sbomify.com/CVE-2019-15058/): Memory corruption in stb project:stb (critical 9.1)
- [CVE-2019-15055](https://insights.sbomify.com/CVE-2019-15055/): Path traversal in mikrotik:routeros (medium 6.5)
- [CVE-2019-15054](https://insights.sbomify.com/CVE-2019-15054/): Cross-site scripting in getmailbird:mailbird (medium 6.1)
- [CVE-2019-15053](https://insights.sbomify.com/CVE-2019-15053/): Cross-site scripting in atlassian:html include and replace macro (medium 6.8)
- [CVE-2019-15052](https://insights.sbomify.com/CVE-2019-15052/): Information disclosure in gradle:gradle (critical 9.8)
- [CVE-2019-15051](https://insights.sbomify.com/CVE-2019-15051/): Command injection in softing:uagate 840d firmware (high 8.8)
- [CVE-2019-15050](https://insights.sbomify.com/CVE-2019-15050/): Memory corruption in axiosys:bento4 (high 8.8)
- [CVE-2019-15049](https://insights.sbomify.com/CVE-2019-15049/): Memory corruption in axiosys:bento4 (high 8.8)
- [CVE-2019-15048](https://insights.sbomify.com/CVE-2019-15048/): Memory corruption in axiosys:bento4 (high 8.8)
- [CVE-2019-15047](https://insights.sbomify.com/CVE-2019-15047/): Memory corruption in axiosys:bento4 (high 8.8)
- [CVE-2019-15046](https://insights.sbomify.com/CVE-2019-15046/): Information disclosure in zohocorp:manageengine servicedesk plus (high 7.5)
- [CVE-2019-15045](https://insights.sbomify.com/CVE-2019-15045/): Information disclosure in zohocorp:manageengine servicedesk plus (medium 5.3)
- [CVE-2019-15043](https://insights.sbomify.com/CVE-2019-15043/): Missing authorization in grafana:grafana (high 7.5)
- [CVE-2019-15042](https://insights.sbomify.com/CVE-2019-15042/): Weak cryptography in jetbrains:teamcity (high 7.5)
- [CVE-2019-15041](https://insights.sbomify.com/CVE-2019-15041/): Open redirect in jetbrains:youtrack (medium 6.1)
- [CVE-2019-15040](https://insights.sbomify.com/CVE-2019-15040/): Cross-site request forgery in jetbrains:youtrack (high 8.8)
- [CVE-2019-15039](https://insights.sbomify.com/CVE-2019-15039/): Path traversal in jetbrains:teamcity (critical 9.8)
- [CVE-2019-15038](https://insights.sbomify.com/CVE-2019-15038/): Misconfiguration in jetbrains:teamcity (high 7.5)
- [CVE-2019-15037](https://insights.sbomify.com/CVE-2019-15037/): Cross-site scripting in jetbrains:teamcity (medium 6.1)
- [CVE-2019-15036](https://insights.sbomify.com/CVE-2019-15036/): Command injection in jetbrains:teamcity (high 7.2)
- [CVE-2019-15035](https://insights.sbomify.com/CVE-2019-15035/): Information disclosure in jetbrains:teamcity (medium 4.9)
- [CVE-2019-15034](https://insights.sbomify.com/CVE-2019-15034/): Memory corruption in qemu:qemu (medium 5.8)
- [CVE-2019-15033](https://insights.sbomify.com/CVE-2019-15033/): Server-side request forgery in pydio:pydio (high 7.7)
- [CVE-2019-15032](https://insights.sbomify.com/CVE-2019-15032/): Information disclosure in pydio:pydio (medium 5.3)
- [CVE-2019-15031](https://insights.sbomify.com/CVE-2019-15031/): Information disclosure in canonical:ubuntu linux (medium 4.4)
- [CVE-2019-15030](https://insights.sbomify.com/CVE-2019-15030/): Information disclosure in canonical:ubuntu linux (medium 4.4)
- [CVE-2019-15029](https://insights.sbomify.com/CVE-2019-15029/): Command injection in fusionpbx:fusionpbx (high 8.8)
- [CVE-2019-15028](https://insights.sbomify.com/CVE-2019-15028/): Security feature bypass in joomla:joomla\! (medium 5.3)
- [CVE-2019-15027](https://insights.sbomify.com/CVE-2019-15027/): Command injection in mediatek:mt6577 firmware (critical 9.8)
- [CVE-2019-15026](https://insights.sbomify.com/CVE-2019-15026/): Memory corruption in memcached:memcached (high 7.5)
- [CVE-2019-15025](https://insights.sbomify.com/CVE-2019-15025/): SQL injection in ninjaforms:ninjaforms (critical 9.8)
- [CVE-2019-15024](https://insights.sbomify.com/CVE-2019-15024/): Path traversal in ClickHouse (medium 6.5)
- [CVE-2019-15023](https://insights.sbomify.com/CVE-2019-15023/): Information disclosure in Palo Alto Networks Zingbox Inspector (high 7.5)
- [CVE-2019-15022](https://insights.sbomify.com/CVE-2019-15022/): Security feature bypass in Palo Alto Networks Zingbox Inspector (high 7.5)
- [CVE-2019-15021](https://insights.sbomify.com/CVE-2019-15021/): Server-side request forgery in Palo Alto Networks Zingbox Inspector (medium 5.3)
- [CVE-2019-15020](https://insights.sbomify.com/CVE-2019-15020/): Command injection in Palo Alto Networks Zingbox Inspector (critical 9.8)
- [CVE-2019-15019](https://insights.sbomify.com/CVE-2019-15019/): Other in Palo Alto Networks Zingbox Inspector (critical 9.8)
- [CVE-2019-15018](https://insights.sbomify.com/CVE-2019-15018/): Auth bypass in Palo Alto Networks Zingbox Inspector (high 7.5)
- [CVE-2019-15017](https://insights.sbomify.com/CVE-2019-15017/): Hardcoded credentials in Palo Alto Networks Zingbox Inspector (high 8.4)
- [CVE-2019-15016](https://insights.sbomify.com/CVE-2019-15016/): SQL injection in Palo Alto Networks Zingbox Inspector (high 8.8)
- [CVE-2019-15015](https://insights.sbomify.com/CVE-2019-15015/): Hardcoded credentials in Palo Alto Networks Zingbox Inspector (high 8.4)
- [CVE-2019-15014](https://insights.sbomify.com/CVE-2019-15014/): Command injection in Palo Alto Networks Zingbox Inspector (high 8.8)
- [CVE-2019-15013](https://insights.sbomify.com/CVE-2019-15013/): Missing authorization in Jira (medium 4.3)
- [CVE-2019-15012](https://insights.sbomify.com/CVE-2019-15012/): Path traversal in Bitbucket Data Center (high 8.8)
- [CVE-2019-15011](https://insights.sbomify.com/CVE-2019-15011/): Missing authorization in Application Links (medium 4.3)
- [CVE-2019-15010](https://insights.sbomify.com/CVE-2019-15010/): Command injection in Bitbucket Data Center (high 8.8)
- [CVE-2019-15009](https://insights.sbomify.com/CVE-2019-15009/): Missing authorization in Crucible (medium 4.3)
- [CVE-2019-15008](https://insights.sbomify.com/CVE-2019-15008/): Cross-site scripting in Crucible (medium 6.1)
- [CVE-2019-15007](https://insights.sbomify.com/CVE-2019-15007/): Cross-site scripting in Crucible (medium 4.8)
- [CVE-2019-15006](https://insights.sbomify.com/CVE-2019-15006/): Weak cryptography in Confluence Server (medium 6.5)
- [CVE-2019-15005](https://insights.sbomify.com/CVE-2019-15005/): Missing authorization in Bamboo (medium 4.3)
- [CVE-2019-15004](https://insights.sbomify.com/CVE-2019-15004/): Path traversal in Jira Service Desk Data Center (high 7.5)
- [CVE-2019-15003](https://insights.sbomify.com/CVE-2019-15003/): Auth bypass in Jira Service Desk Data Center (medium 5.3)
- [CVE-2019-15002](https://insights.sbomify.com/CVE-2019-15002/): Cross-site request forgery in Jira Data Center (medium 4.3)
- [CVE-2019-15001](https://insights.sbomify.com/CVE-2019-15001/): Code injection in Jira Data Center (high 7.2)
- [CVE-2019-15000](https://insights.sbomify.com/CVE-2019-15000/): Command injection in Bitbucket Data Center (critical 9.8)
- [CVE-2019-14999](https://insights.sbomify.com/CVE-2019-14999/): Cross-site request forgery in Universal Plugin Manager (medium 4.3)
- [CVE-2019-14998](https://insights.sbomify.com/CVE-2019-14998/): Cross-site request forgery in Jira (medium 6.5)
- [CVE-2019-14997](https://insights.sbomify.com/CVE-2019-14997/): Information disclosure in Jira (medium 4.3)
- [CVE-2019-14996](https://insights.sbomify.com/CVE-2019-14996/): Cross-site scripting in Jira (medium 6.1)
- [CVE-2019-14995](https://insights.sbomify.com/CVE-2019-14995/): Missing authorization in Jira (medium 5.3)
- [CVE-2019-14994](https://insights.sbomify.com/CVE-2019-14994/): Path traversal in Jira Service Desk Data Center (high 7.5)
- [CVE-2019-14993](https://insights.sbomify.com/CVE-2019-14993/): Istio ReDoS Vulnerability (high 7.5)
- [CVE-2019-14987](https://insights.sbomify.com/CVE-2019-14987/): Cross-site scripting in schben:framework (medium 4.8)
- [CVE-2019-14986](https://insights.sbomify.com/CVE-2019-14986/): Missing authorization in eq-3:homematic ccu2 firmware (high 8.1)
- [CVE-2019-14985](https://insights.sbomify.com/CVE-2019-14985/): Auth bypass in eq-3:homematic ccu2 firmware (critical 9.8)
- [CVE-2019-14984](https://insights.sbomify.com/CVE-2019-14984/): Missing authorization in eq-3:homematic ccu2 firmware (high 8.1)
- [CVE-2019-14982](https://insights.sbomify.com/CVE-2019-14982/): Integer overflow in exiv2:exiv2 (medium 6.5)
- [CVE-2019-14981](https://insights.sbomify.com/CVE-2019-14981/): Denial of service in canonical:ubuntu linux (medium 6.5)
- [CVE-2019-14980](https://insights.sbomify.com/CVE-2019-14980/): Use after free in imagemagick:imagemagick (medium 6.5)
- [CVE-2019-14979](https://insights.sbomify.com/CVE-2019-14979/): Business logic in woocommerce:paypal checkout payment gateway (medium 5.3)
- [CVE-2019-14978](https://insights.sbomify.com/CVE-2019-14978/): Business logic in woocommerce:payu india payment gateway (medium 5.3)
- [CVE-2019-14976](https://insights.sbomify.com/CVE-2019-14976/): Cross-site scripting in icmsdev:icms (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/110/