# Vulnerabilities published in 2019


- [CVE-2019-12889](https://insights.sbomify.com/CVE-2019-12889/): Privilege escalation in sailpoint:desktop password reset (high 7.0)
- [CVE-2019-12887](https://insights.sbomify.com/CVE-2019-12887/): LinOTP replay vulnerability with auto resynchronization enabled for TOTP token (high 8.1)
- [CVE-2019-12881](https://insights.sbomify.com/CVE-2019-12881/): Null dereference in linux:linux kernel (high 7.8)
- [CVE-2019-12880](https://insights.sbomify.com/CVE-2019-12880/): Other in bcnquark:quarking password manager (medium 4.3)
- [CVE-2019-12876](https://insights.sbomify.com/CVE-2019-12876/): Privilege escalation in zohocorp:manageengine admanager plus (high 7.3)
- [CVE-2019-12875](https://insights.sbomify.com/CVE-2019-12875/): Security feature bypass in alpinelinux:abuild (medium 6.5)
- [CVE-2019-12874](https://insights.sbomify.com/CVE-2019-12874/): Memory corruption in videolan:vlc media player (critical 9.8)
- [CVE-2019-12872](https://insights.sbomify.com/CVE-2019-12872/): SQL injection in dotcms:dotcms (high 7.2)
- [CVE-2019-12871](https://insights.sbomify.com/CVE-2019-12871/): Use after free in phoenixcontact:automationworx software suite (high 8.8)
- [CVE-2019-12870](https://insights.sbomify.com/CVE-2019-12870/): Memory corruption in phoenixcontact:automationworx software suite (high 8.8)
- [CVE-2019-1287](https://insights.sbomify.com/CVE-2019-1287/): Privilege escalation in Windows (high 7.8)
- [CVE-2019-12869](https://insights.sbomify.com/CVE-2019-12869/): Memory corruption in phoenixcontact:automationworx software suite (high 8.8)
- [CVE-2019-12868](https://insights.sbomify.com/CVE-2019-12868/): Deserialization in misp-project:misp (high 7.2)
- [CVE-2019-12867](https://insights.sbomify.com/CVE-2019-12867/): Privilege escalation in jetbrains:youtrack (critical 9.8)
- [CVE-2019-12866](https://insights.sbomify.com/CVE-2019-12866/): Missing authorization in jetbrains:youtrack (critical 9.8)
- [CVE-2019-12865](https://insights.sbomify.com/CVE-2019-12865/): Memory corruption in radare:radare2 (medium 5.5)
- [CVE-2019-12864](https://insights.sbomify.com/CVE-2019-12864/): Information disclosure in solarwinds:netpath (medium 5.5)
- [CVE-2019-12863](https://insights.sbomify.com/CVE-2019-12863/): Cross-site scripting in solarwinds:netpath (medium 4.8)
- [CVE-2019-1286](https://insights.sbomify.com/CVE-2019-1286/): Information disclosure in Windows (medium 6.5)
- [CVE-2019-12855](https://insights.sbomify.com/CVE-2019-12855/): Improper Certificate Validation in Twisted (high 7.4)
- [CVE-2019-12854](https://insights.sbomify.com/CVE-2019-12854/): Memory corruption in canonical:ubuntu linux (high 7.5)
- [CVE-2019-12852](https://insights.sbomify.com/CVE-2019-12852/): Server-side request forgery in jetbrains:youtrack (critical 9.8)
- [CVE-2019-12851](https://insights.sbomify.com/CVE-2019-12851/): Cross-site request forgery in jetbrains:youtrack (high 8.8)
- [CVE-2019-12850](https://insights.sbomify.com/CVE-2019-12850/): SQL injection in jetbrains:youtrack (critical 9.8)
- [CVE-2019-1285](https://insights.sbomify.com/CVE-2019-1285/): Privilege escalation in Windows (high 7.8)
- [CVE-2019-12847](https://insights.sbomify.com/CVE-2019-12847/): Information disclosure in jetbrains:hub (high 7.2)
- [CVE-2019-12846](https://insights.sbomify.com/CVE-2019-12846/): Missing authorization in jetbrains:teamcity (medium 4.3)
- [CVE-2019-12845](https://insights.sbomify.com/CVE-2019-12845/): Weak cryptography in jetbrains:teamcity (medium 5.3)
- [CVE-2019-12844](https://insights.sbomify.com/CVE-2019-12844/): Cross-site scripting in jetbrains:teamcity (medium 6.1)
- [CVE-2019-12843](https://insights.sbomify.com/CVE-2019-12843/): Cross-site scripting in jetbrains:teamcity (medium 6.1)
- [CVE-2019-12842](https://insights.sbomify.com/CVE-2019-12842/): Cross-site scripting in jetbrains:teamcity (medium 6.1)
- [CVE-2019-12841](https://insights.sbomify.com/CVE-2019-12841/): Other in jetbrains:teamcity (high 7.5)
- [CVE-2019-12840](https://insights.sbomify.com/CVE-2019-12840/): Command injection in webmin:webmin (high 8.8)
- [CVE-2019-1284](https://insights.sbomify.com/CVE-2019-1284/): Privilege escalation in Windows (high 7.8)
- [CVE-2019-12839](https://insights.sbomify.com/CVE-2019-12839/): Command injection in orangehrm:orangehrm (high 8.8)
- [CVE-2019-12838](https://insights.sbomify.com/CVE-2019-12838/): SQL injection in debian:debian linux (critical 9.8)
- [CVE-2019-12837](https://insights.sbomify.com/CVE-2019-12837/): Missing authorization in gencat:portal d\'acces a la universitat (medium 4.3)
- [CVE-2019-12836](https://insights.sbomify.com/CVE-2019-12836/): Cross-site request forgery in bobronix:jeditor (high 8.8)
- [CVE-2019-12835](https://insights.sbomify.com/CVE-2019-12835/): Memory corruption in leanify project:leanify (critical 9.8)
- [CVE-2019-12834](https://insights.sbomify.com/CVE-2019-12834/): Cross-site scripting in ht2labs:learning locker (high 7.3)
- [CVE-2019-12831](https://insights.sbomify.com/CVE-2019-12831/): Code injection in mybb:mybb (high 7.2)
- [CVE-2019-12830](https://insights.sbomify.com/CVE-2019-12830/): Cross-site scripting in mybb:mybb (high 8.7)
- [CVE-2019-1283](https://insights.sbomify.com/CVE-2019-1283/): Information disclosure in Windows (medium 5.5)
- [CVE-2019-12829](https://insights.sbomify.com/CVE-2019-12829/): Memory corruption in radare:radare2 (high 7.5)
- [CVE-2019-12828](https://insights.sbomify.com/CVE-2019-12828/): Command injection in ea:origin (high 8.8)
- [CVE-2019-12827](https://insights.sbomify.com/CVE-2019-12827/): Memory corruption in digium:asterisk (medium 6.5)
- [CVE-2019-12826](https://insights.sbomify.com/CVE-2019-12826/): Cross-site request forgery in wpchef:widget logic (high 8.8)
- [CVE-2019-12825](https://insights.sbomify.com/CVE-2019-12825/): Missing authorization in gitlab:gitlab (medium 4.3)
- [CVE-2019-12823](https://insights.sbomify.com/CVE-2019-12823/): Craft CMS XSS Vulnerability (medium 6.1)
- [CVE-2019-12822](https://insights.sbomify.com/CVE-2019-12822/): Memory corruption in embedthis:goahead (high 7.5)
- [CVE-2019-12821](https://insights.sbomify.com/CVE-2019-12821/): Weak cryptography in jisiwei:i3 firmware (medium 4.8)
- [CVE-2019-12820](https://insights.sbomify.com/CVE-2019-12820/): Weak cryptography in jisiwei:i3 firmware (medium 5.6)
- [CVE-2019-1282](https://insights.sbomify.com/CVE-2019-1282/): Information disclosure in Windows (medium 5.5)
- [CVE-2019-12819](https://insights.sbomify.com/CVE-2019-12819/): Use after free in linux:linux kernel (medium 5.5)
- [CVE-2019-12818](https://insights.sbomify.com/CVE-2019-12818/): Null dereference in linux:linux kernel (high 7.5)
- [CVE-2019-12817](https://insights.sbomify.com/CVE-2019-12817/): Memory corruption in canonical:ubuntu linux (high 7.0)
- [CVE-2019-12816](https://insights.sbomify.com/CVE-2019-12816/): Privilege escalation in znc:znc (high 8.8)
- [CVE-2019-12815](https://insights.sbomify.com/CVE-2019-12815/): Path traversal in debian:debian linux (critical 9.8)
- [CVE-2019-12814](https://insights.sbomify.com/CVE-2019-12814/): Deserialization of untrusted data in FasterXML jackson-databind (medium 5.9)
- [CVE-2019-12813](https://insights.sbomify.com/CVE-2019-12813/): Weak cryptography in crossmatch:digital persona u.are.u 4500 firmware (medium 5.9)
- [CVE-2019-12812](https://insights.sbomify.com/CVE-2019-12812/): Command injection in MyBuilder (critical 9.8)
- [CVE-2019-12811](https://insights.sbomify.com/CVE-2019-12811/): Command injection in MyBuilder (critical 9.8)
- [CVE-2019-12810](https://insights.sbomify.com/CVE-2019-12810/): Memory corruption in ALSee (high 7.8)
- [CVE-2019-12809](https://insights.sbomify.com/CVE-2019-12809/): Code injection in YES24 PC VIEWER (high 8.8)
- [CVE-2019-12808](https://insights.sbomify.com/CVE-2019-12808/): Privilege escalation in ALTOOLS Update Service (high 7.8)
- [CVE-2019-12807](https://insights.sbomify.com/CVE-2019-12807/): Memory corruption in ALZIP (high 7.8)
- [CVE-2019-12806](https://insights.sbomify.com/CVE-2019-12806/): Memory corruption in UniSign (high 8.8)
- [CVE-2019-12805](https://insights.sbomify.com/CVE-2019-12805/): NC Launcher 2 Arbitrary Command Injection Vulnerability (high 8.8)
- [CVE-2019-12804](https://insights.sbomify.com/CVE-2019-12804/): Hunesion i-oneNet Missing Support for Integrity Check vulnerability (high 7.8)
- [CVE-2019-12803](https://insights.sbomify.com/CVE-2019-12803/): Hunesion i-oneNet unrestricted file upload vulnerability (high 8.8)
- [CVE-2019-12802](https://insights.sbomify.com/CVE-2019-12802/): Use after free in fedoraproject:fedora (high 7.8)
- [CVE-2019-12801](https://insights.sbomify.com/CVE-2019-12801/): Cross-site scripting in seeddms:seeddms (medium 6.1)
- [CVE-2019-1280](https://insights.sbomify.com/CVE-2019-1280/): Code injection in Windows (high 7.8)
- [CVE-2019-12799](https://insights.sbomify.com/CVE-2019-12799/): Shopware Insecure Deserialization Vulnerability (medium 6.5)
- [CVE-2019-12798](https://insights.sbomify.com/CVE-2019-12798/): Memory corruption in artifex:mujs (critical 9.8)
- [CVE-2019-12797](https://insights.sbomify.com/CVE-2019-12797/): Hardcoded credentials in elmelectronics:elm27 firmware (critical 9.8)
- [CVE-2019-12795](https://insights.sbomify.com/CVE-2019-12795/): Misconfiguration in gnome:gvfs (high 7.8)
- [CVE-2019-12794](https://insights.sbomify.com/CVE-2019-12794/): Privilege escalation in misp-project:misp (medium 6.6)
- [CVE-2019-12792](https://insights.sbomify.com/CVE-2019-12792/): Command injection in vestacp:control panel (high 8.8)
- [CVE-2019-12791](https://insights.sbomify.com/CVE-2019-12791/): Path traversal in vestacp:control panel (high 8.8)
- [CVE-2019-12790](https://insights.sbomify.com/CVE-2019-12790/): Memory corruption in radare:radare2 (high 7.8)
- [CVE-2019-12789](https://insights.sbomify.com/CVE-2019-12789/): Auth bypass in actiontec:t2200h firmware (medium 6.8)
- [CVE-2019-12788](https://insights.sbomify.com/CVE-2019-12788/): Memory corruption in photodex:proshow producer (high 7.8)
- [CVE-2019-12787](https://insights.sbomify.com/CVE-2019-12787/): Command injection in dlink:dir-818lw firmware (high 8.8)
- [CVE-2019-12786](https://insights.sbomify.com/CVE-2019-12786/): Command injection in dlink:dir-818lw firmware (high 8.8)
- [CVE-2019-12784](https://insights.sbomify.com/CVE-2019-12784/): Cross-site request forgery in verint:impact 360 (high 8.8)
- [CVE-2019-12783](https://insights.sbomify.com/CVE-2019-12783/): Open redirect in verint:impact 360 (medium 6.1)
- [CVE-2019-12782](https://insights.sbomify.com/CVE-2019-12782/): Missing authorization in thoughtspot:thoughtspot (high 8.1)
- [CVE-2019-12781](https://insights.sbomify.com/CVE-2019-12781/): Django Incorrect HTTP detection with reverse-proxy connecting via HTTPS (medium 5.3)
- [CVE-2019-12780](https://insights.sbomify.com/CVE-2019-12780/): Command injection in belkin:crock-pot smart slow cooker with wemo firmware (critical 9.8)
- [CVE-2019-1278](https://insights.sbomify.com/CVE-2019-1278/): Privilege escalation in Windows (high 7.8)
- [CVE-2019-12779](https://insights.sbomify.com/CVE-2019-12779/): Race condition in clusterlabs:libqb (high 7.1)
- [CVE-2019-12777](https://insights.sbomify.com/CVE-2019-12777/): Misconfiguration in enttec:datagate mk2 firmware (high 7.8)
- [CVE-2019-12776](https://insights.sbomify.com/CVE-2019-12776/): Hardcoded credentials in enttec:datagate mk2 firmware (critical 9.8)
- [CVE-2019-12775](https://insights.sbomify.com/CVE-2019-12775/): Privilege escalation in enttec:datagate mk2 firmware (high 8.8)
- [CVE-2019-12774](https://insights.sbomify.com/CVE-2019-12774/): Cross-site scripting in enttec:datagate mk2 firmware (medium 6.1)
- [CVE-2019-12773](https://insights.sbomify.com/CVE-2019-12773/): Cross-site scripting in verint:impact 360 (medium 6.1)
- [CVE-2019-12771](https://insights.sbomify.com/CVE-2019-12771/): Command injection in thinstation project:thinstation (critical 9.8)
- [CVE-2019-1277](https://insights.sbomify.com/CVE-2019-1277/): Privilege escalation in Windows (high 7.8)
- [CVE-2019-12769](https://insights.sbomify.com/CVE-2019-12769/): Cross-site request forgery in solarwinds:serv-u managed file transfer (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/128/