# Vulnerabilities published in 2019


- [CVE-2019-12554](https://insights.sbomify.com/CVE-2019-12554/): Memory corruption in sweetscape:010 editor (high 7.5)
- [CVE-2019-12553](https://insights.sbomify.com/CVE-2019-12553/): Memory corruption in sweetscape:010 editor (critical 9.8)
- [CVE-2019-12552](https://insights.sbomify.com/CVE-2019-12552/): Integer overflow in sweetscape:010 editor (medium 5.5)
- [CVE-2019-12551](https://insights.sbomify.com/CVE-2019-12551/): Memory corruption in sweetscape:010 editor (medium 5.5)
- [CVE-2019-12550](https://insights.sbomify.com/CVE-2019-12550/): Hardcoded credentials in wago:852-1305 firmware (critical 9.8)
- [CVE-2019-1255](https://insights.sbomify.com/CVE-2019-1255/): Denial of service in Microsoft Forefront Endpoint Protection (high 7.5)
- [CVE-2019-12549](https://insights.sbomify.com/CVE-2019-12549/): Hardcoded credentials in wago:852-1305 firmware (critical 9.8)
- [CVE-2019-12548](https://insights.sbomify.com/CVE-2019-12548/): File upload in bludit:bludit (high 8.8)
- [CVE-2019-12543](https://insights.sbomify.com/CVE-2019-12543/): Cross-site scripting in zohocorp:manageengine servicedesk plus (medium 6.1)
- [CVE-2019-12542](https://insights.sbomify.com/CVE-2019-12542/): Cross-site scripting in zohocorp:manageengine servicedesk plus (medium 6.1)
- [CVE-2019-12541](https://insights.sbomify.com/CVE-2019-12541/): Cross-site scripting in zohocorp:manageengine servicedesk plus (medium 6.1)
- [CVE-2019-12540](https://insights.sbomify.com/CVE-2019-12540/): Cross-site scripting in zohocorp:manageengine servicedesk plus (medium 6.1)
- [CVE-2019-1254](https://insights.sbomify.com/CVE-2019-1254/): Information disclosure in Windows (medium 5.5)
- [CVE-2019-12539](https://insights.sbomify.com/CVE-2019-12539/): Cross-site scripting in zohocorp:manageengine servicedesk plus (medium 6.1)
- [CVE-2019-12538](https://insights.sbomify.com/CVE-2019-12538/): Cross-site scripting in zohocorp:manageengine servicedesk plus (medium 6.1)
- [CVE-2019-12537](https://insights.sbomify.com/CVE-2019-12537/): Cross-site scripting in zohocorp:manageengine assetexplorer (medium 6.1)
- [CVE-2019-12532](https://insights.sbomify.com/CVE-2019-12532/): Missing authorization in insyde:h2oelv (high 7.8)
- [CVE-2019-12530](https://insights.sbomify.com/CVE-2019-12530/): Missing authorization in glpi dashboard project:glpi dashboard (critical 9.8)
- [CVE-2019-1253](https://insights.sbomify.com/CVE-2019-1253/): Microsoft Windows AppX Deployment Server Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2019-12529](https://insights.sbomify.com/CVE-2019-12529/): Memory corruption in canonical:ubuntu linux (medium 5.9)
- [CVE-2019-12528](https://insights.sbomify.com/CVE-2019-12528/): Information disclosure in canonical:ubuntu linux (high 7.5)
- [CVE-2019-12527](https://insights.sbomify.com/CVE-2019-12527/): Memory corruption in canonical:ubuntu linux (high 8.8)
- [CVE-2019-12526](https://insights.sbomify.com/CVE-2019-12526/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2019-12525](https://insights.sbomify.com/CVE-2019-12525/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2019-12524](https://insights.sbomify.com/CVE-2019-12524/): Security feature bypass in canonical:ubuntu linux (critical 9.8)
- [CVE-2019-12523](https://insights.sbomify.com/CVE-2019-12523/): Server-side request forgery in canonical:ubuntu linux (critical 9.1)
- [CVE-2019-12522](https://insights.sbomify.com/CVE-2019-12522/): Privilege escalation in squid-cache:squid (medium 4.5)
- [CVE-2019-12521](https://insights.sbomify.com/CVE-2019-12521/): Memory corruption in canonical:ubuntu linux (medium 5.9)
- [CVE-2019-12520](https://insights.sbomify.com/CVE-2019-12520/): Security feature bypass in canonical:ubuntu linux (high 7.5)
- [CVE-2019-1252](https://insights.sbomify.com/CVE-2019-1252/): Information disclosure in Windows (medium 6.5)
- [CVE-2019-12519](https://insights.sbomify.com/CVE-2019-12519/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2019-12518](https://insights.sbomify.com/CVE-2019-12518/): Memory corruption in anviz:crosschex (critical 9.8)
- [CVE-2019-12517](https://insights.sbomify.com/CVE-2019-12517/): Cross-site scripting in slickquiz project:slickquiz (medium 6.1)
- [CVE-2019-12516](https://insights.sbomify.com/CVE-2019-12516/): SQL injection in slickquiz project:slickquiz (high 8.8)
- [CVE-2019-12515](https://insights.sbomify.com/CVE-2019-12515/): Memory corruption in glyphandcog:xpdfreader (high 7.1)
- [CVE-2019-12513](https://insights.sbomify.com/CVE-2019-12513/): Stored XSS via DHCP Discover Request Hostname (medium 6.1)
- [CVE-2019-12512](https://insights.sbomify.com/CVE-2019-12512/): Stored XSS via X-Forwarded-For Header During Incorrect Login (medium 6.1)
- [CVE-2019-12511](https://insights.sbomify.com/CVE-2019-12511/): Root Command Injection via MAC Address in SOAP API (critical 9.8)
- [CVE-2019-12510](https://insights.sbomify.com/CVE-2019-12510/): Auth Bypass Via X-Forwarded-For Header in SOAP API (critical 9.1)
- [CVE-2019-1251](https://insights.sbomify.com/CVE-2019-1251/): Information disclosure in Windows (medium 5.5)
- [CVE-2019-12507](https://insights.sbomify.com/CVE-2019-12507/): Cross-site scripting in phprelativepath project:phprelativepath (medium 6.1)
- [CVE-2019-12506](https://insights.sbomify.com/CVE-2019-12506/): Auth bypass in logitech:r700 laser presentation remote firmware (high 8.8)
- [CVE-2019-12505](https://insights.sbomify.com/CVE-2019-12505/): Auth bypass in inateck:wp1001 firmware (high 8.8)
- [CVE-2019-12504](https://insights.sbomify.com/CVE-2019-12504/): Auth bypass in inateck:wp2002 firmware (high 8.8)
- [CVE-2019-12503](https://insights.sbomify.com/CVE-2019-12503/): Auth bypass in inateck:bcst-60 firmware (critical 9.8)
- [CVE-2019-12502](https://insights.sbomify.com/CVE-2019-12502/): Cross-site request forgery in mobotix:s14 firmware (high 8.8)
- [CVE-2019-12500](https://insights.sbomify.com/CVE-2019-12500/): Auth bypass in mi:m365 firmware (medium 6.5)
- [CVE-2019-1250](https://insights.sbomify.com/CVE-2019-1250/): Memory corruption in Windows (high 7.8)
- [CVE-2019-12499](https://insights.sbomify.com/CVE-2019-12499/): Other in firejail project:firejail (high 8.1)
- [CVE-2019-12498](https://insights.sbomify.com/CVE-2019-12498/): Missing authorization in 3cx:live chat (critical 9.8)
- [CVE-2019-12497](https://insights.sbomify.com/CVE-2019-12497/): Information disclosure in debian:debian linux (medium 5.3)
- [CVE-2019-12496](https://insights.sbomify.com/CVE-2019-12496/): Hybrid Group Gobot Improper Certificate Validation vulnerability (high 7.5)
- [CVE-2019-12495](https://insights.sbomify.com/CVE-2019-12495/): Memory corruption in tinycc:tinycc (medium 5.5)
- [CVE-2019-12494](https://insights.sbomify.com/CVE-2019-12494/): Missing authorization in gardener:gardener (high 8.5)
- [CVE-2019-12493](https://insights.sbomify.com/CVE-2019-12493/): Memory corruption in glyphandcog:xpdfreader (high 7.1)
- [CVE-2019-12492](https://insights.sbomify.com/CVE-2019-12492/): Missing authorization in gallagher:command centre (medium 6.5)
- [CVE-2019-12491](https://insights.sbomify.com/CVE-2019-12491/): Command injection in onapp:onapp (medium 6.6)
- [CVE-2019-12490](https://insights.sbomify.com/CVE-2019-12490/): Other in simplemachines:simple machines forum (medium 6.5)
- [CVE-2019-1249](https://insights.sbomify.com/CVE-2019-1249/): Memory corruption in Windows (high 7.8)
- [CVE-2019-12489](https://insights.sbomify.com/CVE-2019-12489/): Command injection in fastweb:askey rtv1907vw firmware (critical 9.8)
- [CVE-2019-12483](https://insights.sbomify.com/CVE-2019-12483/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2019-12482](https://insights.sbomify.com/CVE-2019-12482/): Null dereference in debian:debian linux (high 7.5)
- [CVE-2019-12481](https://insights.sbomify.com/CVE-2019-12481/): Null dereference in debian:debian linux (medium 5.5)
- [CVE-2019-12480](https://insights.sbomify.com/CVE-2019-12480/): Memory corruption in bacnet protocol stack project:bacnet protocol stack (high 7.5)
- [CVE-2019-1248](https://insights.sbomify.com/CVE-2019-1248/): Memory corruption in Windows (high 7.8)
- [CVE-2019-12479](https://insights.sbomify.com/CVE-2019-12479/): Path traversal in twentytwenty.storage project:twentytwenty.storage (critical 9.1)
- [CVE-2019-12477](https://insights.sbomify.com/CVE-2019-12477/): Path traversal in supra:stv-lc40lt0020f firmware (medium 5.5)
- [CVE-2019-12476](https://insights.sbomify.com/CVE-2019-12476/): Auth bypass in zohocorp:manageengine adselfservice plus (medium 6.8)
- [CVE-2019-12475](https://insights.sbomify.com/CVE-2019-12475/): Cross-site scripting in microstrategy:microstrategy web (medium 6.1)
- [CVE-2019-12474](https://insights.sbomify.com/CVE-2019-12474/): Wikimedia information leak vulnerability (high 7.5)
- [CVE-2019-12473](https://insights.sbomify.com/CVE-2019-12473/): Wikimedia Potential DOS due to slow WatchedItemStore::countVisitingWatchersMultiple (high 7.5)
- [CVE-2019-12472](https://insights.sbomify.com/CVE-2019-12472/): MediaWiki Incorrect Access Control vulnerability (high 7.5)
- [CVE-2019-12471](https://insights.sbomify.com/CVE-2019-12471/): MediaWiki Cross-site Scripting (XSS) (medium 6.1)
- [CVE-2019-12470](https://insights.sbomify.com/CVE-2019-12470/): Wikimedia MediaWik exposed suppressed log in RevisionDelete page (medium 6.5)
- [CVE-2019-1247](https://insights.sbomify.com/CVE-2019-1247/): Memory corruption in Windows (high 7.8)
- [CVE-2019-12469](https://insights.sbomify.com/CVE-2019-12469/): MediaWiki Incorrect Access Control vulnerability (medium 6.5)
- [CVE-2019-12468](https://insights.sbomify.com/CVE-2019-12468/): Wikimedia MediaWiki Incorrect Access Control vulnerability (critical 9.8)
- [CVE-2019-12467](https://insights.sbomify.com/CVE-2019-12467/): MediaWiki Incorrect Access Control vulnerability (medium 5.3)
- [CVE-2019-12466](https://insights.sbomify.com/CVE-2019-12466/): Wikimedia MediaWiki allows CSRF (high 8.8)
- [CVE-2019-12465](https://insights.sbomify.com/CVE-2019-12465/): SQL Injection in LibreNMS (high 8.1)
- [CVE-2019-12464](https://insights.sbomify.com/CVE-2019-12464/): Path Traversal in LibreNMS (high 7.5)
- [CVE-2019-12463](https://insights.sbomify.com/CVE-2019-12463/): Improper Encoding or Escaping of Output and Injection in LibreNMS (high 8.8)
- [CVE-2019-12461](https://insights.sbomify.com/CVE-2019-12461/): Cross-site scripting in webport:web port (medium 6.1)
- [CVE-2019-12460](https://insights.sbomify.com/CVE-2019-12460/): Cross-site scripting in webport:web port (medium 6.1)
- [CVE-2019-1246](https://insights.sbomify.com/CVE-2019-1246/): Memory corruption in Microsoft Office (high 7.8)
- [CVE-2019-12459](https://insights.sbomify.com/CVE-2019-12459/): Information disclosure in afian:filerun (medium 5.3)
- [CVE-2019-12458](https://insights.sbomify.com/CVE-2019-12458/): Information disclosure in afian:filerun (medium 5.3)
- [CVE-2019-12457](https://insights.sbomify.com/CVE-2019-12457/): Information disclosure in afian:filerun (medium 5.3)
- [CVE-2019-12456](https://insights.sbomify.com/CVE-2019-12456/): Race condition in linux:linux kernel (high 7.8)
- [CVE-2019-12455](https://insights.sbomify.com/CVE-2019-12455/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2019-12454](https://insights.sbomify.com/CVE-2019-12454/): Memory corruption in linux:linux kernel (high 7.8)
- [CVE-2019-12453](https://insights.sbomify.com/CVE-2019-12453/): Cross-site scripting in microstrategy:microstrategy web (medium 6.1)
- [CVE-2019-12452](https://insights.sbomify.com/CVE-2019-12452/): Containous Traefik Exposes Password Hashes (high 7.5)
- [CVE-2019-12450](https://insights.sbomify.com/CVE-2019-12450/): Race condition in canonical:ubuntu linux (critical 9.8)
- [CVE-2019-1245](https://insights.sbomify.com/CVE-2019-1245/): Information disclosure in Windows (medium 6.5)
- [CVE-2019-12449](https://insights.sbomify.com/CVE-2019-12449/): Other in canonical:ubuntu linux (medium 5.7)
- [CVE-2019-12448](https://insights.sbomify.com/CVE-2019-12448/): Race condition in gnome:gvfs (high 8.1)
- [CVE-2019-12447](https://insights.sbomify.com/CVE-2019-12447/): Privilege escalation in canonical:ubuntu linux (high 7.3)
- [CVE-2019-12446](https://insights.sbomify.com/CVE-2019-12446/): Information disclosure in gitlab:gitlab (high 7.5)
- [CVE-2019-12445](https://insights.sbomify.com/CVE-2019-12445/): Cross-site scripting in gitlab:gitlab (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/131/