# Vulnerabilities published in 2019 - [CVE-2019-12444](https://insights.sbomify.com/CVE-2019-12444/): Cross-site scripting in gitlab:gitlab (medium 6.1) - [CVE-2019-12443](https://insights.sbomify.com/CVE-2019-12443/): Server-side request forgery in gitlab:gitlab (critical 9.8) - [CVE-2019-12442](https://insights.sbomify.com/CVE-2019-12442/): Cross-site scripting in gitlab:gitlab (medium 6.1) - [CVE-2019-12441](https://insights.sbomify.com/CVE-2019-12441/): Security feature bypass in gitlab:gitlab (high 7.5) - [CVE-2019-12440](https://insights.sbomify.com/CVE-2019-12440/): Auth bypass in sitecore:rocks (critical 9.8) - [CVE-2019-1244](https://insights.sbomify.com/CVE-2019-1244/): Information disclosure in Windows (medium 6.5) - [CVE-2019-12439](https://insights.sbomify.com/CVE-2019-12439/): Other in projectatomic:bubblewrap (high 7.4) - [CVE-2019-12437](https://insights.sbomify.com/CVE-2019-12437/): Silverstripe CSRF Protection Bypass via GraphQL (high 8.8) - [CVE-2019-12436](https://insights.sbomify.com/CVE-2019-12436/): Null dereference in canonical:ubuntu linux (medium 6.5) - [CVE-2019-12435](https://insights.sbomify.com/CVE-2019-12435/): Null dereference in samba:samba (medium 6.5) - [CVE-2019-12434](https://insights.sbomify.com/CVE-2019-12434/): Information disclosure in gitlab:gitlab (medium 4.3) - [CVE-2019-12433](https://insights.sbomify.com/CVE-2019-12433/): Missing authorization in gitlab:gitlab (medium 5.3) - [CVE-2019-12432](https://insights.sbomify.com/CVE-2019-12432/): Information disclosure in gitlab:gitlab (medium 4.3) - [CVE-2019-12431](https://insights.sbomify.com/CVE-2019-12431/): Missing authorization in gitlab:gitlab (medium 4.3) - [CVE-2019-12430](https://insights.sbomify.com/CVE-2019-12430/): Command injection in gitlab:gitlab (high 8.8) - [CVE-2019-1243](https://insights.sbomify.com/CVE-2019-1243/): Memory corruption in Windows (high 7.8) - [CVE-2019-12429](https://insights.sbomify.com/CVE-2019-12429/): Missing authorization in gitlab:gitlab (medium 6.5) - [CVE-2019-12428](https://insights.sbomify.com/CVE-2019-12428/): Auth bypass in gitlab:gitlab (critical 9.8) - [CVE-2019-12427](https://insights.sbomify.com/CVE-2019-12427/): Cross-site scripting in zimbra:collaboration server (medium 4.8) - [CVE-2019-12426](https://insights.sbomify.com/CVE-2019-12426/): Auth bypass in Apache OFBiz (medium 5.3) - [CVE-2019-12425](https://insights.sbomify.com/CVE-2019-12425/): Other in Apache OFBiz (high 7.5) - [CVE-2019-12423](https://insights.sbomify.com/CVE-2019-12423/): Private key leak in Apache CXF (high 7.5) - [CVE-2019-12422](https://insights.sbomify.com/CVE-2019-12422/): Improper input validation in Apache Shiro (high 7.5) - [CVE-2019-12421](https://insights.sbomify.com/CVE-2019-12421/): Apache NiFi user log out issue (high 8.8) - [CVE-2019-12420](https://insights.sbomify.com/CVE-2019-12420/): Denial of service in Apache SpamAssassin (high 7.5) - [CVE-2019-1242](https://insights.sbomify.com/CVE-2019-1242/): Memory corruption in Windows (high 7.8) - [CVE-2019-12419](https://insights.sbomify.com/CVE-2019-12419/): Potential session hijack in Apache CXF (critical 9.8) - [CVE-2019-12418](https://insights.sbomify.com/CVE-2019-12418/): Insufficiently Protected Credentials in Apache Tomcat (high 7.0) - [CVE-2019-12417](https://insights.sbomify.com/CVE-2019-12417/): Apache Airflow vulnerable to XSS and local file disclosure (medium 4.8) - [CVE-2019-12416](https://insights.sbomify.com/CVE-2019-12416/): Injection in DeltaSpike (medium 6.1) - [CVE-2019-12415](https://insights.sbomify.com/CVE-2019-12415/): Improper Restriction of XML External Entity Reference in Apache POI (medium 5.5) - [CVE-2019-12414](https://insights.sbomify.com/CVE-2019-12414/): Users can view database names in Apache Superset (medium 5.3) - [CVE-2019-12413](https://insights.sbomify.com/CVE-2019-12413/): Users able to query database metadata in Apache Superset (medium 5.3) - [CVE-2019-12412](https://insights.sbomify.com/CVE-2019-12412/): Null dereference in libapreq2 (high 7.5) - [CVE-2019-12410](https://insights.sbomify.com/CVE-2019-12410/): Missing Initialization of Resource in Apache Arrow (high 7.5) - [CVE-2019-1241](https://insights.sbomify.com/CVE-2019-1241/): Memory corruption in Windows (high 7.8) - [CVE-2019-12409](https://insights.sbomify.com/CVE-2019-12409/): Unrestricted upload of file with dangerous type in Apache Solr (critical 9.8) - [CVE-2019-12408](https://insights.sbomify.com/CVE-2019-12408/): Missing Initialization of Resource in Apache Arrow (high 7.5) - [CVE-2019-12407](https://insights.sbomify.com/CVE-2019-12407/): Cross-site Scripting in Apache JSPWiki (medium 6.1) - [CVE-2019-12406](https://insights.sbomify.com/CVE-2019-12406/): Potential DOS attack due to unrestricted attachment count in messages (medium 6.5) - [CVE-2019-12405](https://insights.sbomify.com/CVE-2019-12405/): Improper Authentication in Apache Traffic Control (critical 9.8) - [CVE-2019-12404](https://insights.sbomify.com/CVE-2019-12404/): Cross-site scripting in Apache JSPWiki (medium 6.1) - [CVE-2019-12402](https://insights.sbomify.com/CVE-2019-12402/): Denial of Service in Apache Commons Compress (high 7.5) - [CVE-2019-12401](https://insights.sbomify.com/CVE-2019-12401/): Apache Solr vulnerable to XML Bomb (high 7.5) - [CVE-2019-12400](https://insights.sbomify.com/CVE-2019-12400/): Improper input validation in Apache Santuario XML Security for Java (medium 5.5) - [CVE-2019-1240](https://insights.sbomify.com/CVE-2019-1240/): Memory corruption in Windows (high 7.8) - [CVE-2019-12399](https://insights.sbomify.com/CVE-2019-12399/): Exposure of Sensitive Information to an Unauthorized Actor in Apache Kafka (high 7.5) - [CVE-2019-12398](https://insights.sbomify.com/CVE-2019-12398/): XSS in Apache Airflow (medium 4.8) - [CVE-2019-12397](https://insights.sbomify.com/CVE-2019-12397/): Cross-site scripting in Apache Ranger (medium 6.1) - [CVE-2019-12395](https://insights.sbomify.com/CVE-2019-12395/): Auth bypass in dynmap project:dynmap (medium 5.3) - [CVE-2019-12394](https://insights.sbomify.com/CVE-2019-12394/): Auth bypass in anviz:management system (critical 9.8) - [CVE-2019-12393](https://insights.sbomify.com/CVE-2019-12393/): Auth bypass in anviz:management system (high 7.5) - [CVE-2019-12392](https://insights.sbomify.com/CVE-2019-12392/): Auth bypass in anviz:anviz firmware (critical 9.8) - [CVE-2019-12391](https://insights.sbomify.com/CVE-2019-12391/): Other in anviz:management system (high 7.5) - [CVE-2019-12390](https://insights.sbomify.com/CVE-2019-12390/): Missing authorization in anviz:anviz firmware (medium 5.3) - [CVE-2019-1239](https://insights.sbomify.com/CVE-2019-1239/): Memory corruption in Internet Explorer 11 (high 7.5) - [CVE-2019-12389](https://insights.sbomify.com/CVE-2019-12389/): Missing authorization in anviz:anviz firmware (high 7.5) - [CVE-2019-12388](https://insights.sbomify.com/CVE-2019-12388/): Information disclosure in anviz:anviz firmware (high 7.5) - [CVE-2019-12387](https://insights.sbomify.com/CVE-2019-12387/): Twisted CRLF Injection (medium 6.1) - [CVE-2019-12386](https://insights.sbomify.com/CVE-2019-12386/): Cross-site scripting in ampache:ampache (medium 5.4) - [CVE-2019-12385](https://insights.sbomify.com/CVE-2019-12385/): SQL injection in ampache:ampache (high 8.8) - [CVE-2019-12384](https://insights.sbomify.com/CVE-2019-12384/): Deserialization of Untrusted Data in FasterXML jackson-databind (medium 5.9) - [CVE-2019-12383](https://insights.sbomify.com/CVE-2019-12383/): Information disclosure in torproject:tor browser (medium 4.3) - [CVE-2019-12382](https://insights.sbomify.com/CVE-2019-12382/): Null dereference in linux:linux kernel (medium 5.5) - [CVE-2019-12381](https://insights.sbomify.com/CVE-2019-12381/): Null dereference in linux:linux kernel (medium 5.5) - [CVE-2019-12380](https://insights.sbomify.com/CVE-2019-12380/): Other in linux:linux kernel (medium 5.5) - [CVE-2019-1238](https://insights.sbomify.com/CVE-2019-1238/): Memory corruption in Internet Explorer 10 (medium 6.4) - [CVE-2019-12379](https://insights.sbomify.com/CVE-2019-12379/): Denial of service in linux:linux kernel (medium 5.5) - [CVE-2019-12378](https://insights.sbomify.com/CVE-2019-12378/): Null dereference in linux:linux kernel (medium 5.5) - [CVE-2019-12377](https://insights.sbomify.com/CVE-2019-12377/): File upload in ivanti:landesk management suite (critical 9.8) - [CVE-2019-12376](https://insights.sbomify.com/CVE-2019-12376/): Hardcoded credentials in ivanti:landesk management suite (medium 4.5) - [CVE-2019-12375](https://insights.sbomify.com/CVE-2019-12375/): Information disclosure in ivanti:landesk management suite (medium 6.3) - [CVE-2019-12374](https://insights.sbomify.com/CVE-2019-12374/): SQL injection in ivanti:landesk management suite (high 8.1) - [CVE-2019-12373](https://insights.sbomify.com/CVE-2019-12373/): Information disclosure in ivanti:landesk management suite (critical 9.0) - [CVE-2019-12372](https://insights.sbomify.com/CVE-2019-12372/): SQL injection in petraware:ptransformer adc (high 7.8) - [CVE-2019-12370](https://insights.sbomify.com/CVE-2019-12370/): Cross-site scripting in readdle:spark (medium 6.1) - [CVE-2019-1237](https://insights.sbomify.com/CVE-2019-1237/): Out-of-bounds write (high 7.5) - [CVE-2019-12369](https://insights.sbomify.com/CVE-2019-12369/): Cross-site scripting in typeapp:typeapp (medium 6.1) - [CVE-2019-12368](https://insights.sbomify.com/CVE-2019-12368/): Cross-site scripting in edison:edison mail (medium 6.1) - [CVE-2019-12367](https://insights.sbomify.com/CVE-2019-12367/): Cross-site scripting in blixhq:bluemail (medium 6.1) - [CVE-2019-12366](https://insights.sbomify.com/CVE-2019-12366/): Cross-site scripting in 9folders:nine (medium 6.1) - [CVE-2019-12365](https://insights.sbomify.com/CVE-2019-12365/): Cross-site scripting in cloudmagic:newton (medium 6.1) - [CVE-2019-12363](https://insights.sbomify.com/CVE-2019-12363/): Cross-site request forgery in mybb-2fa project:mybb-2fa (high 8.8) - [CVE-2019-12362](https://insights.sbomify.com/CVE-2019-12362/): Cross-site scripting in phome:empirecms (medium 6.1) - [CVE-2019-12361](https://insights.sbomify.com/CVE-2019-12361/): Cross-site scripting in phome:empirecms (medium 6.1) - [CVE-2019-12360](https://insights.sbomify.com/CVE-2019-12360/): Memory corruption in glyphandcog:xpdfreader (high 7.1) - [CVE-2019-1236](https://insights.sbomify.com/CVE-2019-1236/): Memory corruption in Internet Explorer 10 (high 7.5) - [CVE-2019-12359](https://insights.sbomify.com/CVE-2019-12359/): SQL injection in zzcms:zzcms (high 7.2) - [CVE-2019-12358](https://insights.sbomify.com/CVE-2019-12358/): SQL injection in zzcms:zzcms (high 8.8) - [CVE-2019-12357](https://insights.sbomify.com/CVE-2019-12357/): SQL injection in zzcms:zzcms (high 7.2) - [CVE-2019-12356](https://insights.sbomify.com/CVE-2019-12356/): SQL injection in zzcms:zzcms (high 8.8) - [CVE-2019-12355](https://insights.sbomify.com/CVE-2019-12355/): SQL injection in zzcms:zzcms (high 8.8) - [CVE-2019-12354](https://insights.sbomify.com/CVE-2019-12354/): SQL injection in zzcms:zzcms (high 7.2) - [CVE-2019-12353](https://insights.sbomify.com/CVE-2019-12353/): SQL injection in zzcms:zzcms (high 7.2) - [CVE-2019-12352](https://insights.sbomify.com/CVE-2019-12352/): SQL injection in zzcms:zzcms (high 8.8) - [CVE-2019-12351](https://insights.sbomify.com/CVE-2019-12351/): SQL injection in zzcms:zzcms (critical 9.8) - [CVE-2019-12350](https://insights.sbomify.com/CVE-2019-12350/): SQL injection in zzcms:zzcms (critical 9.8) - [CVE-2019-1235](https://insights.sbomify.com/CVE-2019-1235/): Privilege escalation in Windows (high 7.8) - [CVE-2019-12349](https://insights.sbomify.com/CVE-2019-12349/): SQL injection in zzcms:zzcms (critical 9.8) - [CVE-2019-12348](https://insights.sbomify.com/CVE-2019-12348/): SQL injection in zzcms:zzcms (critical 9.8) --- From sbomify Insights: https://insights.sbomify.com/years/2019/page/132/