# Vulnerabilities published in 2019


- [CVE-2019-12347](https://insights.sbomify.com/CVE-2019-12347/): Cross-site scripting in netgate:pfsense (medium 6.1)
- [CVE-2019-12346](https://insights.sbomify.com/CVE-2019-12346/): Cross-site scripting in miniorange:saml sp single sign on (medium 6.1)
- [CVE-2019-12345](https://insights.sbomify.com/CVE-2019-12345/): Cross-site scripting in kibokolabs:hostel (medium 6.1)
- [CVE-2019-1234](https://insights.sbomify.com/CVE-2019-1234/): Auth bypass in Azure Stack (high 7.5)
- [CVE-2019-12331](https://insights.sbomify.com/CVE-2019-12331/): XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue (high 8.8)
- [CVE-2019-1233](https://insights.sbomify.com/CVE-2019-1233/): Denial of service in Microsoft Exchange Server 2016 (high 7.5)
- [CVE-2019-12328](https://insights.sbomify.com/CVE-2019-12328/): Command injection in atcom:a10w firmware (critical 9.0)
- [CVE-2019-12327](https://insights.sbomify.com/CVE-2019-12327/): Hardcoded credentials in akuvox:sp-r50p firmware (high 7.2)
- [CVE-2019-12326](https://insights.sbomify.com/CVE-2019-12326/): File upload in akuvox:sp-r50p firmware (high 7.2)
- [CVE-2019-12325](https://insights.sbomify.com/CVE-2019-12325/): Memory corruption in htek:uc902 firmware (high 8.2)
- [CVE-2019-12324](https://insights.sbomify.com/CVE-2019-12324/): Command injection in akuvox:sp-r50p firmware (high 7.2)
- [CVE-2019-12323](https://insights.sbomify.com/CVE-2019-12323/): Memory corruption in hostingcontroller:hc10 (high 7.5)
- [CVE-2019-1232](https://insights.sbomify.com/CVE-2019-1232/): Privilege escalation in Microsoft Visual Studio (high 7.8)
- [CVE-2019-12315](https://insights.sbomify.com/CVE-2019-12315/): Cross-site scripting in samsung:scx-824 firmware (medium 6.1)
- [CVE-2019-12314](https://insights.sbomify.com/CVE-2019-12314/): Path traversal in deltek:maconomy (critical 9.8)
- [CVE-2019-12313](https://insights.sbomify.com/CVE-2019-12313/): Cross-Site Scripting in shave (medium 6.1)
- [CVE-2019-12312](https://insights.sbomify.com/CVE-2019-12312/): Null dereference in libreswan:libreswan (high 7.5)
- [CVE-2019-12311](https://insights.sbomify.com/CVE-2019-12311/): File upload in sandline:centraleyezer (medium 6.1)
- [CVE-2019-12310](https://insights.sbomify.com/CVE-2019-12310/): Path traversal in exagrid:backup appliance firmware (critical 9.8)
- [CVE-2019-1231](https://insights.sbomify.com/CVE-2019-1231/): Weak cryptography in Rome SDK (medium 5.9)
- [CVE-2019-12309](https://insights.sbomify.com/CVE-2019-12309/): Path traversal in dotcms:dotcms (medium 4.9)
- [CVE-2019-12308](https://insights.sbomify.com/CVE-2019-12308/): Django Cross-site Scripting in AdminURLFieldWidget (medium 6.1)
- [CVE-2019-12305](https://insights.sbomify.com/CVE-2019-12305/): Information disclosure in actions-micro:ezcast pro ii firmware (medium 6.5)
- [CVE-2019-12303](https://insights.sbomify.com/CVE-2019-12303/): Rancher code injection via fluentd config commands (high 8.8)
- [CVE-2019-12301](https://insights.sbomify.com/CVE-2019-12301/): Misconfiguration in percona:percona server (critical 9.8)
- [CVE-2019-12300](https://insights.sbomify.com/CVE-2019-12300/): Improper Authentication in Buildbot (critical 9.8)
- [CVE-2019-1230](https://insights.sbomify.com/CVE-2019-1230/): Information disclosure in Windows (medium 6.8)
- [CVE-2019-12299](https://insights.sbomify.com/CVE-2019-12299/): Cross-site scripting in sandline:centraleyezer (medium 6.1)
- [CVE-2019-12298](https://insights.sbomify.com/CVE-2019-12298/): Memory corruption in leanify project:leanify (medium 5.5)
- [CVE-2019-12297](https://insights.sbomify.com/CVE-2019-12297/): Memory corruption in motorola:cx2 firmware (critical 9.8)
- [CVE-2019-12295](https://insights.sbomify.com/CVE-2019-12295/): Denial of service in canonical:ubuntu linux (high 7.5)
- [CVE-2019-12293](https://insights.sbomify.com/CVE-2019-12293/): Memory corruption in freedesktop:poppler (high 8.8)
- [CVE-2019-12292](https://insights.sbomify.com/CVE-2019-12292/): Missing authorization in citrix:appdna (critical 9.8)
- [CVE-2019-12291](https://insights.sbomify.com/CVE-2019-12291/): HashiCorp Consul Incorrect Access Control vulnerability (high 7.5)
- [CVE-2019-12290](https://insights.sbomify.com/CVE-2019-12290/): Security feature bypass in gnu:libidn2 (high 7.5)
- [CVE-2019-1229](https://insights.sbomify.com/CVE-2019-1229/): Dynamics On-Premise Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2019-12289](https://insights.sbomify.com/CVE-2019-12289/): Missing authorization in vstracam:c38s firmware (critical 9.8)
- [CVE-2019-12288](https://insights.sbomify.com/CVE-2019-12288/): Auth bypass in vstarcam:c7824iwp firmware (critical 9.8)
- [CVE-2019-12280](https://insights.sbomify.com/CVE-2019-12280/): Other in dell:supportassist for business pcs (high 7.8)
- [CVE-2019-1228](https://insights.sbomify.com/CVE-2019-1228/): Windows Kernel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2019-12279](https://insights.sbomify.com/CVE-2019-12279/): SQL injection in nagios:nagios xi (critical 9.8)
- [CVE-2019-12278](https://insights.sbomify.com/CVE-2019-12278/): Other in opera:opera (medium 4.3)
- [CVE-2019-12277](https://insights.sbomify.com/CVE-2019-12277/): Blogifier does not properly restrict APIs (critical 9.8)
- [CVE-2019-12276](https://insights.sbomify.com/CVE-2019-12276/): Path traversal in grandnode:grandnode (high 7.5)
- [CVE-2019-12274](https://insights.sbomify.com/CVE-2019-12274/): Rancher Privilege Escalation Vulnerability (high 8.8)
- [CVE-2019-12273](https://insights.sbomify.com/CVE-2019-12273/): Cross-site request forgery in outsystems:outsystems (medium 6.5)
- [CVE-2019-12272](https://insights.sbomify.com/CVE-2019-12272/): Command injection in openwrt:luci (critical 9.8)
- [CVE-2019-12271](https://insights.sbomify.com/CVE-2019-12271/): File upload in sandline:centraleyezer (critical 9.8)
- [CVE-2019-12270](https://insights.sbomify.com/CVE-2019-12270/): Misconfiguration in opentext:brava\! (high 7.4)
- [CVE-2019-1227](https://insights.sbomify.com/CVE-2019-1227/): Windows Kernel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2019-12269](https://insights.sbomify.com/CVE-2019-12269/): Security feature bypass in enigmail:enigmail (high 7.5)
- [CVE-2019-12266](https://insights.sbomify.com/CVE-2019-12266/): Stack buffer overflow in Wyze Cam Pan v2, Cam v2 and Cam v3 (high 7.6)
- [CVE-2019-12265](https://insights.sbomify.com/CVE-2019-12265/): Information disclosure in belden:garrettcom magnum dx940e firmware (medium 5.3)
- [CVE-2019-12264](https://insights.sbomify.com/CVE-2019-12264/): Other in belden:garrettcom magnum dx940e firmware (high 7.1)
- [CVE-2019-12263](https://insights.sbomify.com/CVE-2019-12263/): Race condition in belden:garrettcom magnum dx940e firmware (high 8.1)
- [CVE-2019-12262](https://insights.sbomify.com/CVE-2019-12262/): Security feature bypass in belden:garrettcom magnum dx940e firmware (critical 9.8)
- [CVE-2019-12261](https://insights.sbomify.com/CVE-2019-12261/): Memory corruption in belden:garrettcom magnum dx940e firmware (critical 9.8)
- [CVE-2019-12260](https://insights.sbomify.com/CVE-2019-12260/): Memory corruption in belden:garrettcom magnum dx940e firmware (critical 9.8)
- [CVE-2019-1226](https://insights.sbomify.com/CVE-2019-1226/): Remote Desktop Services Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2019-12259](https://insights.sbomify.com/CVE-2019-12259/): Null dereference in belden:garrettcom magnum dx940e firmware (high 7.5)
- [CVE-2019-12258](https://insights.sbomify.com/CVE-2019-12258/): Denial of service in belden:garrettcom magnum dx940e firmware (high 7.5)
- [CVE-2019-12257](https://insights.sbomify.com/CVE-2019-12257/): Memory corruption in belden:garrettcom magnum dx940e firmware (high 8.8)
- [CVE-2019-12256](https://insights.sbomify.com/CVE-2019-12256/): Memory corruption in belden:garrettcom magnum dx940e firmware (critical 9.8)
- [CVE-2019-12255](https://insights.sbomify.com/CVE-2019-12255/): Integer overflow in belden:garrettcom magnum dx940e firmware (critical 9.8)
- [CVE-2019-12254](https://insights.sbomify.com/CVE-2019-12254/): TECSON/GOK: Improper Authentication and Access Control on multiple devices (critical 9.8)
- [CVE-2019-12253](https://insights.sbomify.com/CVE-2019-12253/): Cross-site request forgery in mylittleforum:my little forum (medium 6.5)
- [CVE-2019-12252](https://insights.sbomify.com/CVE-2019-12252/): Missing authorization in zohocorp:manageengine servicedesk plus (medium 6.5)
- [CVE-2019-12251](https://insights.sbomify.com/CVE-2019-12251/): SQL injection in ucms project:ucms (high 8.8)
- [CVE-2019-12250](https://insights.sbomify.com/CVE-2019-12250/): Cross-site scripting in identityserver:identityserver4 (medium 6.1)
- [CVE-2019-1225](https://insights.sbomify.com/CVE-2019-1225/): Remote Desktop Protocol Server Information Disclosure Vulnerability (high 7.5)
- [CVE-2019-12248](https://insights.sbomify.com/CVE-2019-12248/): Other in debian:debian linux (medium 4.3)
- [CVE-2019-12247](https://insights.sbomify.com/CVE-2019-12247/): Integer overflow in qemu:qemu (high 7.5)
- [CVE-2019-12246](https://insights.sbomify.com/CVE-2019-12246/): SilverStripe Denial of Service on flush and development URL tools (medium 4.3)
- [CVE-2019-12245](https://insights.sbomify.com/CVE-2019-12245/): Lack of access control on upoaded files (medium 5.3)
- [CVE-2019-12243](https://insights.sbomify.com/CVE-2019-12243/): Istio may not check inbound TCP connections against istio-policy (high 7.5)
- [CVE-2019-12241](https://insights.sbomify.com/CVE-2019-12241/): Deserialization in carts.guru:carts guru (critical 9.8)
- [CVE-2019-12240](https://insights.sbomify.com/CVE-2019-12240/): Deserialization in virim project:virim (critical 9.8)
- [CVE-2019-1224](https://insights.sbomify.com/CVE-2019-1224/): Remote Desktop Protocol Server Information Disclosure Vulnerability (high 7.5)
- [CVE-2019-12239](https://insights.sbomify.com/CVE-2019-12239/): Cross-site request forgery in wpbookingsystem:wp booking system (high 7.2)
- [CVE-2019-1223](https://insights.sbomify.com/CVE-2019-1223/): Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability (high 7.5)
- [CVE-2019-12223](https://insights.sbomify.com/CVE-2019-12223/): Memory corruption in hanwha-security:srn-1673s firmware (high 7.5)
- [CVE-2019-12222](https://insights.sbomify.com/CVE-2019-12222/): Memory corruption in libsdl:simple directmedia layer (medium 6.5)
- [CVE-2019-12221](https://insights.sbomify.com/CVE-2019-12221/): Memory corruption in canonical:ubuntu linux (medium 6.5)
- [CVE-2019-12220](https://insights.sbomify.com/CVE-2019-12220/): Memory corruption in libsdl:sdl2 image (medium 6.5)
- [CVE-2019-1222](https://insights.sbomify.com/CVE-2019-1222/): Remote Desktop Services Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2019-12219](https://insights.sbomify.com/CVE-2019-12219/): Memory corruption in libsdl:sdl2 image (high 8.8)
- [CVE-2019-12218](https://insights.sbomify.com/CVE-2019-12218/): Null dereference in libsdl:sdl2 image (medium 6.5)
- [CVE-2019-12217](https://insights.sbomify.com/CVE-2019-12217/): Null dereference in libsdl:sdl2 image (medium 6.5)
- [CVE-2019-12216](https://insights.sbomify.com/CVE-2019-12216/): Memory corruption in canonical:ubuntu linux (medium 6.5)
- [CVE-2019-12215](https://insights.sbomify.com/CVE-2019-12215/): Information disclosure in matomo:matomo (medium 4.3)
- [CVE-2019-12214](https://insights.sbomify.com/CVE-2019-12214/): Memory corruption in freeimage project:freeimage (high 7.5)
- [CVE-2019-12213](https://insights.sbomify.com/CVE-2019-12213/): Denial of service in canonical:ubuntu linux (medium 6.5)
- [CVE-2019-12212](https://insights.sbomify.com/CVE-2019-12212/): Denial of service in freeimage project:freeimage (high 7.5)
- [CVE-2019-12211](https://insights.sbomify.com/CVE-2019-12211/): Memory corruption in canonical:ubuntu linux (high 7.5)
- [CVE-2019-12210](https://insights.sbomify.com/CVE-2019-12210/): Information disclosure in yubico:pam-u2f (high 8.1)
- [CVE-2019-1221](https://insights.sbomify.com/CVE-2019-1221/): Memory corruption in Internet Explorer 11 (high 7.5)
- [CVE-2019-12209](https://insights.sbomify.com/CVE-2019-12209/): Path traversal in yubico:pam-u2f (high 7.5)
- [CVE-2019-12208](https://insights.sbomify.com/CVE-2019-12208/): Memory corruption in f5:njs (critical 9.8)
- [CVE-2019-12207](https://insights.sbomify.com/CVE-2019-12207/): Memory corruption in f5:njs (critical 9.8)
- [CVE-2019-12206](https://insights.sbomify.com/CVE-2019-12206/): Memory corruption in f5:njs (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/133/