# Vulnerabilities published in 2019


- [CVE-2019-12205](https://insights.sbomify.com/CVE-2019-12205/): Silverstripe Flash Clipboard Reflected XSS (medium 6.1)
- [CVE-2019-12204](https://insights.sbomify.com/CVE-2019-12204/): Missing warning can lead to unauthenticated admin access in SilverStripe (critical 9.8)
- [CVE-2019-12203](https://insights.sbomify.com/CVE-2019-12203/): Session fixation in change password form (medium 6.3)
- [CVE-2019-1220](https://insights.sbomify.com/CVE-2019-1220/): Security feature bypass in Internet Explorer 10 (medium 4.3)
- [CVE-2019-12198](https://insights.sbomify.com/CVE-2019-12198/): Memory corruption in gohttp project:gohttp (high 7.5)
- [CVE-2019-12196](https://insights.sbomify.com/CVE-2019-12196/): SQL injection in zohocorp:manageengine netflow analyzer (critical 9.8)
- [CVE-2019-12195](https://insights.sbomify.com/CVE-2019-12195/): Cross-site scripting in tp-link:tl-wr840n firmware (medium 4.8)
- [CVE-2019-12193](https://insights.sbomify.com/CVE-2019-12193/): SQL injection in h3c:h3cloud os (critical 9.8)
- [CVE-2019-12190](https://insights.sbomify.com/CVE-2019-12190/): Cross-site scripting in control-webpanel:webpanel (medium 5.4)
- [CVE-2019-1219](https://insights.sbomify.com/CVE-2019-1219/): Information disclosure in Windows (medium 5.5)
- [CVE-2019-12189](https://insights.sbomify.com/CVE-2019-12189/): Cross-site scripting in zohocorp:manageengine servicedesk plus (medium 6.1)
- [CVE-2019-12186](https://insights.sbomify.com/CVE-2019-12186/): XSS injection in the Grid component of Sylius (medium 4.8)
- [CVE-2019-12185](https://insights.sbomify.com/CVE-2019-12185/): File upload in elabftw:elabftw (high 8.8)
- [CVE-2019-12184](https://insights.sbomify.com/CVE-2019-12184/): Cross-site scripting in boostio:boostnote (medium 5.4)
- [CVE-2019-12183](https://insights.sbomify.com/CVE-2019-12183/): Missing authorization in safescan:ta-8010 firmware (high 7.5)
- [CVE-2019-12182](https://insights.sbomify.com/CVE-2019-12182/): Path traversal in safescan:ta-8010 firmware (critical 9.8)
- [CVE-2019-12181](https://insights.sbomify.com/CVE-2019-12181/): Command injection in solarwinds:serv-u ftp server (high 8.8)
- [CVE-2019-12180](https://insights.sbomify.com/CVE-2019-12180/): Code injection in smartbear:readyapi (high 7.8)
- [CVE-2019-1218](https://insights.sbomify.com/CVE-2019-1218/): Outlook iOS Spoofing Vulnerability (medium 5.4)
- [CVE-2019-12177](https://insights.sbomify.com/CVE-2019-12177/): Privilege escalation in htc:viveport (high 7.8)
- [CVE-2019-12176](https://insights.sbomify.com/CVE-2019-12176/): Privilege escalation in htc:viveport (high 7.8)
- [CVE-2019-12175](https://insights.sbomify.com/CVE-2019-12175/): Null dereference in zeek:zeek (high 7.5)
- [CVE-2019-12174](https://insights.sbomify.com/CVE-2019-12174/): Privilege escalation in hide:hide.me (high 7.8)
- [CVE-2019-12173](https://insights.sbomify.com/CVE-2019-12173/): Path traversal in macdown project:macdown (high 8.8)
- [CVE-2019-12172](https://insights.sbomify.com/CVE-2019-12172/): Path traversal in typora:typora (high 7.8)
- [CVE-2019-12171](https://insights.sbomify.com/CVE-2019-12171/): Information disclosure in dropbox:dropbox (high 7.8)
- [CVE-2019-12170](https://insights.sbomify.com/CVE-2019-12170/): File upload in atutor:atutor (high 8.8)
- [CVE-2019-1217](https://insights.sbomify.com/CVE-2019-1217/): Out-of-bounds write (high 7.5)
- [CVE-2019-12169](https://insights.sbomify.com/CVE-2019-12169/): Path traversal in atutor:atutor (high 8.8)
- [CVE-2019-12168](https://insights.sbomify.com/CVE-2019-12168/): Missing authorization in four-faith:f3x24 firmware (high 7.2)
- [CVE-2019-12167](https://insights.sbomify.com/CVE-2019-12167/): Cross-site scripting in emerson:liebert challenger firmware (medium 6.1)
- [CVE-2019-12165](https://insights.sbomify.com/CVE-2019-12165/): Command injection in mitel:micollab (critical 9.8)
- [CVE-2019-12164](https://insights.sbomify.com/CVE-2019-12164/): Code injection in status:react native desktop (critical 9.8)
- [CVE-2019-12163](https://insights.sbomify.com/CVE-2019-12163/): Information disclosure in gatship:web module (medium 5.3)
- [CVE-2019-12162](https://insights.sbomify.com/CVE-2019-12162/): Security feature bypass in upwork:time tracker (high 7.8)
- [CVE-2019-12161](https://insights.sbomify.com/CVE-2019-12161/): Server-side request forgery in webpagetest:webpagetest (high 8.8)
- [CVE-2019-12160](https://insights.sbomify.com/CVE-2019-12160/): Use after free in gohttp project:gohttp (critical 9.8)
- [CVE-2019-1216](https://insights.sbomify.com/CVE-2019-1216/): Information disclosure in Windows (medium 5.5)
- [CVE-2019-12159](https://insights.sbomify.com/CVE-2019-12159/): Memory corruption in gohttp project:gohttp (high 7.5)
- [CVE-2019-12158](https://insights.sbomify.com/CVE-2019-12158/): Memory corruption in gohttp project:gohttp (critical 9.8)
- [CVE-2019-12157](https://insights.sbomify.com/CVE-2019-12157/): Information disclosure in jetbrains:teamcity (critical 9.8)
- [CVE-2019-12156](https://insights.sbomify.com/CVE-2019-12156/): Information disclosure in jetbrains:upsource (medium 5.3)
- [CVE-2019-12155](https://insights.sbomify.com/CVE-2019-12155/): Null dereference in qemu:qemu (high 7.5)
- [CVE-2019-12154](https://insights.sbomify.com/CVE-2019-12154/): XML external entity in realobjects:pdfreactor (critical 9.1)
- [CVE-2019-12153](https://insights.sbomify.com/CVE-2019-12153/): Server-side request forgery in realobjects:pdfreactor (critical 10.0)
- [CVE-2019-12150](https://insights.sbomify.com/CVE-2019-12150/): File upload in karamasoft:ultimateeditor (critical 9.8)
- [CVE-2019-1215](https://insights.sbomify.com/CVE-2019-1215/): Microsoft Windows Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2019-12149](https://insights.sbomify.com/CVE-2019-12149/): silverstripe restfulserver and registry modules SQL injection vulnerability (critical 9.8)
- [CVE-2019-12148](https://insights.sbomify.com/CVE-2019-12148/): Auth bypass in sangoma:session border controller firmware (critical 9.8)
- [CVE-2019-12147](https://insights.sbomify.com/CVE-2019-12147/): Command injection in sangoma:session border controller firmware (critical 9.8)
- [CVE-2019-12146](https://insights.sbomify.com/CVE-2019-12146/): Path traversal in ipswitch:ws ftp server (critical 9.1)
- [CVE-2019-12145](https://insights.sbomify.com/CVE-2019-12145/): Path traversal in ipswitch:ws ftp server (high 7.5)
- [CVE-2019-12144](https://insights.sbomify.com/CVE-2019-12144/): Path traversal in ipswitch:ws ftp server (critical 9.8)
- [CVE-2019-12143](https://insights.sbomify.com/CVE-2019-12143/): Path traversal in progress:ws ftp server (medium 5.3)
- [CVE-2019-1214](https://insights.sbomify.com/CVE-2019-1214/): Microsoft Windows Privilege Common Log File System (CLFS) Escalation (high 7.8, exploited in the wild)
- [CVE-2019-12139](https://insights.sbomify.com/CVE-2019-12139/): ezplatform-admin-ui Cross-site Scripting (XSS) vulnerability (medium 6.1)
- [CVE-2019-12138](https://insights.sbomify.com/CVE-2019-12138/): Path traversal in macdown project:macdown (high 7.8)
- [CVE-2019-12137](https://insights.sbomify.com/CVE-2019-12137/): Path traversal in typora:typora (high 7.8)
- [CVE-2019-12136](https://insights.sbomify.com/CVE-2019-12136/): Cross-site scripting in boostio:boostnote (medium 5.4)
- [CVE-2019-12135](https://insights.sbomify.com/CVE-2019-12135/): Other in papercut:papercut mf (critical 9.8)
- [CVE-2019-12134](https://insights.sbomify.com/CVE-2019-12134/): Code injection in workday:workday (high 8.8)
- [CVE-2019-12133](https://insights.sbomify.com/CVE-2019-12133/): Privilege escalation in zohocorp:manageengine analytics plus (high 7.8)
- [CVE-2019-12132](https://insights.sbomify.com/CVE-2019-12132/): Command injection in onap:open network automation platform (critical 9.8)
- [CVE-2019-12131](https://insights.sbomify.com/CVE-2019-12131/): Auth bypass in onap:open network automation platform (critical 9.1)
- [CVE-2019-12130](https://insights.sbomify.com/CVE-2019-12130/): Missing authorization in onap:open network automation platform (critical 9.8)
- [CVE-2019-1213](https://insights.sbomify.com/CVE-2019-1213/): Windows DHCP Server Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2019-12129](https://insights.sbomify.com/CVE-2019-12129/): Missing authorization in onap:open network automation platform (critical 9.8)
- [CVE-2019-12128](https://insights.sbomify.com/CVE-2019-12128/): Missing authorization in onap:open network automation platform (critical 9.8)
- [CVE-2019-12127](https://insights.sbomify.com/CVE-2019-12127/): Missing authorization in onap:open network automation platform (critical 9.8)
- [CVE-2019-12126](https://insights.sbomify.com/CVE-2019-12126/): Missing authorization in onap:open network automation platform (critical 9.8)
- [CVE-2019-12125](https://insights.sbomify.com/CVE-2019-12125/): Missing authorization in onap:open network automation platform (critical 9.8)
- [CVE-2019-12124](https://insights.sbomify.com/CVE-2019-12124/): Missing authorization in onap:open network automation platform (critical 9.1)
- [CVE-2019-12123](https://insights.sbomify.com/CVE-2019-12123/): Command injection in onap:open network automation platform (high 8.8)
- [CVE-2019-12122](https://insights.sbomify.com/CVE-2019-12122/): Information disclosure in onap:open network automation platform (medium 6.5)
- [CVE-2019-12121](https://insights.sbomify.com/CVE-2019-12121/): Weak cryptography in onap:open network automation platform (high 7.5)
- [CVE-2019-12120](https://insights.sbomify.com/CVE-2019-12120/): Missing authorization in onap:open network automation platform (critical 9.8)
- [CVE-2019-1212](https://insights.sbomify.com/CVE-2019-1212/): Windows DHCP Server Denial of Service Vulnerability (critical 9.8)
- [CVE-2019-12119](https://insights.sbomify.com/CVE-2019-12119/): Missing authorization in onap:open network automation platform (critical 9.8)
- [CVE-2019-12118](https://insights.sbomify.com/CVE-2019-12118/): Missing authorization in onap:open network automation platform (critical 9.8)
- [CVE-2019-12117](https://insights.sbomify.com/CVE-2019-12117/): Missing authorization in onap:open network automation platform (critical 9.8)
- [CVE-2019-12116](https://insights.sbomify.com/CVE-2019-12116/): Missing authorization in onap:open network automation platform (critical 9.8)
- [CVE-2019-12115](https://insights.sbomify.com/CVE-2019-12115/): Missing authorization in onap:open network automation platform (critical 9.8)
- [CVE-2019-12114](https://insights.sbomify.com/CVE-2019-12114/): Missing authorization in onap:open network automation platform (critical 9.8)
- [CVE-2019-12113](https://insights.sbomify.com/CVE-2019-12113/): Command injection in onap:open network automation platform (high 8.8)
- [CVE-2019-12112](https://insights.sbomify.com/CVE-2019-12112/): Command injection in onap:open network automation platform (critical 9.8)
- [CVE-2019-12111](https://insights.sbomify.com/CVE-2019-12111/): Null dereference in debian:debian linux (high 7.5)
- [CVE-2019-12110](https://insights.sbomify.com/CVE-2019-12110/): Null dereference in miniupnp.free:miniupnpd (high 7.5)
- [CVE-2019-1211](https://insights.sbomify.com/CVE-2019-1211/): Git for Visual Studio Elevation of Privilege Vulnerability (high 7.3)
- [CVE-2019-12109](https://insights.sbomify.com/CVE-2019-12109/): Null dereference in miniupnp project:miniupnpd (high 7.5)
- [CVE-2019-12108](https://insights.sbomify.com/CVE-2019-12108/): Null dereference in miniupnp project:miniupnpd (high 7.5)
- [CVE-2019-12107](https://insights.sbomify.com/CVE-2019-12107/): Information disclosure in miniupnp.free:miniupnpd (high 7.5)
- [CVE-2019-12106](https://insights.sbomify.com/CVE-2019-12106/): Use after free in miniupnp project:miniupnpd (high 7.5)
- [CVE-2019-12105](https://insights.sbomify.com/CVE-2019-12105/): Missing authorization in supervisord:supervisor (high 8.2)
- [CVE-2019-12104](https://insights.sbomify.com/CVE-2019-12104/): Command injection in tp-link:m7350 firmware (high 8.8)
- [CVE-2019-12103](https://insights.sbomify.com/CVE-2019-12103/): Command injection in tp-link:m7350 firmware (critical 9.8)
- [CVE-2019-12102](https://insights.sbomify.com/CVE-2019-12102/): Missing authorization in kentico:xperience (critical 9.1)
- [CVE-2019-12101](https://insights.sbomify.com/CVE-2019-12101/): Null dereference in libnyoci project:libnyoci (high 7.5)
- [CVE-2019-12099](https://insights.sbomify.com/CVE-2019-12099/): File upload in php-fusion:php-fusion (high 8.8)
- [CVE-2019-12098](https://insights.sbomify.com/CVE-2019-12098/): Security feature bypass in debian:debian linux (high 7.4)
- [CVE-2019-12097](https://insights.sbomify.com/CVE-2019-12097/): Code injection in progress:fiddler (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/134/