# Vulnerabilities published in 2019


- [CVE-2019-11931](https://insights.sbomify.com/CVE-2019-11931/): Memory corruption in WhatsApp Business for Android (high 7.8)
- [CVE-2019-11930](https://insights.sbomify.com/CVE-2019-11930/): Memory corruption in HHVM (critical 9.8)
- [CVE-2019-1193](https://insights.sbomify.com/CVE-2019-1193/): Microsoft Browser Memory Corruption Vulnerability (medium 6.4)
- [CVE-2019-11929](https://insights.sbomify.com/CVE-2019-11929/): Memory corruption in HHVM (critical 9.8)
- [CVE-2019-11928](https://insights.sbomify.com/CVE-2019-11928/): Cross-site scripting in WhatsApp Desktop (medium 6.1)
- [CVE-2019-11927](https://insights.sbomify.com/CVE-2019-11927/): Integer overflow in WhatsApp for Android (high 7.8)
- [CVE-2019-11926](https://insights.sbomify.com/CVE-2019-11926/): Memory corruption in HHVM (critical 9.8)
- [CVE-2019-11925](https://insights.sbomify.com/CVE-2019-11925/): Memory corruption in HHVM (critical 9.8)
- [CVE-2019-11924](https://insights.sbomify.com/CVE-2019-11924/): Denial of service in fizz (high 7.5)
- [CVE-2019-11923](https://insights.sbomify.com/CVE-2019-11923/): Denial of service in Mcrouter (high 7.5)
- [CVE-2019-11922](https://insights.sbomify.com/CVE-2019-11922/): Race condition in Zstandard (high 8.1)
- [CVE-2019-11921](https://insights.sbomify.com/CVE-2019-11921/): Memory corruption in Proxygen (critical 9.8)
- [CVE-2019-1192](https://insights.sbomify.com/CVE-2019-1192/): Microsoft Browsers Security Feature Bypass Vulnerability (medium 4.3)
- [CVE-2019-1190](https://insights.sbomify.com/CVE-2019-1190/): Windows Image Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2019-11899](https://insights.sbomify.com/CVE-2019-11899/): Missing authorization in Access Professional Edition (high 8.8)
- [CVE-2019-11898](https://insights.sbomify.com/CVE-2019-11898/): Hardcoded credentials in Access Professional Edition (critical 9.9)
- [CVE-2019-11897](https://insights.sbomify.com/CVE-2019-11897/): Server-side request forgery in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software (high 8.6)
- [CVE-2019-11896](https://insights.sbomify.com/CVE-2019-11896/): Incorrect pviilege assignment in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC) (medium 5.5)
- [CVE-2019-11895](https://insights.sbomify.com/CVE-2019-11895/): Improper access control in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) (medium 5.3)
- [CVE-2019-11894](https://insights.sbomify.com/CVE-2019-11894/): Improper access control in the backup mechanism of the Bosch Smart Home Controller (SHC) (medium 5.7)
- [CVE-2019-11893](https://insights.sbomify.com/CVE-2019-11893/): Incorrect privilege assignment in the app permission update API of the Bosch Smart Home Controller (SHC) (medium 5.5)
- [CVE-2019-11892](https://insights.sbomify.com/CVE-2019-11892/): Improper access control in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) (high 7.5)
- [CVE-2019-11891](https://insights.sbomify.com/CVE-2019-11891/): Incorrect privilege assignment in the app pairing mechanism of the Bosch Smart Home Controller (SHC) (high 8.0)
- [CVE-2019-11890](https://insights.sbomify.com/CVE-2019-11890/): Denial of service in sony:bravia firmware (high 7.5)
- [CVE-2019-11889](https://insights.sbomify.com/CVE-2019-11889/): Denial of service in sony:bravia firmware (high 7.5)
- [CVE-2019-11888](https://insights.sbomify.com/CVE-2019-11888/): Privilege escalation in golang:go (critical 9.8)
- [CVE-2019-11887](https://insights.sbomify.com/CVE-2019-11887/): File upload in simplybook:simplybook (critical 9.8)
- [CVE-2019-11886](https://insights.sbomify.com/CVE-2019-11886/): Cross-site request forgery in yellowpencil:visual css style editor (high 8.8)
- [CVE-2019-11885](https://insights.sbomify.com/CVE-2019-11885/): Information disclosure in eye-disk:eyedisk (medium 6.8)
- [CVE-2019-11884](https://insights.sbomify.com/CVE-2019-11884/): Information disclosure in canonical:ubuntu linux (low 3.3)
- [CVE-2019-11881](https://insights.sbomify.com/CVE-2019-11881/): Rancher Login Parameter Can Be Edited (medium 4.7)
- [CVE-2019-11880](https://insights.sbomify.com/CVE-2019-11880/): SQL injection in commsy:commsy (high 7.5)
- [CVE-2019-1188](https://insights.sbomify.com/CVE-2019-1188/): LNK Remote Code Execution Vulnerability (high 7.5)
- [CVE-2019-11879](https://insights.sbomify.com/CVE-2019-11879/): Path traversal in ruby-lang:webrick (medium 5.5)
- [CVE-2019-11878](https://insights.sbomify.com/CVE-2019-11878/): Integer overflow in xiongmaitech:besder ip20h1 firmware (medium 6.5)
- [CVE-2019-11877](https://insights.sbomify.com/CVE-2019-11877/): Cross-site scripting in pix-link:lv-wr09 firmware (medium 6.1)
- [CVE-2019-11876](https://insights.sbomify.com/CVE-2019-11876/): PrestaShop Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2019-11875](https://insights.sbomify.com/CVE-2019-11875/): Missing authorization in blueprism:robotic process automation (high 8.8)
- [CVE-2019-11873](https://insights.sbomify.com/CVE-2019-11873/): Memory corruption in wolfssl:wolfssl (critical 9.8)
- [CVE-2019-11872](https://insights.sbomify.com/CVE-2019-11872/): Code injection in incsub:hustle (high 8.8)
- [CVE-2019-11871](https://insights.sbomify.com/CVE-2019-11871/): Cross-site scripting in custom field suite project:custom field suite (medium 5.4)
- [CVE-2019-11870](https://insights.sbomify.com/CVE-2019-11870/): Cross-site scripting in s9y:serendipity (medium 6.1)
- [CVE-2019-1187](https://insights.sbomify.com/CVE-2019-1187/): XmlLite Runtime Denial of Service Vulnerability (medium 5.5)
- [CVE-2019-11869](https://insights.sbomify.com/CVE-2019-11869/): Cross-site scripting in yuzopro:yuzo (medium 6.1)
- [CVE-2019-11868](https://insights.sbomify.com/CVE-2019-11868/): Memory corruption in softether:see.sys (high 7.8)
- [CVE-2019-11867](https://insights.sbomify.com/CVE-2019-11867/): Null dereference in realtek:ndis (medium 5.5)
- [CVE-2019-11862](https://insights.sbomify.com/CVE-2019-11862/): ALEOS SSH Service Allows Traffic Proxying (high 8.1)
- [CVE-2019-1186](https://insights.sbomify.com/CVE-2019-1186/): Windows Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2019-11859](https://insights.sbomify.com/CVE-2019-11859/): ALEOS SMS Handler Buffer Overflow (medium 6.0)
- [CVE-2019-11858](https://insights.sbomify.com/CVE-2019-11858/): ALEOS Multiple Web UI vulnerabilities (medium 5.7)
- [CVE-2019-11857](https://insights.sbomify.com/CVE-2019-11857/): ALEOS AceManager Information Disclosure (critical 9.1)
- [CVE-2019-11856](https://insights.sbomify.com/CVE-2019-11856/): ALEOS ACEView Message Replay (low 3.3)
- [CVE-2019-11855](https://insights.sbomify.com/CVE-2019-11855/): ALEOS LAN-Side RPC Server (high 8.1)
- [CVE-2019-11853](https://insights.sbomify.com/CVE-2019-11853/): ALEOS AT Command Injections (low 3.9)
- [CVE-2019-11852](https://insights.sbomify.com/CVE-2019-11852/): ALEOS ACEView Service Out-Of-Bounds Read (low 3.7)
- [CVE-2019-11851](https://insights.sbomify.com/CVE-2019-11851/): Memory corruption in sierrawireless:aleos (critical 9.8)
- [CVE-2019-11850](https://insights.sbomify.com/CVE-2019-11850/): ALEOS AT Command Stack Overflow (medium 6.3)
- [CVE-2019-1185](https://insights.sbomify.com/CVE-2019-1185/): Windows Subsystem for Linux Elevation of Privilege Vulnerability (high 7.3)
- [CVE-2019-11849](https://insights.sbomify.com/CVE-2019-11849/): ALEOS AT API Stack Overflow (medium 6.3)
- [CVE-2019-11848](https://insights.sbomify.com/CVE-2019-11848/): ALEOS AT Command API Abuse (medium 4.1)
- [CVE-2019-11847](https://insights.sbomify.com/CVE-2019-11847/): ALEOS User Root Shell Escalation (high 7.3)
- [CVE-2019-11846](https://insights.sbomify.com/CVE-2019-11846/): Cross-site scripting in dotcms:dotcms (medium 6.1)
- [CVE-2019-11845](https://insights.sbomify.com/CVE-2019-11845/): Cross-site scripting in ricoh:sp 4510dn firmware (medium 6.1)
- [CVE-2019-11844](https://insights.sbomify.com/CVE-2019-11844/): Cross-site scripting in ricoh:sp 4520dn firmware (medium 6.1)
- [CVE-2019-11843](https://insights.sbomify.com/CVE-2019-11843/): Cross-site scripting in automattic:mailpoet (medium 6.1)
- [CVE-2019-11842](https://insights.sbomify.com/CVE-2019-11842/): matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG (high 7.5)
- [CVE-2019-11841](https://insights.sbomify.com/CVE-2019-11841/): Golang/x/crypto message forgery vulnerability (medium 5.9)
- [CVE-2019-11840](https://insights.sbomify.com/CVE-2019-11840/): golang.org/x/crypto/salsa20/salsa uses insufficiently random values (medium 5.9)
- [CVE-2019-1184](https://insights.sbomify.com/CVE-2019-1184/): Windows Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2019-11839](https://insights.sbomify.com/CVE-2019-11839/): Memory corruption in f5:njs (critical 9.8)
- [CVE-2019-11838](https://insights.sbomify.com/CVE-2019-11838/): Memory corruption in f5:njs (critical 9.8)
- [CVE-2019-11837](https://insights.sbomify.com/CVE-2019-11837/): Null dereference in f5:njs (high 7.5)
- [CVE-2019-11836](https://insights.sbomify.com/CVE-2019-11836/): Information disclosure in rediff:rediffmail (medium 4.6)
- [CVE-2019-11835](https://insights.sbomify.com/CVE-2019-11835/): Memory corruption in davegamble:cjson (critical 9.8)
- [CVE-2019-11834](https://insights.sbomify.com/CVE-2019-11834/): Memory corruption in davegamble:cjson (critical 9.8)
- [CVE-2019-11833](https://insights.sbomify.com/CVE-2019-11833/): Information disclosure in canonical:ubuntu linux (medium 5.5)
- [CVE-2019-11832](https://insights.sbomify.com/CVE-2019-11832/): TYPO3 Image Processing susceptible to Code Execution (high 7.5)
- [CVE-2019-11831](https://insights.sbomify.com/CVE-2019-11831/): Directory Traversal in typo3/phar-stream-wrapper (critical 9.8)
- [CVE-2019-11830](https://insights.sbomify.com/CVE-2019-11830/): PharStreamWrapper for Typo3 unsafe deserialization vulnerability (critical 9.8)
- [CVE-2019-1183](https://insights.sbomify.com/CVE-2019-1183/): Windows VBScript Engine Remote Code Execution Vulnerability (high 8.8)
- [CVE-2019-11829](https://insights.sbomify.com/CVE-2019-11829/): Command injection in Calendar (high 7.3)
- [CVE-2019-11828](https://insights.sbomify.com/CVE-2019-11828/): Cross-site scripting in Office (medium 5.5)
- [CVE-2019-11827](https://insights.sbomify.com/CVE-2019-11827/): Cross-site scripting in Note Station (medium 6.5)
- [CVE-2019-11826](https://insights.sbomify.com/CVE-2019-11826/): Path traversal in Photo Moments (high 8.0)
- [CVE-2019-11825](https://insights.sbomify.com/CVE-2019-11825/): Cross-site scripting in Calendar (medium 6.5)
- [CVE-2019-11823](https://insights.sbomify.com/CVE-2019-11823/): Denial of service in Synology Router Manager (SRM) (high 8.6)
- [CVE-2019-11822](https://insights.sbomify.com/CVE-2019-11822/): Path traversal in Photo Station (medium 4.3)
- [CVE-2019-11821](https://insights.sbomify.com/CVE-2019-11821/): SQL injection in Photo Station (high 7.3)
- [CVE-2019-11820](https://insights.sbomify.com/CVE-2019-11820/): Information disclosure in Calendar (medium 5.5)
- [CVE-2019-1182](https://insights.sbomify.com/CVE-2019-1182/): Remote Desktop Services Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2019-11819](https://insights.sbomify.com/CVE-2019-11819/): Alkacon OpenCMS CSV Injection via New User module (high 7.8)
- [CVE-2019-11818](https://insights.sbomify.com/CVE-2019-11818/): Alkacon OpenCMS XSS via New User module (medium 6.1)
- [CVE-2019-11816](https://insights.sbomify.com/CVE-2019-11816/): Privilege escalation in netgate:pfsense (high 7.2)
- [CVE-2019-11815](https://insights.sbomify.com/CVE-2019-11815/): Use after free in canonical:ubuntu linux (high 8.1)
- [CVE-2019-11814](https://insights.sbomify.com/CVE-2019-11814/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2019-11813](https://insights.sbomify.com/CVE-2019-11813/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2019-11812](https://insights.sbomify.com/CVE-2019-11812/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2019-11811](https://insights.sbomify.com/CVE-2019-11811/): Use after free in linux:linux kernel (high 7.0)
- [CVE-2019-11810](https://insights.sbomify.com/CVE-2019-11810/): Null dereference in canonical:ubuntu linux (high 7.5)
- [CVE-2019-1181](https://insights.sbomify.com/CVE-2019-1181/): Remote Desktop Services Remote Code Execution Vulnerability (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/136/