# Vulnerabilities published in 2019


- [CVE-2019-11485](https://insights.sbomify.com/CVE-2019-11485/): apport created lock file in wrong directory (low 3.3)
- [CVE-2019-11484](https://insights.sbomify.com/CVE-2019-11484/): Integer overflow in bson_ensure_space (medium 6.3)
- [CVE-2019-11483](https://insights.sbomify.com/CVE-2019-11483/): Information disclosure in apport (high 7.0)
- [CVE-2019-11482](https://insights.sbomify.com/CVE-2019-11482/): Race condition between reading current working directory and writing a core dump (medium 4.2)
- [CVE-2019-11481](https://insights.sbomify.com/CVE-2019-11481/): Apport reads arbitrary files if ~/.config/apport/settings is a symlink (low 3.8)
- [CVE-2019-11480](https://insights.sbomify.com/CVE-2019-11480/): Ubuntu kernel snap build process could use unauthenticated sources (high 8.4)
- [CVE-2019-1148](https://insights.sbomify.com/CVE-2019-1148/): Microsoft Graphics Component Information Disclosure Vulnerability (medium 5.5)
- [CVE-2019-11479](https://insights.sbomify.com/CVE-2019-11479/): Denial of service in Linux kernel (medium 5.3)
- [CVE-2019-11478](https://insights.sbomify.com/CVE-2019-11478/): SACK can cause extensive memory use via fragmented resend queue (medium 5.3)
- [CVE-2019-11477](https://insights.sbomify.com/CVE-2019-11477/): Integer overflow in TCP_SKB_CB(skb)->tcp_gso_segs (high 7.5)
- [CVE-2019-11476](https://insights.sbomify.com/CVE-2019-11476/): Integer overflow in whoopsie results in out-of-bounds heap write (medium 6.5)
- [CVE-2019-11474](https://insights.sbomify.com/CVE-2019-11474/): Denial of service in canonical:ubuntu linux (medium 6.5)
- [CVE-2019-11473](https://insights.sbomify.com/CVE-2019-11473/): Memory corruption in graphicsmagick:graphicsmagick (medium 6.5)
- [CVE-2019-11472](https://insights.sbomify.com/CVE-2019-11472/): Denial of service in imagemagick:imagemagick (medium 6.5)
- [CVE-2019-11471](https://insights.sbomify.com/CVE-2019-11471/): Use after free in struktur:libheif (high 8.8)
- [CVE-2019-11470](https://insights.sbomify.com/CVE-2019-11470/): Denial of service in imagemagick:imagemagick (medium 6.5)
- [CVE-2019-1147](https://insights.sbomify.com/CVE-2019-1147/): Jet Database Engine Remote Code Execution Vulnerability (high 7.8)
- [CVE-2019-11469](https://insights.sbomify.com/CVE-2019-11469/): SQL injection in zohocorp:manageengine applications manager (critical 9.8)
- [CVE-2019-11467](https://insights.sbomify.com/CVE-2019-11467/): Memory corruption in couchbase:couchbase server (high 7.5)
- [CVE-2019-11466](https://insights.sbomify.com/CVE-2019-11466/): Missing authorization in couchbase:couchbase server (medium 5.3)
- [CVE-2019-11465](https://insights.sbomify.com/CVE-2019-11465/): Information disclosure in couchbase:couchbase server (medium 5.3)
- [CVE-2019-11464](https://insights.sbomify.com/CVE-2019-11464/): Misconfiguration in couchbase:couchbase server (medium 6.1)
- [CVE-2019-11463](https://insights.sbomify.com/CVE-2019-11463/): Denial of service in libarchive:libarchive (medium 5.5)
- [CVE-2019-11461](https://insights.sbomify.com/CVE-2019-11461/): Security feature bypass in gnome:nautilus (high 7.8)
- [CVE-2019-11460](https://insights.sbomify.com/CVE-2019-11460/): Security feature bypass in gnome:gnome-desktop (critical 9.0)
- [CVE-2019-1146](https://insights.sbomify.com/CVE-2019-1146/): Jet Database Engine Remote Code Execution Vulnerability (high 7.8)
- [CVE-2019-11459](https://insights.sbomify.com/CVE-2019-11459/): Memory corruption in canonical:ubuntu linux (medium 5.5)
- [CVE-2019-11458](https://insights.sbomify.com/CVE-2019-11458/): Unsafe deserialization in SmtpTransport in CakePHP (high 7.5)
- [CVE-2019-11457](https://insights.sbomify.com/CVE-2019-11457/): Cross-Site Request Forgery in MicroPyramid Django CRM (high 8.8)
- [CVE-2019-11456](https://insights.sbomify.com/CVE-2019-11456/): Cross-site request forgery in gilacms:gila cms (high 8.8)
- [CVE-2019-11455](https://insights.sbomify.com/CVE-2019-11455/): Buffer overflow (high 8.1)
- [CVE-2019-11454](https://insights.sbomify.com/CVE-2019-11454/): Cross-site scripting (medium 6.1)
- [CVE-2019-11452](https://insights.sbomify.com/CVE-2019-11452/): SQL injection in whatsns:whatsns (high 7.2)
- [CVE-2019-11451](https://insights.sbomify.com/CVE-2019-11451/): SQL injection in whatsns:whatsns (high 7.2)
- [CVE-2019-11450](https://insights.sbomify.com/CVE-2019-11450/): SQL injection in whatsns:whatsns (critical 9.8)
- [CVE-2019-1145](https://insights.sbomify.com/CVE-2019-1145/): Microsoft Graphics Remote Code Execution Vulnerability (high 8.8)
- [CVE-2019-11449](https://insights.sbomify.com/CVE-2019-11449/): Cross-site scripting in scilico:i\, librarian (medium 6.1)
- [CVE-2019-11448](https://insights.sbomify.com/CVE-2019-11448/): SQL injection in zohocorp:manageengine applications manager (critical 9.8)
- [CVE-2019-11447](https://insights.sbomify.com/CVE-2019-11447/): File upload in cutephp:cutenews (high 8.8)
- [CVE-2019-11446](https://insights.sbomify.com/CVE-2019-11446/): File upload in atutor:atutor (high 8.8)
- [CVE-2019-11445](https://insights.sbomify.com/CVE-2019-11445/): File upload in openkm:openkm (high 7.2)
- [CVE-2019-11444](https://insights.sbomify.com/CVE-2019-11444/): Command injection in liferay:liferay portal (high 7.2)
- [CVE-2019-1144](https://insights.sbomify.com/CVE-2019-1144/): Microsoft Graphics Remote Code Execution Vulnerability (high 8.8)
- [CVE-2019-1143](https://insights.sbomify.com/CVE-2019-1143/): Windows Graphics Component Information Disclosure Vulnerability (medium 5.5)
- [CVE-2019-11429](https://insights.sbomify.com/CVE-2019-11429/): Cross-site scripting in control-webpanel:webpanel (medium 4.8)
- [CVE-2019-11428](https://insights.sbomify.com/CVE-2019-11428/): Cross-site scripting in scilico:i\, librarian (medium 6.1)
- [CVE-2019-11427](https://insights.sbomify.com/CVE-2019-11427/): Cross-site scripting in idreamsoft:icms (medium 6.1)
- [CVE-2019-11426](https://insights.sbomify.com/CVE-2019-11426/): Cross-site scripting in idreamsoft:icms (medium 6.1)
- [CVE-2019-1142](https://insights.sbomify.com/CVE-2019-1142/): Path traversal in Microsoft .NET Framework 3.5 (medium 5.5)
- [CVE-2019-11419](https://insights.sbomify.com/CVE-2019-11419/): Null dereference in tencent:wechat (medium 5.5)
- [CVE-2019-11418](https://insights.sbomify.com/CVE-2019-11418/): Memory corruption in trendnet:tew-632brp firmware (critical 9.8)
- [CVE-2019-11417](https://insights.sbomify.com/CVE-2019-11417/): Memory corruption in trendnet:tv-ip110wn firmware (critical 9.8)
- [CVE-2019-11416](https://insights.sbomify.com/CVE-2019-11416/): Cross-site request forgery in intelbras:iwr 3000n firmware (high 8.8)
- [CVE-2019-11415](https://insights.sbomify.com/CVE-2019-11415/): Denial of service in intelbras:iwr 3000n firmware (high 7.5)
- [CVE-2019-11414](https://insights.sbomify.com/CVE-2019-11414/): Auth bypass in intelbras:iwr 3000n firmware (high 8.8)
- [CVE-2019-11413](https://insights.sbomify.com/CVE-2019-11413/): Denial of service in artifex:mujs (high 7.5)
- [CVE-2019-11412](https://insights.sbomify.com/CVE-2019-11412/): Denial of service in artifex:mujs (high 7.5)
- [CVE-2019-11411](https://insights.sbomify.com/CVE-2019-11411/): Memory corruption in artifex:mujs (critical 9.8)
- [CVE-2019-11410](https://insights.sbomify.com/CVE-2019-11410/): Command injection in fusionpbx:fusionpbx (high 7.2)
- [CVE-2019-1141](https://insights.sbomify.com/CVE-2019-1141/): Chakra Scripting Engine Memory Corruption Vulnerability (medium 4.2)
- [CVE-2019-11409](https://insights.sbomify.com/CVE-2019-11409/): Command injection in fusionpbx:fusionpbx (high 8.8)
- [CVE-2019-11408](https://insights.sbomify.com/CVE-2019-11408/): Cross-site scripting in fusionpbx:fusionpbx (medium 6.1)
- [CVE-2019-11407](https://insights.sbomify.com/CVE-2019-11407/): Information disclosure in fusionpbx:fusionpbx (high 7.2)
- [CVE-2019-11406](https://insights.sbomify.com/CVE-2019-11406/): Cross-site scripting in intelliants:subrion cms (medium 6.1)
- [CVE-2019-11405](https://insights.sbomify.com/CVE-2019-11405/): OpenAPI Tools OpenAPI Generator uses HTTP in various files (high 8.1)
- [CVE-2019-11404](https://insights.sbomify.com/CVE-2019-11404/): Missing Encryption of Sensitive Data in arrow-kt Arrow (high 8.1)
- [CVE-2019-11403](https://insights.sbomify.com/CVE-2019-11403/): Information disclosure in gradle:build cache node (critical 9.8)
- [CVE-2019-11402](https://insights.sbomify.com/CVE-2019-11402/): Information disclosure in gradle:enterprise (critical 9.8)
- [CVE-2019-11401](https://insights.sbomify.com/CVE-2019-11401/): SiteServer CMS RCE via unsafe file upload (high 7.2)
- [CVE-2019-11400](https://insights.sbomify.com/CVE-2019-11400/): Memory corruption in trendnet:tew-651br firmware (critical 9.8)
- [CVE-2019-1140](https://insights.sbomify.com/CVE-2019-1140/): Chakra Scripting Engine Memory Corruption Vulnerability (high 8.8)
- [CVE-2019-11399](https://insights.sbomify.com/CVE-2019-11399/): Command injection in trendnet:tew-651br firmware (critical 9.8)
- [CVE-2019-11398](https://insights.sbomify.com/CVE-2019-11398/): Cross-site scripting in ulicms:ulicms (medium 6.1)
- [CVE-2019-11397](https://insights.sbomify.com/CVE-2019-11397/): Path traversal in microsoft:.net framework (medium 6.5)
- [CVE-2019-11396](https://insights.sbomify.com/CVE-2019-11396/): Privilege escalation in avira:free security suite (high 7.8)
- [CVE-2019-11395](https://insights.sbomify.com/CVE-2019-11395/): Memory corruption in tabslab:mailcarrier (critical 9.8)
- [CVE-2019-11393](https://insights.sbomify.com/CVE-2019-11393/): Privilege escalation in tildeslash:monit (critical 9.8)
- [CVE-2019-11392](https://insights.sbomify.com/CVE-2019-11392/): XML external entity in dotnetblogengine:blogengine.net (high 7.5)
- [CVE-2019-11391](https://insights.sbomify.com/CVE-2019-11391/): Denial of service in modsecurity:owasp modsecurity core rule set (medium 5.3)
- [CVE-2019-11390](https://insights.sbomify.com/CVE-2019-11390/): Denial of service in modsecurity:owasp modsecurity core rule set (medium 5.3)
- [CVE-2019-1139](https://insights.sbomify.com/CVE-2019-1139/): Chakra Scripting Engine Memory Corruption Vulnerability (medium 4.2)
- [CVE-2019-11389](https://insights.sbomify.com/CVE-2019-11389/): Denial of service in modsecurity:owasp modsecurity core rule set (medium 5.3)
- [CVE-2019-11388](https://insights.sbomify.com/CVE-2019-11388/): Denial of service in modsecurity:owasp modsecurity core rule set (medium 5.3)
- [CVE-2019-11387](https://insights.sbomify.com/CVE-2019-11387/): Denial of service in modsecurity:owasp modsecurity core rule set (medium 5.3)
- [CVE-2019-11384](https://insights.sbomify.com/CVE-2019-11384/): Information disclosure in zalora:zalora (critical 9.8)
- [CVE-2019-11383](https://insights.sbomify.com/CVE-2019-11383/): Information disclosure in wifi ftp server project:wifi ftp server (critical 9.8)
- [CVE-2019-11380](https://insights.sbomify.com/CVE-2019-11380/): Auth bypass in estrongs:es file explorer file manager (high 7.5)
- [CVE-2019-1138](https://insights.sbomify.com/CVE-2019-1138/): Out-of-bounds write (high 7.5)
- [CVE-2019-11378](https://insights.sbomify.com/CVE-2019-11378/): Path traversal in projectsend:projectsend (high 8.8)
- [CVE-2019-11377](https://insights.sbomify.com/CVE-2019-11377/): File upload in wcms:wcms (high 8.8)
- [CVE-2019-11376](https://insights.sbomify.com/CVE-2019-11376/): Code injection in brassica:soy cms (high 7.2)
- [CVE-2019-11375](https://insights.sbomify.com/CVE-2019-11375/): Cross-site request forgery in meisivod:msvod (medium 6.5)
- [CVE-2019-11374](https://insights.sbomify.com/CVE-2019-11374/): Cross-site request forgery in 74cms:74cms (high 8.8)
- [CVE-2019-11373](https://insights.sbomify.com/CVE-2019-11373/): Memory corruption in fedoraproject:fedora (medium 6.5)
- [CVE-2019-11372](https://insights.sbomify.com/CVE-2019-11372/): Memory corruption in fedoraproject:fedora (medium 6.5)
- [CVE-2019-11371](https://insights.sbomify.com/CVE-2019-11371/): Memory corruption in burrow-wheeler aligner project:burrow-wheeler aligner (critical 9.8)
- [CVE-2019-11370](https://insights.sbomify.com/CVE-2019-11370/): Cross-site scripting in carel:pcoweb card firmware (medium 5.4)
- [CVE-2019-1137](https://insights.sbomify.com/CVE-2019-1137/): Cross-site scripting in Microsoft Exchange Server 2013 (medium 5.4)
- [CVE-2019-11369](https://insights.sbomify.com/CVE-2019-11369/): Information disclosure in carel:pcoweb card firmware (high 8.8)
- [CVE-2019-11368](https://insights.sbomify.com/CVE-2019-11368/): Cross-site scripting in auo:solar data recorder (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/140/