# Vulnerabilities published in 2019


- [CVE-2019-11367](https://insights.sbomify.com/CVE-2019-11367/): Information disclosure in auo:solar data recorder (critical 9.8)
- [CVE-2019-11366](https://insights.sbomify.com/CVE-2019-11366/): Race condition in atftp project:atftp (medium 5.9)
- [CVE-2019-11365](https://insights.sbomify.com/CVE-2019-11365/): Memory corruption in atftp project:atftp (critical 9.8)
- [CVE-2019-11364](https://insights.sbomify.com/CVE-2019-11364/): Command injection in prophecyinternational:snare central (high 7.2)
- [CVE-2019-11363](https://insights.sbomify.com/CVE-2019-11363/): SQL injection in prophecyinternational:snare central (high 7.2)
- [CVE-2019-11362](https://insights.sbomify.com/CVE-2019-11362/): SQL injection in rocboss:rocboss (critical 9.8)
- [CVE-2019-11361](https://insights.sbomify.com/CVE-2019-11361/): Privilege escalation in zohocorp:manageengine remote access plus (high 8.8)
- [CVE-2019-11360](https://insights.sbomify.com/CVE-2019-11360/): Memory corruption in netfilter:iptables (medium 4.2)
- [CVE-2019-1136](https://insights.sbomify.com/CVE-2019-1136/): Privilege escalation in Microsoft Exchange Server (high 8.1)
- [CVE-2019-11359](https://insights.sbomify.com/CVE-2019-11359/): Cross-site scripting in scilico:i\, librarian (medium 6.1)
- [CVE-2019-11358](https://insights.sbomify.com/CVE-2019-11358/): XSS in jQuery as used in Drupal, Backdrop CMS, and other products (medium 6.1)
- [CVE-2019-11356](https://insights.sbomify.com/CVE-2019-11356/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2019-11355](https://insights.sbomify.com/CVE-2019-11355/): Command injection in polycom:hdx system software (high 7.2)
- [CVE-2019-11354](https://insights.sbomify.com/CVE-2019-11354/): Code injection in ea:origin (high 7.8)
- [CVE-2019-11353](https://insights.sbomify.com/CVE-2019-11353/): Command injection in engeniustech:ews660ap firmware (critical 9.8)
- [CVE-2019-11351](https://insights.sbomify.com/CVE-2019-11351/): Code injection in teamspeak:teamspeak (high 8.8)
- [CVE-2019-11350](https://insights.sbomify.com/CVE-2019-11350/): Information disclosure in cloudbees:jenkins operations center (critical 9.8)
- [CVE-2019-11345](https://insights.sbomify.com/CVE-2019-11345/): Cross-site scripting in citrix:citrix sd-wan center (medium 6.1)
- [CVE-2019-11344](https://insights.sbomify.com/CVE-2019-11344/): File upload in pluck-cms:pluck (critical 9.8)
- [CVE-2019-11343](https://insights.sbomify.com/CVE-2019-11343/): Vulnerability in Torpedo Query (critical 9.8)
- [CVE-2019-11341](https://insights.sbomify.com/CVE-2019-11341/): Weak cryptography in google:android (medium 4.6)
- [CVE-2019-11340](https://insights.sbomify.com/CVE-2019-11340/): Matrix Sydent mishandles emails (medium 5.9)
- [CVE-2019-1134](https://insights.sbomify.com/CVE-2019-1134/): Cross-site scripting in Microsoft SharePoint Enterprise Server (medium 5.4)
- [CVE-2019-11339](https://insights.sbomify.com/CVE-2019-11339/): Memory corruption in ffmpeg:ffmpeg (high 8.8)
- [CVE-2019-11338](https://insights.sbomify.com/CVE-2019-11338/): Null dereference in canonical:ubuntu linux (high 8.8)
- [CVE-2019-11336](https://insights.sbomify.com/CVE-2019-11336/): Information disclosure in sony:photo sharing plus (high 8.1)
- [CVE-2019-11334](https://insights.sbomify.com/CVE-2019-11334/): Auth bypass in tzumi:klic lock (low 3.7)
- [CVE-2019-11332](https://insights.sbomify.com/CVE-2019-11332/): Business logic in mkcms project:mkcms (high 8.8)
- [CVE-2019-11331](https://insights.sbomify.com/CVE-2019-11331/): Weak cryptography in ntp:ntp (high 8.1)
- [CVE-2019-1133](https://insights.sbomify.com/CVE-2019-1133/): Scripting Engine Memory Corruption Vulnerability (high 7.5)
- [CVE-2019-11328](https://insights.sbomify.com/CVE-2019-11328/): Incorrect Permission Assignment for Critical Resource in Singularity (high 8.8)
- [CVE-2019-11327](https://insights.sbomify.com/CVE-2019-11327/): Path traversal in topcon:net-g5 firmware (medium 4.9)
- [CVE-2019-11326](https://insights.sbomify.com/CVE-2019-11326/): Auth bypass in topcon:net-g5 firmware (high 8.8)
- [CVE-2019-11325](https://insights.sbomify.com/CVE-2019-11325/): Improper Input Validation in Symfony (critical 9.8)
- [CVE-2019-11324](https://insights.sbomify.com/CVE-2019-11324/): Improper Certificate Validation in urllib3 (high 7.5)
- [CVE-2019-11323](https://insights.sbomify.com/CVE-2019-11323/): Weak cryptography in haproxy:haproxy (medium 5.9)
- [CVE-2019-11322](https://insights.sbomify.com/CVE-2019-11322/): Command injection in motorola:cx2 firmware (critical 9.8)
- [CVE-2019-11321](https://insights.sbomify.com/CVE-2019-11321/): Missing authorization in motorola:cx2 firmware (medium 5.3)
- [CVE-2019-11320](https://insights.sbomify.com/CVE-2019-11320/): Missing authorization in motorola:cx2 firmware (critical 9.8)
- [CVE-2019-1132](https://insights.sbomify.com/CVE-2019-1132/): Microsoft Win32k Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2019-11319](https://insights.sbomify.com/CVE-2019-11319/): Command injection in motorola:cx2 firmware (critical 9.8)
- [CVE-2019-11318](https://insights.sbomify.com/CVE-2019-11318/): Cross-site scripting in synacor:zimbra collaboration server (medium 5.4)
- [CVE-2019-1131](https://insights.sbomify.com/CVE-2019-1131/): Chakra Scripting Engine Memory Corruption Vulnerability (medium 4.2)
- [CVE-2019-1130](https://insights.sbomify.com/CVE-2019-1130/): Microsoft Windows AppX Deployment Service Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2019-11294](https://insights.sbomify.com/CVE-2019-11294/): CAPI leaks service broker URLs and GUIDs to space developers (medium 4.3)
- [CVE-2019-11293](https://insights.sbomify.com/CVE-2019-11293/): UAA logs all query parameters with debug logging level (high 8.8)
- [CVE-2019-11292](https://insights.sbomify.com/CVE-2019-11292/): Pivotal Ops Manager logs query parameters in tomcat access file (high 8.8)
- [CVE-2019-11291](https://insights.sbomify.com/CVE-2019-11291/): RabbitMQ XSS attack via federation and shovel endpoints (low 3.1)
- [CVE-2019-11290](https://insights.sbomify.com/CVE-2019-11290/): Cloud Foundry UAA logs query parameters in tomcat access file (high 8.8)
- [CVE-2019-1129](https://insights.sbomify.com/CVE-2019-1129/): Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2019-11289](https://insights.sbomify.com/CVE-2019-11289/): A forged route service request using an invalid nonce can cause the gorouter to panic and crash (high 8.6)
- [CVE-2019-11288](https://insights.sbomify.com/CVE-2019-11288/): tcServer JMX Socket Listener Registry Rebinding Local Privilege Escalation (high 7.3)
- [CVE-2019-11287](https://insights.sbomify.com/CVE-2019-11287/): RabbitMQ Web Management Plugin DoS via heap overflow (medium 4.5)
- [CVE-2019-11286](https://insights.sbomify.com/CVE-2019-11286/): JMX Credential Deserialization in GemFire (critical 9.0)
- [CVE-2019-11284](https://insights.sbomify.com/CVE-2019-11284/): Reactor Netty authentication leak in redirects (medium 6.8)
- [CVE-2019-11283](https://insights.sbomify.com/CVE-2019-11283/): Password leak in smbdriver logs (high 8.8)
- [CVE-2019-11282](https://insights.sbomify.com/CVE-2019-11282/): UAA is vulnerable to a Blind SCIM injection leading to information disclosure (medium 4.3)
- [CVE-2019-11281](https://insights.sbomify.com/CVE-2019-11281/): RabbitMQ XSS attack (low 2.4)
- [CVE-2019-11280](https://insights.sbomify.com/CVE-2019-11280/): Privilege escalation through the invitations service (high 8.8)
- [CVE-2019-1128](https://insights.sbomify.com/CVE-2019-1128/): Memory corruption in Windows (high 8.8)
- [CVE-2019-11279](https://insights.sbomify.com/CVE-2019-11279/): Privilege Escalation via Scope Manipulation in UAA (high 8.7)
- [CVE-2019-11278](https://insights.sbomify.com/CVE-2019-11278/): Privilege Escalation via Blind SCIM Injection in UAA (high 8.7)
- [CVE-2019-11277](https://insights.sbomify.com/CVE-2019-11277/): Volume Services is vulnerable to an LDAP injection attack (high 8.4)
- [CVE-2019-11276](https://insights.sbomify.com/CVE-2019-11276/): Apps Manager sends tokens to Spring apps via HTTP (medium 5.4)
- [CVE-2019-11275](https://insights.sbomify.com/CVE-2019-11275/): CSV Injection in usage report downloaded from Pivotal Application Manager (low 3.5)
- [CVE-2019-11274](https://insights.sbomify.com/CVE-2019-11274/): UAA SCIM Filter XSS (medium 4.3)
- [CVE-2019-11273](https://insights.sbomify.com/CVE-2019-11273/): PKS Telemetry logs credentials (low 2.2)
- [CVE-2019-11272](https://insights.sbomify.com/CVE-2019-11272/): PlaintextPasswordEncoder authenticates encoded passwords that are null (high 7.3)
- [CVE-2019-11271](https://insights.sbomify.com/CVE-2019-11271/): Bosh Deployment logs leak sensitive information (medium 6.0)
- [CVE-2019-11270](https://insights.sbomify.com/CVE-2019-11270/): UAA clients.write vulnerability (high 7.3)
- [CVE-2019-1127](https://insights.sbomify.com/CVE-2019-1127/): Memory corruption in Windows (high 8.8)
- [CVE-2019-11269](https://insights.sbomify.com/CVE-2019-11269/): Open Redirector in spring-security-oauth2 (medium 4.2)
- [CVE-2019-11268](https://insights.sbomify.com/CVE-2019-11268/): UAA SQL Identity Zone Vulnerability (medium 6.5)
- [CVE-2019-1126](https://insights.sbomify.com/CVE-2019-1126/): Security feature bypass in Windows Server (medium 5.3)
- [CVE-2019-11255](https://insights.sbomify.com/CVE-2019-11255/): Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation (medium 4.8)
- [CVE-2019-11254](https://insights.sbomify.com/CVE-2019-11254/): Kubernetes API Server denial of service vulnerability from malicious YAML payloads (medium 6.5)
- [CVE-2019-11253](https://insights.sbomify.com/CVE-2019-11253/): Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack (high 7.5)
- [CVE-2019-11252](https://insights.sbomify.com/CVE-2019-11252/): Credential leakage when failing to mount (medium 5.9)
- [CVE-2019-11251](https://insights.sbomify.com/CVE-2019-11251/): kubectl cp allows symlink directory traversal (medium 4.8)
- [CVE-2019-11250](https://insights.sbomify.com/CVE-2019-11250/): Kubernetes client-go logs authorization headers at debug verbosity levels (medium 4.7)
- [CVE-2019-1125](https://insights.sbomify.com/CVE-2019-1125/): Windows Kernel Information Disclosure Vulnerability (medium 5.6)
- [CVE-2019-11249](https://insights.sbomify.com/CVE-2019-11249/): kubectl cp allows symlink directory traversal (medium 4.8)
- [CVE-2019-11248](https://insights.sbomify.com/CVE-2019-11248/): Kubernetes kubelet exposes /debug/pprof info on healthz port (medium 6.5)
- [CVE-2019-11247](https://insights.sbomify.com/CVE-2019-11247/): Kubernetes kube-apiserver allows access to custom resources via wrong scope (medium 5.0)
- [CVE-2019-11246](https://insights.sbomify.com/CVE-2019-11246/): kubectl cp allows symlink directory traversal (medium 6.4)
- [CVE-2019-11245](https://insights.sbomify.com/CVE-2019-11245/): kubelet-started container uid changes to root after first restart or if image is already pulled to the node (medium 4.9)
- [CVE-2019-11244](https://insights.sbomify.com/CVE-2019-11244/): kubectl creates world-writeable cached schema files (low 3.3)
- [CVE-2019-11243](https://insights.sbomify.com/CVE-2019-11243/): Kubernetes did not effectively clear service account credentials (low 3.1)
- [CVE-2019-11242](https://insights.sbomify.com/CVE-2019-11242/): Security feature bypass in cohesity:dataplatform (high 8.1)
- [CVE-2019-1124](https://insights.sbomify.com/CVE-2019-1124/): Memory corruption in Windows (high 8.8)
- [CVE-2019-11236](https://insights.sbomify.com/CVE-2019-11236/): Improper Neutralization of CRLF Sequences in urllib3 library for Python (medium 6.1)
- [CVE-2019-11235](https://insights.sbomify.com/CVE-2019-11235/): Weak cryptography in canonical:ubuntu linux (critical 9.8)
- [CVE-2019-11234](https://insights.sbomify.com/CVE-2019-11234/): Auth bypass in canonical:ubuntu linux (critical 9.8)
- [CVE-2019-11233](https://insights.sbomify.com/CVE-2019-11233/): Information disclosure in eic:biyan (high 7.5)
- [CVE-2019-11232](https://insights.sbomify.com/CVE-2019-11232/): Auth bypass in eic:biyan (critical 9.8)
- [CVE-2019-11231](https://insights.sbomify.com/CVE-2019-11231/): File upload in get-simple:getsimple cms (critical 9.8)
- [CVE-2019-11230](https://insights.sbomify.com/CVE-2019-11230/): Other in avast:antivirus (medium 4.4)
- [CVE-2019-1123](https://insights.sbomify.com/CVE-2019-1123/): Memory corruption in Windows (high 8.8)
- [CVE-2019-11229](https://insights.sbomify.com/CVE-2019-11229/): Gitea Remote Code Execution (high 8.8)
- [CVE-2019-11228](https://insights.sbomify.com/CVE-2019-11228/): Gitea Improper Input Validation (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/141/