# Vulnerabilities published in 2019


- [CVE-2019-11108](https://insights.sbomify.com/CVE-2019-11108/): Privilege escalation in Intel(R) CSME (medium 6.7)
- [CVE-2019-11107](https://insights.sbomify.com/CVE-2019-11107/): Other in Intel(R) AMT (critical 9.8)
- [CVE-2019-11106](https://insights.sbomify.com/CVE-2019-11106/): Privilege escalation in Intel(R) CSME (medium 6.7)
- [CVE-2019-11105](https://insights.sbomify.com/CVE-2019-11105/): Privilege escalation in Intel(R) CSME (medium 6.7)
- [CVE-2019-11104](https://insights.sbomify.com/CVE-2019-11104/): Privilege escalation in Intel(R) CSME (high 7.8)
- [CVE-2019-11103](https://insights.sbomify.com/CVE-2019-11103/): Privilege escalation in Intel(R) CSME (high 7.8)
- [CVE-2019-11102](https://insights.sbomify.com/CVE-2019-11102/): Information disclosure in Intel(R) DAL software for Intel(R) CSME (medium 4.4)
- [CVE-2019-11101](https://insights.sbomify.com/CVE-2019-11101/): Information disclosure in Intel(R) CSME, Intel(R) TXE (medium 4.4)
- [CVE-2019-11100](https://insights.sbomify.com/CVE-2019-11100/): Information disclosure in Intel(R) AMT (medium 4.6)
- [CVE-2019-1110](https://insights.sbomify.com/CVE-2019-1110/): Memory corruption in Microsoft Excel (high 8.8)
- [CVE-2019-11098](https://insights.sbomify.com/CVE-2019-11098/): Other in Tianocore (medium 6.8)
- [CVE-2019-11097](https://insights.sbomify.com/CVE-2019-11097/): Misconfiguration in Intel(R) Management Engine (high 7.8)
- [CVE-2019-11096](https://insights.sbomify.com/CVE-2019-11096/): Information disclosure in Intel(R) Ethernet I218 Adapter driver for Windows* 10 (medium 5.5)
- [CVE-2019-11095](https://insights.sbomify.com/CVE-2019-11095/): Missing authorization in Intel(R) Driver & Support Assistant (medium 4.4)
- [CVE-2019-11094](https://insights.sbomify.com/CVE-2019-11094/): Other in Intel (R) NUC (high 7.8)
- [CVE-2019-11093](https://insights.sbomify.com/CVE-2019-11093/): Privilege escalation in Intel(R) SCS Discovery Utility (medium 6.7)
- [CVE-2019-11092](https://insights.sbomify.com/CVE-2019-11092/): Information disclosure in Open Cloud Integrity Technology and OpenAttestation (medium 4.4)
- [CVE-2019-11091](https://insights.sbomify.com/CVE-2019-11091/): Information disclosure in Central Processing Units (CPUs) (medium 5.6)
- [CVE-2019-11090](https://insights.sbomify.com/CVE-2019-11090/): Weak cryptography in Intel(R) PTT (medium 5.9)
- [CVE-2019-1109](https://insights.sbomify.com/CVE-2019-1109/): Security feature bypass in Microsoft Office (critical 9.1)
- [CVE-2019-11089](https://insights.sbomify.com/CVE-2019-11089/): Denial of service in 2019.2 IPU – Intel(R) Graphics Driver for Windows* and Linux (medium 5.5)
- [CVE-2019-11088](https://insights.sbomify.com/CVE-2019-11088/): Privilege escalation in Intel(R) AMT (high 8.8)
- [CVE-2019-11087](https://insights.sbomify.com/CVE-2019-11087/): Other in Intel(R) CSME, Intel(R) TXE (medium 6.7)
- [CVE-2019-11086](https://insights.sbomify.com/CVE-2019-11086/): Privilege escalation in Intel(R) AMT (medium 6.8)
- [CVE-2019-11085](https://insights.sbomify.com/CVE-2019-11085/): Privilege escalation in Intel(R) i915 Graphics for Linux (high 7.8)
- [CVE-2019-11084](https://insights.sbomify.com/CVE-2019-11084/): Cross-site scripting in gbraad:gauth (medium 6.1)
- [CVE-2019-11082](https://insights.sbomify.com/CVE-2019-11082/): Path Traversal in DKPro Core (high 7.5)
- [CVE-2019-11081](https://insights.sbomify.com/CVE-2019-11081/): Hardcoded credentials in dentsplysirona:sidexis (critical 9.8)
- [CVE-2019-11080](https://insights.sbomify.com/CVE-2019-11080/): Deserialization in sitecore:experience platform (high 8.8)
- [CVE-2019-1108](https://insights.sbomify.com/CVE-2019-1108/): Information disclosure in Windows (medium 6.5)
- [CVE-2019-11078](https://insights.sbomify.com/CVE-2019-11078/): Cross-site request forgery in mkcms project:mkcms (high 8.8)
- [CVE-2019-11077](https://insights.sbomify.com/CVE-2019-11077/): Cross-site request forgery in fastadmin:fastadmin (high 8.8)
- [CVE-2019-11076](https://insights.sbomify.com/CVE-2019-11076/): Command injection in cribl:cribl (critical 9.8)
- [CVE-2019-11074](https://insights.sbomify.com/CVE-2019-11074/): Path traversal in paessler:prtg network monitor (high 7.2)
- [CVE-2019-11073](https://insights.sbomify.com/CVE-2019-11073/): Command injection in paessler:prtg network monitor (high 7.2)
- [CVE-2019-11072](https://insights.sbomify.com/CVE-2019-11072/): Integer overflow in lighttpd:lighttpd (critical 9.8)
- [CVE-2019-11071](https://insights.sbomify.com/CVE-2019-11071/): Code injection in debian:debian linux (high 8.8)
- [CVE-2019-11070](https://insights.sbomify.com/CVE-2019-11070/): Security feature bypass in webkitgtk:webkitgtk (medium 5.3)
- [CVE-2019-1107](https://insights.sbomify.com/CVE-2019-1107/): Out-of-bounds write (high 7.5)
- [CVE-2019-11069](https://insights.sbomify.com/CVE-2019-11069/): SQL Injection in sequelize (high 7.5)
- [CVE-2019-11068](https://insights.sbomify.com/CVE-2019-11068/): Nokogiri vulnerable to libxslt protection mechanism bypass (critical 9.8)
- [CVE-2019-11066](https://insights.sbomify.com/CVE-2019-11066/): Server-side request forgery in lightopenid project:lightopenid (critical 9.8)
- [CVE-2019-11065](https://insights.sbomify.com/CVE-2019-11065/): Insecure transport protocol in Gradle (medium 5.9)
- [CVE-2019-11064](https://insights.sbomify.com/CVE-2019-11064/): A vulnerability of remote credential disclosure was discovered in Advan VD-1 (critical 9.8)
- [CVE-2019-11063](https://insights.sbomify.com/CVE-2019-11063/): SmartHome application has a broken access control vulnerability in its Web API Server (critical 10.0)
- [CVE-2019-11062](https://insights.sbomify.com/CVE-2019-11062/): SUNNET WMPro v5.0 and v5.1 has OS Command Injection (critical 9.8)
- [CVE-2019-11061](https://insights.sbomify.com/CVE-2019-11061/): HG100 has a broken access control vulnerability in its Web API Server (critical 10.0)
- [CVE-2019-11060](https://insights.sbomify.com/CVE-2019-11060/): HG100 contains an Uncontrolled Resource Consumption vulnerability (high 7.4)
- [CVE-2019-1106](https://insights.sbomify.com/CVE-2019-1106/): Out-of-bounds write (high 7.5)
- [CVE-2019-11059](https://insights.sbomify.com/CVE-2019-11059/): Memory corruption in denx:u-boot (critical 9.8)
- [CVE-2019-11057](https://insights.sbomify.com/CVE-2019-11057/): SQL injection in vtiger:vtiger crm (high 8.8)
- [CVE-2019-11050](https://insights.sbomify.com/CVE-2019-11050/): Use-after-free in exif parsing under memory sanitizer (medium 4.8)
- [CVE-2019-1105](https://insights.sbomify.com/CVE-2019-1105/): Outlook for Android Spoofing Vulnerability (medium 5.4)
- [CVE-2019-11049](https://insights.sbomify.com/CVE-2019-11049/): mail() may release string with refcount==1 twice (medium 6.5)
- [CVE-2019-11048](https://insights.sbomify.com/CVE-2019-11048/): Temporary files are not cleaned after OOM when parsing HTTP request data (medium 5.3)
- [CVE-2019-11047](https://insights.sbomify.com/CVE-2019-11047/): Heap-buffer-overflow READ in exif (medium 4.8)
- [CVE-2019-11046](https://insights.sbomify.com/CVE-2019-11046/): Buffer underflow in bc_shift_addsub (low 3.7)
- [CVE-2019-11045](https://insights.sbomify.com/CVE-2019-11045/): DirectoryIterator class silently truncates after a null byte (low 3.7)
- [CVE-2019-11044](https://insights.sbomify.com/CVE-2019-11044/): link() silently truncates after a null byte on Windows (low 3.7)
- [CVE-2019-11043](https://insights.sbomify.com/CVE-2019-11043/): PHP FastCGI Process Manager (FPM) Buffer Overflow (high 8.7, exploited in the wild)
- [CVE-2019-11042](https://insights.sbomify.com/CVE-2019-11042/): heap-buffer-overflow on exif_process_user_comment in EXIF extension (medium 4.8)
- [CVE-2019-11041](https://insights.sbomify.com/CVE-2019-11041/): heap-buffer-overflow on exif_scan_thumbnail in EXIF extension (medium 4.8)
- [CVE-2019-11040](https://insights.sbomify.com/CVE-2019-11040/): Heap buffer overflow in EXIF extension (medium 4.8)
- [CVE-2019-1104](https://insights.sbomify.com/CVE-2019-1104/): Memory corruption in Internet Explorer 10 (high 7.5)
- [CVE-2019-11039](https://insights.sbomify.com/CVE-2019-11039/): Out-of-bounds read in iconv.c (medium 4.2)
- [CVE-2019-11038](https://insights.sbomify.com/CVE-2019-11038/): Uninitialized read in gdImageCreateFromXbm (low 3.1)
- [CVE-2019-11037](https://insights.sbomify.com/CVE-2019-11037/): Out of bounds memory write in PHP Imagick extension (medium 4.9)
- [CVE-2019-11036](https://insights.sbomify.com/CVE-2019-11036/): Heap over-read in PHP EXIF extension (medium 4.8)
- [CVE-2019-11035](https://insights.sbomify.com/CVE-2019-11035/): Heap over-read in PHP EXIF extension (medium 4.8)
- [CVE-2019-11034](https://insights.sbomify.com/CVE-2019-11034/): Heap over-read in PHP EXIF extension (medium 4.8)
- [CVE-2019-11033](https://insights.sbomify.com/CVE-2019-11033/): Cross-site scripting in applaudsolutions:applaud hcm (medium 6.1)
- [CVE-2019-11032](https://insights.sbomify.com/CVE-2019-11032/): Cross-site scripting in hr-technologies:easytorecruit (medium 6.1)
- [CVE-2019-11031](https://insights.sbomify.com/CVE-2019-11031/): File upload in mirasys:mirasys vms (critical 9.8)
- [CVE-2019-11030](https://insights.sbomify.com/CVE-2019-11030/): Deserialization in mirasys:mirasys vms (critical 9.8)
- [CVE-2019-1103](https://insights.sbomify.com/CVE-2019-1103/): Out-of-bounds write (high 7.5)
- [CVE-2019-11029](https://insights.sbomify.com/CVE-2019-11029/): Path traversal in mirasys:mirasys vms (high 7.5)
- [CVE-2019-11028](https://insights.sbomify.com/CVE-2019-11028/): File upload in gatship:web module (high 8.8)
- [CVE-2019-11027](https://insights.sbomify.com/CVE-2019-11027/): ruby-openid SSRF via claimed_id request (critical 9.8)
- [CVE-2019-11026](https://insights.sbomify.com/CVE-2019-11026/): Denial of service in fedoraproject:fedora (medium 6.5)
- [CVE-2019-11025](https://insights.sbomify.com/CVE-2019-11025/): Cross-site scripting in cacti:cacti (medium 5.4)
- [CVE-2019-11024](https://insights.sbomify.com/CVE-2019-11024/): Denial of service in saitoha:libsixel (medium 5.5)
- [CVE-2019-11023](https://insights.sbomify.com/CVE-2019-11023/): Null dereference in graphviz:graphviz (high 8.8)
- [CVE-2019-11021](https://insights.sbomify.com/CVE-2019-11021/): File upload in schlix:cms (high 7.2)
- [CVE-2019-11020](https://insights.sbomify.com/CVE-2019-11020/): Missing authorization in ddrt:dashcom live firmware (high 7.5)
- [CVE-2019-1102](https://insights.sbomify.com/CVE-2019-1102/): Memory corruption in Windows (high 8.8)
- [CVE-2019-11019](https://insights.sbomify.com/CVE-2019-11019/): Missing authorization in ddrt:dashcom live firmware (high 7.5)
- [CVE-2019-11018](https://insights.sbomify.com/CVE-2019-11018/): ThinkAdmin Administrator cookies still working after password change (critical 9.8)
- [CVE-2019-11017](https://insights.sbomify.com/CVE-2019-11017/): Cross-site scripting in dlink:di-524 firmware (medium 4.8)
- [CVE-2019-11016](https://insights.sbomify.com/CVE-2019-11016/): Elgg open redirect (medium 6.1)
- [CVE-2019-11015](https://insights.sbomify.com/CVE-2019-11015/): Auth bypass in miui:miui (medium 6.8)
- [CVE-2019-11014](https://insights.sbomify.com/CVE-2019-11014/): Auth bypass in vstarcam:eye4 (critical 9.8)
- [CVE-2019-11013](https://insights.sbomify.com/CVE-2019-11013/): Path traversal in softvelum:nimble streamer (medium 6.5)
- [CVE-2019-11011](https://insights.sbomify.com/CVE-2019-11011/): Deserialization in akamai:cloudtest (critical 9.8)
- [CVE-2019-11010](https://insights.sbomify.com/CVE-2019-11010/): Denial of service in debian:debian linux (medium 6.5)
- [CVE-2019-1101](https://insights.sbomify.com/CVE-2019-1101/): Information disclosure in Windows (medium 6.5)
- [CVE-2019-11009](https://insights.sbomify.com/CVE-2019-11009/): Memory corruption in debian:debian linux (high 8.1)
- [CVE-2019-11008](https://insights.sbomify.com/CVE-2019-11008/): Memory corruption in canonical:ubuntu linux (high 8.8)
- [CVE-2019-11007](https://insights.sbomify.com/CVE-2019-11007/): Memory corruption in canonical:ubuntu linux (high 8.1)
- [CVE-2019-11006](https://insights.sbomify.com/CVE-2019-11006/): Memory corruption in debian:debian linux (critical 9.1)
- [CVE-2019-11005](https://insights.sbomify.com/CVE-2019-11005/): Memory corruption in graphicsmagick:graphicsmagick (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/143/