# Vulnerabilities published in 2019


- [CVE-2019-11004](https://insights.sbomify.com/CVE-2019-11004/): Materialize-css vulnerable to Improper Neutralization of Input During Web Page Generation (medium 6.1)
- [CVE-2019-11003](https://insights.sbomify.com/CVE-2019-11003/): Materialize-css vulnerable to Cross-site Scripting in autocomplete component (medium 6.1)
- [CVE-2019-11002](https://insights.sbomify.com/CVE-2019-11002/): Materialize-css vulnerable to Cross-site Scripting in tooltip component (medium 6.1)
- [CVE-2019-11001](https://insights.sbomify.com/CVE-2019-11001/): Reolink Multiple IP Cameras OS Command Injection (high 7.2, exploited in the wild)
- [CVE-2019-11000](https://insights.sbomify.com/CVE-2019-11000/): Information disclosure in gitlab:gitlab (medium 6.5)
- [CVE-2019-1100](https://insights.sbomify.com/CVE-2019-1100/): Information disclosure in Windows (medium 6.5)
- [CVE-2019-10999](https://insights.sbomify.com/CVE-2019-10999/): Memory corruption in dlink:dcs-5009l firmware (high 8.8)
- [CVE-2019-10998](https://insights.sbomify.com/CVE-2019-10998/): Auth bypass in phoenixcontact:axc f 2152 firmware (medium 6.8)
- [CVE-2019-10997](https://insights.sbomify.com/CVE-2019-10997/): Denial of service in phoenixcontact:axc f 2152 firmware (medium 5.9)
- [CVE-2019-10996](https://insights.sbomify.com/CVE-2019-10996/): Use after free in Red Lion Controls Crimson (Windows configuration software) (high 7.8)
- [CVE-2019-10995](https://insights.sbomify.com/CVE-2019-10995/): Hardcoded credentials in ABB CP651 HMI products (high 8.8)
- [CVE-2019-10994](https://insights.sbomify.com/CVE-2019-10994/): Memory corruption in LCDS LAquis SCADA (low 3.3)
- [CVE-2019-10993](https://insights.sbomify.com/CVE-2019-10993/): Memory corruption in WebAccess/SCADA (critical 9.8)
- [CVE-2019-10992](https://insights.sbomify.com/CVE-2019-10992/): Memory corruption in CNCSoft ScreenEditor (medium 5.5)
- [CVE-2019-10991](https://insights.sbomify.com/CVE-2019-10991/): Memory corruption in WebAccess/SCADA (critical 9.8)
- [CVE-2019-10990](https://insights.sbomify.com/CVE-2019-10990/): Hardcoded credentials in Red Lion Controls Crimson (Windows configuration software) (medium 6.5)
- [CVE-2019-1099](https://insights.sbomify.com/CVE-2019-1099/): Information disclosure in Windows (medium 6.5)
- [CVE-2019-10989](https://insights.sbomify.com/CVE-2019-10989/): Memory corruption in WebAccess/SCADA (critical 9.8)
- [CVE-2019-10988](https://insights.sbomify.com/CVE-2019-10988/): Other in Philips HDI 4000 Ultrasound Systems (low 3.4)
- [CVE-2019-10987](https://insights.sbomify.com/CVE-2019-10987/): Memory corruption in WebAccess/SCADA (high 8.8)
- [CVE-2019-10985](https://insights.sbomify.com/CVE-2019-10985/): Path traversal in WebAccess/SCADA (critical 9.1)
- [CVE-2019-10984](https://insights.sbomify.com/CVE-2019-10984/): Memory corruption in Red Lion Controls Crimson (Windows configuration software) (high 7.8)
- [CVE-2019-10983](https://insights.sbomify.com/CVE-2019-10983/): Memory corruption in WebAccess/SCADA (high 7.5)
- [CVE-2019-10982](https://insights.sbomify.com/CVE-2019-10982/): Memory corruption in CNCSoft ScreenEditor (high 7.8)
- [CVE-2019-10981](https://insights.sbomify.com/CVE-2019-10981/): Information disclosure in AVEVA Vijeo Citect and CitectSCADA (high 7.8)
- [CVE-2019-10980](https://insights.sbomify.com/CVE-2019-10980/): Memory corruption in LCDS LAquis SCADA (high 7.8)
- [CVE-2019-1098](https://insights.sbomify.com/CVE-2019-1098/): Information disclosure in Windows (medium 6.5)
- [CVE-2019-10979](https://insights.sbomify.com/CVE-2019-10979/): Hardcoded credentials in MSC800 (critical 9.8)
- [CVE-2019-10978](https://insights.sbomify.com/CVE-2019-10978/): Memory corruption in Red Lion Controls Crimson (Windows configuration software) (low 3.3)
- [CVE-2019-10977](https://insights.sbomify.com/CVE-2019-10977/): Denial of service in MELSEC-Q series Ethernet module (high 7.5)
- [CVE-2019-10976](https://insights.sbomify.com/CVE-2019-10976/): XML external entity in Mitsubishi Electric FR Configurator2 (medium 5.5)
- [CVE-2019-10975](https://insights.sbomify.com/CVE-2019-10975/): Memory corruption in Alpha7 PC Loader (medium 6.6)
- [CVE-2019-10974](https://insights.sbomify.com/CVE-2019-10974/): Memory corruption in EnergyPlus (medium 5.5)
- [CVE-2019-10973](https://insights.sbomify.com/CVE-2019-10973/): Missing authorization in Quest KACE (high 7.2)
- [CVE-2019-10972](https://insights.sbomify.com/CVE-2019-10972/): Denial of service in Mitsubishi Electric FR Configurator2 (medium 5.5)
- [CVE-2019-10971](https://insights.sbomify.com/CVE-2019-10971/): Other in Network Configurator for DeviceNet Safety (high 7.8)
- [CVE-2019-10970](https://insights.sbomify.com/CVE-2019-10970/): Missing authorization in Rockwell Automation PanelView 5510 (critical 9.8)
- [CVE-2019-1097](https://insights.sbomify.com/CVE-2019-1097/): Information disclosure in Windows (medium 5.5)
- [CVE-2019-10969](https://insights.sbomify.com/CVE-2019-10969/): Command injection in Moxa EDR 810 (high 7.2)
- [CVE-2019-10968](https://insights.sbomify.com/CVE-2019-10968/): Security feature bypass in Philips Holter 2010 Plus (medium 4.4)
- [CVE-2019-10967](https://insights.sbomify.com/CVE-2019-10967/): Memory corruption in Emerson Ovation OCR400 Controller (high 8.8)
- [CVE-2019-10966](https://insights.sbomify.com/CVE-2019-10966/): Auth bypass in Aestiva and Aespire (medium 5.3)
- [CVE-2019-10965](https://insights.sbomify.com/CVE-2019-10965/): Memory corruption in Emerson Ovation OCR400 Controller (high 8.8)
- [CVE-2019-10964](https://insights.sbomify.com/CVE-2019-10964/): Medtronic MiniMed 508 and Paradigm Series Insulin Pumps Improper Access Control (high 7.1)
- [CVE-2019-10963](https://insights.sbomify.com/CVE-2019-10963/): Information disclosure in Moxa EDR 810 (medium 4.3)
- [CVE-2019-10962](https://insights.sbomify.com/CVE-2019-10962/): Missing authorization in BD Alaris Gateway Workstation (medium 5.3)
- [CVE-2019-10961](https://insights.sbomify.com/CVE-2019-10961/): Memory corruption in Advantech WebAccess HMI Designer (high 8.8)
- [CVE-2019-10960](https://insights.sbomify.com/CVE-2019-10960/): Information disclosure in Zebra Industrial Printers All Versions (high 7.5)
- [CVE-2019-1096](https://insights.sbomify.com/CVE-2019-1096/): Information disclosure in Windows (medium 5.5)
- [CVE-2019-10959](https://insights.sbomify.com/CVE-2019-10959/): File upload in BD Alaris Gateway Workstation (critical 10.0)
- [CVE-2019-10958](https://insights.sbomify.com/CVE-2019-10958/): Command injection in Geutebruck IP Cameras (high 7.2)
- [CVE-2019-10957](https://insights.sbomify.com/CVE-2019-10957/): Cross-site scripting in Geutebruck IP Cameras (medium 4.8)
- [CVE-2019-10956](https://insights.sbomify.com/CVE-2019-10956/): Command injection in Geutebruck IP Cameras (high 7.2)
- [CVE-2019-10955](https://insights.sbomify.com/CVE-2019-10955/): Open redirect in CompactLogix 5370 L1 controllers (medium 6.1)
- [CVE-2019-10954](https://insights.sbomify.com/CVE-2019-10954/): Rockwell Automation CompactLogix 5370 Stack-based Buffer Overflow (high 7.5)
- [CVE-2019-10953](https://insights.sbomify.com/CVE-2019-10953/): Denial of service in 1SAP120600R0071 PM554-TP-ETH (high 7.5)
- [CVE-2019-10952](https://insights.sbomify.com/CVE-2019-10952/): Rockwell Automation CompactLogix 5370 Uncontrolled Resource Consumption (critical 9.8)
- [CVE-2019-10951](https://insights.sbomify.com/CVE-2019-10951/): Memory corruption in Delta Industrial Automation CNCSoft (high 7.8)
- [CVE-2019-10950](https://insights.sbomify.com/CVE-2019-10950/): Auth bypass in Fujifilm FCR Capsula X/ Carbon X (critical 9.8)
- [CVE-2019-1095](https://insights.sbomify.com/CVE-2019-1095/): Information disclosure in Windows (medium 6.5)
- [CVE-2019-10949](https://insights.sbomify.com/CVE-2019-10949/): Memory corruption in Delta Industrial Automation CNCSoft (medium 5.5)
- [CVE-2019-10948](https://insights.sbomify.com/CVE-2019-10948/): Denial of service in Fujifilm FCR Capsula X/ Carbon X (high 7.5)
- [CVE-2019-10947](https://insights.sbomify.com/CVE-2019-10947/): Memory corruption in Delta Industrial Automation CNCSoft (high 7.8)
- [CVE-2019-10946](https://insights.sbomify.com/CVE-2019-10946/): Missing authorization in joomla:joomla\! (high 7.5)
- [CVE-2019-10945](https://insights.sbomify.com/CVE-2019-10945/): Path traversal in joomla:joomla\! (critical 9.8)
- [CVE-2019-10943](https://insights.sbomify.com/CVE-2019-10943/): Security feature bypass in SIMATIC Drive Controller family (high 7.5)
- [CVE-2019-10942](https://insights.sbomify.com/CVE-2019-10942/): Denial of service in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (high 8.6)
- [CVE-2019-10941](https://insights.sbomify.com/CVE-2019-10941/): Missing authorization in SINEMA Server (medium 5.3)
- [CVE-2019-10940](https://insights.sbomify.com/CVE-2019-10940/): Privilege escalation in SINEMA Server (critical 9.9)
- [CVE-2019-1094](https://insights.sbomify.com/CVE-2019-1094/): Information disclosure in Windows (medium 6.5)
- [CVE-2019-10939](https://insights.sbomify.com/CVE-2019-10939/): Misconfiguration in TIM 3V-IE (incl. SIPLUS NET variants) (critical 9.8)
- [CVE-2019-10938](https://insights.sbomify.com/CVE-2019-10938/): Security feature bypass in SIPROTEC 5 devices with CPU variants CP200 (critical 9.8)
- [CVE-2019-10937](https://insights.sbomify.com/CVE-2019-10937/): Denial of service in SIMATIC TDC CP51M1 (high 7.5)
- [CVE-2019-10936](https://insights.sbomify.com/CVE-2019-10936/): Denial of service in Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller (high 7.5)
- [CVE-2019-10935](https://insights.sbomify.com/CVE-2019-10935/): File upload in SIMATIC PCS 7 V8.0 and earlier (high 7.2)
- [CVE-2019-10934](https://insights.sbomify.com/CVE-2019-10934/): Path traversal in TIA Portal V14 (high 7.8)
- [CVE-2019-10933](https://insights.sbomify.com/CVE-2019-10933/): Cross-site scripting in Spectrum Power 3 (Corporate User Interface) (medium 6.1)
- [CVE-2019-10931](https://insights.sbomify.com/CVE-2019-10931/): Denial of service in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules (high 7.5)
- [CVE-2019-10930](https://insights.sbomify.com/CVE-2019-10930/): File upload in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules (high 7.5)
- [CVE-2019-1093](https://insights.sbomify.com/CVE-2019-1093/): Information disclosure in Windows (medium 5.5)
- [CVE-2019-10929](https://insights.sbomify.com/CVE-2019-10929/): Weak cryptography in SIMATIC CP 1626 (medium 5.9)
- [CVE-2019-10928](https://insights.sbomify.com/CVE-2019-10928/): Command injection in SCALANCE SC-600 (medium 6.6)
- [CVE-2019-10927](https://insights.sbomify.com/CVE-2019-10927/): Denial of service in SCALANCE SC-600 (medium 6.5)
- [CVE-2019-10926](https://insights.sbomify.com/CVE-2019-10926/): Information disclosure in SIMATIC MV400 family (medium 5.3)
- [CVE-2019-10925](https://insights.sbomify.com/CVE-2019-10925/): Privilege escalation in SIMATIC MV400 family (high 7.1)
- [CVE-2019-10924](https://insights.sbomify.com/CVE-2019-10924/): Deserialization in LOGO! Soft Comfort (high 7.8)
- [CVE-2019-10923](https://insights.sbomify.com/CVE-2019-10923/): Denial of service in Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller (high 7.5)
- [CVE-2019-10922](https://insights.sbomify.com/CVE-2019-10922/): Auth bypass in SIMATIC PCS 7 V8.0 and earlier (critical 9.8)
- [CVE-2019-10921](https://insights.sbomify.com/CVE-2019-10921/): Information disclosure in LOGO! 8 BM (incl. SIPLUS variants) (high 7.5)
- [CVE-2019-10920](https://insights.sbomify.com/CVE-2019-10920/): Hardcoded credentials in LOGO! 8 BM (incl. SIPLUS variants) (high 7.5)
- [CVE-2019-1092](https://insights.sbomify.com/CVE-2019-1092/): Out-of-bounds write (high 7.5)
- [CVE-2019-10919](https://insights.sbomify.com/CVE-2019-10919/): Missing authorization in LOGO! 8 BM (incl. SIPLUS variants) (critical 9.4)
- [CVE-2019-10918](https://insights.sbomify.com/CVE-2019-10918/): Command injection in SIMATIC PCS 7 V8.0 and earlier (high 8.8)
- [CVE-2019-10917](https://insights.sbomify.com/CVE-2019-10917/): Denial of service in SIMATIC PCS 7 V8.0 and earlier (medium 5.5)
- [CVE-2019-10916](https://insights.sbomify.com/CVE-2019-10916/): Command injection in SIMATIC PCS 7 V8.0 and earlier (high 8.8)
- [CVE-2019-10915](https://insights.sbomify.com/CVE-2019-10915/): Missing authorization in TIA Administrator (high 7.8)
- [CVE-2019-10914](https://insights.sbomify.com/CVE-2019-10914/): Memory corruption in matrixssl:matrixssl (critical 9.8)
- [CVE-2019-10913](https://insights.sbomify.com/CVE-2019-10913/): Invalid HTTP method overrides allow possible XSS or other attacks in Symfony (critical 9.8)
- [CVE-2019-10912](https://insights.sbomify.com/CVE-2019-10912/): Deserialization of untrusted data in Symfony (high 7.1)
- [CVE-2019-10911](https://insights.sbomify.com/CVE-2019-10911/): Improper authentication in Symfony (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/144/