# Vulnerabilities published in 2019


- [CVE-2019-10910](https://insights.sbomify.com/CVE-2019-10910/): Symfony Service IDs Allow Injection (critical 9.8)
- [CVE-2019-1091](https://insights.sbomify.com/CVE-2019-1091/): Information disclosure in Windows (medium 5.5)
- [CVE-2019-10909](https://insights.sbomify.com/CVE-2019-10909/): Symfony Cross-site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2019-10908](https://insights.sbomify.com/CVE-2019-10908/): Weak cryptography in airsonic project:airsonic (critical 9.8)
- [CVE-2019-10907](https://insights.sbomify.com/CVE-2019-10907/): Weak cryptography in airsonic project:airsonic (critical 9.8)
- [CVE-2019-10906](https://insights.sbomify.com/CVE-2019-10906/): Jinja2 sandbox escape via string formatting (high 8.6)
- [CVE-2019-10905](https://insights.sbomify.com/CVE-2019-10905/): Parsedown Class-Name Injection (high 8.1)
- [CVE-2019-10904](https://insights.sbomify.com/CVE-2019-10904/): Moderate severity vulnerability that affects roundup (medium 6.1)
- [CVE-2019-10903](https://insights.sbomify.com/CVE-2019-10903/): Memory corruption in canonical:ubuntu linux (high 7.5)
- [CVE-2019-10902](https://insights.sbomify.com/CVE-2019-10902/): Denial of service in fedoraproject:fedora (high 7.5)
- [CVE-2019-10901](https://insights.sbomify.com/CVE-2019-10901/): Null dereference in canonical:ubuntu linux (high 7.5)
- [CVE-2019-10900](https://insights.sbomify.com/CVE-2019-10900/): Denial of service in fedoraproject:fedora (high 7.5)
- [CVE-2019-1090](https://insights.sbomify.com/CVE-2019-1090/): Privilege escalation in Windows (high 7.8)
- [CVE-2019-10899](https://insights.sbomify.com/CVE-2019-10899/): Memory corruption in canonical:ubuntu linux (high 7.5)
- [CVE-2019-10898](https://insights.sbomify.com/CVE-2019-10898/): Denial of service in fedoraproject:fedora (high 7.5)
- [CVE-2019-10897](https://insights.sbomify.com/CVE-2019-10897/): Denial of service in fedoraproject:fedora (high 7.5)
- [CVE-2019-10896](https://insights.sbomify.com/CVE-2019-10896/): Memory corruption in canonical:ubuntu linux (high 7.5)
- [CVE-2019-10895](https://insights.sbomify.com/CVE-2019-10895/): Memory corruption in canonical:ubuntu linux (high 7.5)
- [CVE-2019-10894](https://insights.sbomify.com/CVE-2019-10894/): Denial of service in canonical:ubuntu linux (high 7.5)
- [CVE-2019-10893](https://insights.sbomify.com/CVE-2019-10893/): Cross-site scripting in centos-webpanel:centos web panel (medium 4.8)
- [CVE-2019-10892](https://insights.sbomify.com/CVE-2019-10892/): Memory corruption in dlink:dir-806 firmware (critical 9.8)
- [CVE-2019-10891](https://insights.sbomify.com/CVE-2019-10891/): Command injection in dlink:dir-806 firmware (critical 9.8)
- [CVE-2019-1089](https://insights.sbomify.com/CVE-2019-1089/): Privilege escalation in Multiple (high 7.8)
- [CVE-2019-10888](https://insights.sbomify.com/CVE-2019-10888/): Cross-site request forgery in ukcms:ukcms (high 8.8)
- [CVE-2019-10887](https://insights.sbomify.com/CVE-2019-10887/): Cross-site scripting in salicru:slc-20-cube3\(5\) (medium 6.1)
- [CVE-2019-10886](https://insights.sbomify.com/CVE-2019-10886/): Missing authorization in sony:photo sharing plus (medium 5.9)
- [CVE-2019-10885](https://insights.sbomify.com/CVE-2019-10885/): Security feature bypass in ivanti:workspace control (high 7.8)
- [CVE-2019-10884](https://insights.sbomify.com/CVE-2019-10884/): Security feature bypass in uniqkey:password manager (high 8.8)
- [CVE-2019-10883](https://insights.sbomify.com/CVE-2019-10883/): Command injection in citrix:citrix sd-wan center (critical 9.8)
- [CVE-2019-10882](https://insights.sbomify.com/CVE-2019-10882/): Netskope client buffer overflow vulnerability (medium 5.5)
- [CVE-2019-10881](https://insights.sbomify.com/CVE-2019-10881/): Default hidden Privileged Account Vulnerability in multiple XEROX devices (critical 9.4)
- [CVE-2019-10880](https://insights.sbomify.com/CVE-2019-10880/): Command injection in AltaLink B8045/B8055/B8065/B8075/B8090 (critical 9.8)
- [CVE-2019-1088](https://insights.sbomify.com/CVE-2019-1088/): Privilege escalation in Windows (high 7.8)
- [CVE-2019-10879](https://insights.sbomify.com/CVE-2019-10879/): Integer overflow in teeworlds:teeworlds (critical 9.8)
- [CVE-2019-10878](https://insights.sbomify.com/CVE-2019-10878/): Memory corruption in teeworlds:teeworlds (critical 9.8)
- [CVE-2019-10877](https://insights.sbomify.com/CVE-2019-10877/): Integer overflow in teeworlds:teeworlds (critical 9.8)
- [CVE-2019-10876](https://insights.sbomify.com/CVE-2019-10876/): OpenStack Neutron overlapping security group rules prevents compute node network configuration (medium 6.5)
- [CVE-2019-10875](https://insights.sbomify.com/CVE-2019-10875/): Other in mi:mi browser (medium 6.5)
- [CVE-2019-10874](https://insights.sbomify.com/CVE-2019-10874/): Bolt Cross Site Request Forgery (CSRF) (high 8.8)
- [CVE-2019-10873](https://insights.sbomify.com/CVE-2019-10873/): Null dereference in freedesktop:poppler (medium 6.5)
- [CVE-2019-10872](https://insights.sbomify.com/CVE-2019-10872/): Memory corruption in freedesktop:poppler (high 8.8)
- [CVE-2019-10871](https://insights.sbomify.com/CVE-2019-10871/): Memory corruption in freedesktop:poppler (medium 6.5)
- [CVE-2019-1087](https://insights.sbomify.com/CVE-2019-1087/): Privilege escalation in Windows (high 7.8)
- [CVE-2019-10869](https://insights.sbomify.com/CVE-2019-10869/): File upload in ninjaforms:ninja forms file uploads (high 8.1)
- [CVE-2019-10868](https://insights.sbomify.com/CVE-2019-10868/): Tryton Improper Access Control (medium 4.3)
- [CVE-2019-10867](https://insights.sbomify.com/CVE-2019-10867/): Pimcore Unserialize Remote Code Execution (high 8.8)
- [CVE-2019-10866](https://insights.sbomify.com/CVE-2019-10866/): SQL injection in 10web:form maker (critical 9.8)
- [CVE-2019-10864](https://insights.sbomify.com/CVE-2019-10864/): Cross-site scripting in veronalabs:wp statistics (medium 6.1)
- [CVE-2019-10863](https://insights.sbomify.com/CVE-2019-10863/): Code injection in combodo:teemip (high 7.2)
- [CVE-2019-1086](https://insights.sbomify.com/CVE-2019-1086/): Privilege escalation in Windows (high 7.8)
- [CVE-2019-10856](https://insights.sbomify.com/CVE-2019-10856/): Jupyter Notebook open redirect vulnerability (medium 6.1)
- [CVE-2019-10855](https://insights.sbomify.com/CVE-2019-10855/): Weak cryptography in computrols:computrols building automation software (high 7.5)
- [CVE-2019-10854](https://insights.sbomify.com/CVE-2019-10854/): Command injection in computrols:computrols building automation software (high 8.8)
- [CVE-2019-10853](https://insights.sbomify.com/CVE-2019-10853/): Auth bypass in computrols:computrols building automation software (high 8.1)
- [CVE-2019-10852](https://insights.sbomify.com/CVE-2019-10852/): SQL injection in computrols:computrols building automation software (high 8.8)
- [CVE-2019-10851](https://insights.sbomify.com/CVE-2019-10851/): Hardcoded credentials in computrols:computrols building automation software (medium 6.5)
- [CVE-2019-10850](https://insights.sbomify.com/CVE-2019-10850/): Hardcoded credentials in computrols:computrols building automation software (critical 9.8)
- [CVE-2019-1085](https://insights.sbomify.com/CVE-2019-1085/): Privilege escalation in Windows (high 7.8)
- [CVE-2019-10849](https://insights.sbomify.com/CVE-2019-10849/): Information disclosure in computrols:computrols building automation software (high 7.5)
- [CVE-2019-10848](https://insights.sbomify.com/CVE-2019-10848/): Information disclosure in computrols:computrols building automation software (medium 5.3)
- [CVE-2019-10847](https://insights.sbomify.com/CVE-2019-10847/): Cross-site request forgery in computrols:computrols building automation software (high 8.8)
- [CVE-2019-10846](https://insights.sbomify.com/CVE-2019-10846/): Cross-site scripting in computrols:computrols building automation system (medium 6.1)
- [CVE-2019-10845](https://insights.sbomify.com/CVE-2019-10845/): Security feature bypass in uniqkey:password manager (medium 6.5)
- [CVE-2019-10844](https://insights.sbomify.com/CVE-2019-10844/): Sony Neural Network Libraries reliance on untrusted inputs prior to v1.0.10 (critical 9.8)
- [CVE-2019-10842](https://insights.sbomify.com/CVE-2019-10842/): Bootstrap-sass contains code execution backdoor (critical 9.8)
- [CVE-2019-1084](https://insights.sbomify.com/CVE-2019-1084/): Information disclosure in Mail and Calendar (medium 6.5)
- [CVE-2019-1083](https://insights.sbomify.com/CVE-2019-1083/): Denial of service in Microsoft .NET Framework 2.0 (high 7.5)
- [CVE-2019-1082](https://insights.sbomify.com/CVE-2019-1082/): Privilege escalation in Windows (high 7.8)
- [CVE-2019-1081](https://insights.sbomify.com/CVE-2019-1081/): Microsoft Browser Information Disclosure Vulnerability (medium 4.2)
- [CVE-2019-10808](https://insights.sbomify.com/CVE-2019-10808/): Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify (high 8.8)
- [CVE-2019-10807](https://insights.sbomify.com/CVE-2019-10807/): Improper Neutralization of Special Elements used in an OS Command in Blamer (critical 9.8)
- [CVE-2019-10806](https://insights.sbomify.com/CVE-2019-10806/): Improperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util (medium 4.3)
- [CVE-2019-10805](https://insights.sbomify.com/CVE-2019-10805/): Exposure of Resource to Wrong Sphere in valib (high 7.5)
- [CVE-2019-10804](https://insights.sbomify.com/CVE-2019-10804/): OS Command Injection in serial-number (critical 9.8)
- [CVE-2019-10803](https://insights.sbomify.com/CVE-2019-10803/): push-dir Enables OS Command Injection (critical 9.8)
- [CVE-2019-10802](https://insights.sbomify.com/CVE-2019-10802/): OS Command Injection in giting (critical 9.8)
- [CVE-2019-10801](https://insights.sbomify.com/CVE-2019-10801/): OS Command Injection in enpeem (critical 9.8)
- [CVE-2019-10800](https://insights.sbomify.com/CVE-2019-10800/): Command Injection (medium 6.5)
- [CVE-2019-1080](https://insights.sbomify.com/CVE-2019-1080/): Scripting Engine Memory Corruption Vulnerability (high 7.5)
- [CVE-2019-10799](https://insights.sbomify.com/CVE-2019-10799/): OS Command Injection in compile-sass (high 8.2)
- [CVE-2019-10798](https://insights.sbomify.com/CVE-2019-10798/): Uncontrolled Resource Consumption in rdf-graph-array (medium 5.3)
- [CVE-2019-10797](https://insights.sbomify.com/CVE-2019-10797/): HTTP Response Splitting in WSO2 transport-http (medium 6.5)
- [CVE-2019-10796](https://insights.sbomify.com/CVE-2019-10796/): OS Command Injection in rpi (critical 9.8)
- [CVE-2019-10795](https://insights.sbomify.com/CVE-2019-10795/): Prototype Pollution in undefsafe (medium 6.3)
- [CVE-2019-10794](https://insights.sbomify.com/CVE-2019-10794/): component-flatten vulnerable to Prototype Pollution (medium 6.3)
- [CVE-2019-10793](https://insights.sbomify.com/CVE-2019-10793/): Prototype Pollution in dot-object (medium 6.3)
- [CVE-2019-10792](https://insights.sbomify.com/CVE-2019-10792/): Injection in bodymen (medium 6.3)
- [CVE-2019-10791](https://insights.sbomify.com/CVE-2019-10791/): promise-probe OS command injection vulnerability (critical 9.8)
- [CVE-2019-10790](https://insights.sbomify.com/CVE-2019-10790/): TaffyDB can allow access to any data items in the DB (high 7.5)
- [CVE-2019-1079](https://insights.sbomify.com/CVE-2019-1079/): Information disclosure in Microsoft Visual Studio (medium 6.5)
- [CVE-2019-10789](https://insights.sbomify.com/CVE-2019-10789/): OS Command Injection in curling (critical 9.8)
- [CVE-2019-10788](https://insights.sbomify.com/CVE-2019-10788/): OS Command Injection in im-metadata (critical 9.8)
- [CVE-2019-10787](https://insights.sbomify.com/CVE-2019-10787/): OS Command Injection in im-resize (critical 9.8)
- [CVE-2019-10786](https://insights.sbomify.com/CVE-2019-10786/): Improper Input Validation in network-manager (critical 9.8)
- [CVE-2019-10785](https://insights.sbomify.com/CVE-2019-10785/): XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode (medium 6.1)
- [CVE-2019-10784](https://insights.sbomify.com/CVE-2019-10784/): Cross-site request forgery in phppgadmin (critical 9.6)
- [CVE-2019-10783](https://insights.sbomify.com/CVE-2019-10783/): OS Command Injection in lsof (critical 9.8)
- [CVE-2019-10782](https://insights.sbomify.com/CVE-2019-10782/): XML external entity (XXE) processing ('external-parameter-entities' feature was not fully disabled)) (medium 5.3)
- [CVE-2019-10781](https://insights.sbomify.com/CVE-2019-10781/): Validation Bypass in schema-inspector (critical 9.8)
- [CVE-2019-10780](https://insights.sbomify.com/CVE-2019-10780/): BibTeX-Ruby vulnerable to OS command injection (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/145/