# Vulnerabilities published in 2019


- [CVE-2019-1078](https://insights.sbomify.com/CVE-2019-1078/): Microsoft Graphics Component Information Disclosure Vulnerability (medium 5.5)
- [CVE-2019-10779](https://insights.sbomify.com/CVE-2019-10779/): Cross-site scripting in stroom:stroom-app (medium 6.1)
- [CVE-2019-10778](https://insights.sbomify.com/CVE-2019-10778/): OS Command Injection in devcert-sanscache (critical 9.8)
- [CVE-2019-10777](https://insights.sbomify.com/CVE-2019-10777/): OS command injection in aws-lambda (critical 9.8)
- [CVE-2019-10776](https://insights.sbomify.com/CVE-2019-10776/): OS command injection in git-diff-apply (critical 9.8)
- [CVE-2019-10775](https://insights.sbomify.com/CVE-2019-10775/): Denial of Service in ecstatic (high 7.5)
- [CVE-2019-10774](https://insights.sbomify.com/CVE-2019-10774/): php-shellcommand command injection vulnerability (critical 9.8)
- [CVE-2019-10773](https://insights.sbomify.com/CVE-2019-10773/): Yarn Improper link resolution before file access (Link Following) (high 7.8)
- [CVE-2019-10772](https://insights.sbomify.com/CVE-2019-10772/): Sanitizer bypass in svg-sanitizer (medium 6.1)
- [CVE-2019-10771](https://insights.sbomify.com/CVE-2019-10771/): Cross-Site Scripting in iobroker.web (medium 6.1)
- [CVE-2019-10770](https://insights.sbomify.com/CVE-2019-10770/): Default development error handler in Ratpack is vulnerable to HTML content injection (XSS) (medium 6.1)
- [CVE-2019-1077](https://insights.sbomify.com/CVE-2019-1077/): Privilege escalation in Microsoft Visual Studio 2017 (medium 5.0)
- [CVE-2019-10769](https://insights.sbomify.com/CVE-2019-10769/): Sandbox Breakout / Arbitrary Code Execution in safer-eval (critical 9.8)
- [CVE-2019-10768](https://insights.sbomify.com/CVE-2019-10768/): angular Prototype Pollution vulnerability (high 7.5)
- [CVE-2019-10767](https://insights.sbomify.com/CVE-2019-10767/): Arbitrary File Write in iobroker.js-controller (high 7.5)
- [CVE-2019-10766](https://insights.sbomify.com/CVE-2019-10766/): SQL Injection in usmanhalalit/pixie (critical 9.8)
- [CVE-2019-10765](https://insights.sbomify.com/CVE-2019-10765/): Arbitrary File Write in iobroker.admin (critical 9.8)
- [CVE-2019-10764](https://insights.sbomify.com/CVE-2019-10764/): Timing attacks might allow practical recovery of the long-term private key (high 7.4)
- [CVE-2019-10763](https://insights.sbomify.com/CVE-2019-10763/): Data leakage via SQL Injection in Pimcore (medium 6.5)
- [CVE-2019-10762](https://insights.sbomify.com/CVE-2019-10762/): SQL Injection in medoo (critical 9.8)
- [CVE-2019-10761](https://insights.sbomify.com/CVE-2019-10761/): Sandbox Bypass (high 8.3)
- [CVE-2019-10760](https://insights.sbomify.com/CVE-2019-10760/): Sandbox Breakout / Arbitrary Code Execution in safer-eval (critical 9.9)
- [CVE-2019-1076](https://insights.sbomify.com/CVE-2019-1076/): Cross-site scripting in Azure DevOps Server (medium 5.4)
- [CVE-2019-10759](https://insights.sbomify.com/CVE-2019-10759/): Sandbox Breakout / Arbitrary Code Execution in safer-eval (critical 9.9)
- [CVE-2019-10758](https://insights.sbomify.com/CVE-2019-10758/): MongoDB mongo-express Remote Code Execution (critical 9.9, exploited in the wild)
- [CVE-2019-10757](https://insights.sbomify.com/CVE-2019-10757/): SQL Injection in knex (critical 9.8)
- [CVE-2019-10756](https://insights.sbomify.com/CVE-2019-10756/): Cross-site Scripting in node-red-dashboard (medium 5.4)
- [CVE-2019-10755](https://insights.sbomify.com/CVE-2019-10755/): Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml (medium 4.9)
- [CVE-2019-10754](https://insights.sbomify.com/CVE-2019-10754/): Use of Insufficiently Random Values in Apereo CAS (high 8.1)
- [CVE-2019-10753](https://insights.sbomify.com/CVE-2019-10753/): Incorrect Resource Transfer Between Spheres in eclipse-wtp (medium 5.9)
- [CVE-2019-10752](https://insights.sbomify.com/CVE-2019-10752/): SQL Injection in sequelize (critical 9.8)
- [CVE-2019-10751](https://insights.sbomify.com/CVE-2019-10751/): Open Redirect in httpie (high 8.8)
- [CVE-2019-10750](https://insights.sbomify.com/CVE-2019-10750/): Prototype Pollution in deeply (critical 9.8)
- [CVE-2019-1075](https://insights.sbomify.com/CVE-2019-1075/): Open redirect in ASP.NET Core (medium 6.1)
- [CVE-2019-10749](https://insights.sbomify.com/CVE-2019-10749/): SQL Injection in sequelize (critical 9.8)
- [CVE-2019-10748](https://insights.sbomify.com/CVE-2019-10748/): SQL Injection in sequelize (critical 9.8)
- [CVE-2019-10747](https://insights.sbomify.com/CVE-2019-10747/): Prototype Pollution in set-value (critical 9.8)
- [CVE-2019-10746](https://insights.sbomify.com/CVE-2019-10746/): Prototype Pollution in mixin-deep (critical 9.8)
- [CVE-2019-10745](https://insights.sbomify.com/CVE-2019-10745/): assign-deep Vulnerable to Prototype Pollution (high 7.5)
- [CVE-2019-10744](https://insights.sbomify.com/CVE-2019-10744/): Prototype Pollution in lodash (critical 9.1)
- [CVE-2019-10743](https://insights.sbomify.com/CVE-2019-10743/): Path Traversal in MHolt Archiver (medium 5.5)
- [CVE-2019-10742](https://insights.sbomify.com/CVE-2019-10742/): Denial of Service in axios (high 7.5)
- [CVE-2019-10741](https://insights.sbomify.com/CVE-2019-10741/): Security feature bypass in k-9 mail project:k-9 mail (medium 4.3)
- [CVE-2019-10740](https://insights.sbomify.com/CVE-2019-10740/): Information disclosure in fedoraproject:fedora (medium 4.3)
- [CVE-2019-1074](https://insights.sbomify.com/CVE-2019-1074/): Privilege escalation in Windows (medium 5.5)
- [CVE-2019-10735](https://insights.sbomify.com/CVE-2019-10735/): Information disclosure in claws-mail:mail (medium 4.3)
- [CVE-2019-10734](https://insights.sbomify.com/CVE-2019-10734/): Information disclosure in trojita project:trojita (medium 4.3)
- [CVE-2019-10732](https://insights.sbomify.com/CVE-2019-10732/): Information disclosure in debian:debian linux (medium 4.3)
- [CVE-2019-1073](https://insights.sbomify.com/CVE-2019-1073/): Information disclosure in Windows (medium 5.5)
- [CVE-2019-10724](https://insights.sbomify.com/CVE-2019-10724/): Privilege escalation in lenovo:100e 2nd gen firmware (medium 6.5)
- [CVE-2019-10723](https://insights.sbomify.com/CVE-2019-10723/): Denial of service in podofo project:podofo (medium 5.5)
- [CVE-2019-10721](https://insights.sbomify.com/CVE-2019-10721/): Open redirect in dotnetblogengine:blogengine.net (medium 6.1)
- [CVE-2019-10720](https://insights.sbomify.com/CVE-2019-10720/): Path traversal in blogengine:blogengine.net (high 8.8)
- [CVE-2019-1072](https://insights.sbomify.com/CVE-2019-1072/): Code injection in Azure DevOps Server (critical 9.8)
- [CVE-2019-10719](https://insights.sbomify.com/CVE-2019-10719/): Path traversal in dotnetblogengine:blogengine.net (high 8.8)
- [CVE-2019-10718](https://insights.sbomify.com/CVE-2019-10718/): XML external entity in dotnetblogengine:blogengine.net (high 7.5)
- [CVE-2019-10717](https://insights.sbomify.com/CVE-2019-10717/): Path traversal in dotnetblogengine:blogengine.net (high 7.1)
- [CVE-2019-10716](https://insights.sbomify.com/CVE-2019-10716/): Information disclosure in verodin:director (high 7.7)
- [CVE-2019-10715](https://insights.sbomify.com/CVE-2019-10715/): Cross-site scripting in verodin:director (medium 5.4)
- [CVE-2019-10714](https://insights.sbomify.com/CVE-2019-10714/): Memory corruption in imagemagick:imagemagick (medium 6.5)
- [CVE-2019-10712](https://insights.sbomify.com/CVE-2019-10712/): Hardcoded credentials in wago:750-330 firmware (critical 9.8)
- [CVE-2019-10711](https://insights.sbomify.com/CVE-2019-10711/): Hardcoded credentials in hisilicon:hi3510 firmware (high 7.5)
- [CVE-2019-10710](https://insights.sbomify.com/CVE-2019-10710/): Information disclosure in hisilicon:hi3510 firmware (high 8.8)
- [CVE-2019-1071](https://insights.sbomify.com/CVE-2019-1071/): Information disclosure in Windows (medium 5.5)
- [CVE-2019-10709](https://insights.sbomify.com/CVE-2019-10709/): Memory corruption in asus:precision touchpad (critical 9.8)
- [CVE-2019-10708](https://insights.sbomify.com/CVE-2019-10708/): SQL injection in s-cms:s-cms (critical 9.8)
- [CVE-2019-10707](https://insights.sbomify.com/CVE-2019-10707/): SQL injection in mkcms project:mkcms (critical 9.8)
- [CVE-2019-10706](https://insights.sbomify.com/CVE-2019-10706/): Weak cryptography in westerndigital:sandisk x300 sd7sb6s-128g firmware (medium 6.3)
- [CVE-2019-10705](https://insights.sbomify.com/CVE-2019-10705/): Auth bypass in westerndigital:sandisk x600 sd9sb8w-128g firmware (high 7.5)
- [CVE-2019-1070](https://insights.sbomify.com/CVE-2019-1070/): Cross-site scripting in Microsoft SharePoint Enterprise Server (medium 5.4)
- [CVE-2019-10695](https://insights.sbomify.com/CVE-2019-10695/): Information disclosure in Continuous Delivery for Puppet Enterprise (CD4PE) (medium 6.5)
- [CVE-2019-10694](https://insights.sbomify.com/CVE-2019-10694/): Hardcoded credentials in Puppet Enterprise (critical 9.8)
- [CVE-2019-10692](https://insights.sbomify.com/CVE-2019-10692/): SQL injection in codecabin:wp go maps (critical 9.8)
- [CVE-2019-10691](https://insights.sbomify.com/CVE-2019-10691/): Denial of service in dovecot:dovecot (high 7.5)
- [CVE-2019-1069](https://insights.sbomify.com/CVE-2019-1069/): Microsoft Task Scheduler Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2019-10689](https://insights.sbomify.com/CVE-2019-10689/): Auth bypass in polycom:better together over ethernet connector (medium 6.5)
- [CVE-2019-10688](https://insights.sbomify.com/CVE-2019-10688/): Hardcoded credentials in polycom:better together over ethernet connector (medium 6.8)
- [CVE-2019-10687](https://insights.sbomify.com/CVE-2019-10687/): SQL injection in kbpublisher:kbpublisher (critical 9.8)
- [CVE-2019-10686](https://insights.sbomify.com/CVE-2019-10686/): Server-Side Request Forgery (SSRF) in com.ctrip.framework.apollo:apollo (critical 10.0)
- [CVE-2019-10685](https://insights.sbomify.com/CVE-2019-10685/): Cross-site scripting in heidelberg:prinect archiver (medium 6.1)
- [CVE-2019-10684](https://insights.sbomify.com/CVE-2019-10684/): Code injection in 74cms:74cms (critical 9.8)
- [CVE-2019-10682](https://insights.sbomify.com/CVE-2019-10682/): django-nopassword stores secrets in cleartext (high 7.5)
- [CVE-2019-1068](https://insights.sbomify.com/CVE-2019-1068/): Microsoft SQL Server Remote Code Execution (high 8.8, exploited in the wild)
- [CVE-2019-10679](https://insights.sbomify.com/CVE-2019-10679/): Misconfiguration in thomsonreuters:eikon (high 7.8)
- [CVE-2019-10678](https://insights.sbomify.com/CVE-2019-10678/): Command injection in domoticz:domoticz (high 7.5)
- [CVE-2019-10677](https://insights.sbomify.com/CVE-2019-10677/): Cross-site scripting in dasanzhone:znid gpon 2426a eu firmware (medium 6.1)
- [CVE-2019-10676](https://insights.sbomify.com/CVE-2019-10676/): Information disclosure in uniqkey:password manager (medium 6.5)
- [CVE-2019-10673](https://insights.sbomify.com/CVE-2019-10673/): Cross-site request forgery in ultimatemember:ultimate member (high 8.8)
- [CVE-2019-10672](https://insights.sbomify.com/CVE-2019-10672/): Other in symonics:libmysofa (critical 9.8)
- [CVE-2019-10671](https://insights.sbomify.com/CVE-2019-10671/): SQL Injection in LibreNMS (high 8.8)
- [CVE-2019-10670](https://insights.sbomify.com/CVE-2019-10670/): Cross-site scripting in librenms:librenms (medium 6.1)
- [CVE-2019-1067](https://insights.sbomify.com/CVE-2019-1067/): Privilege escalation in Windows (high 7.8)
- [CVE-2019-10669](https://insights.sbomify.com/CVE-2019-10669/): Command injection in librenms:librenms (high 7.2)
- [CVE-2019-10668](https://insights.sbomify.com/CVE-2019-10668/): Missing Authentication for Critical Function in LibreNMS (critical 9.1)
- [CVE-2019-10667](https://insights.sbomify.com/CVE-2019-10667/): Exposure of Sensitive Information to an Unauthorized Actor in LibreNMS (medium 5.3)
- [CVE-2019-10666](https://insights.sbomify.com/CVE-2019-10666/): Code injection in librenms:librenms (high 8.1)
- [CVE-2019-10665](https://insights.sbomify.com/CVE-2019-10665/): LibreNMS Information Disclosure (critical 9.8)
- [CVE-2019-10664](https://insights.sbomify.com/CVE-2019-10664/): SQL injection in domoticz:domoticz (critical 9.8)
- [CVE-2019-10663](https://insights.sbomify.com/CVE-2019-10663/): SQL injection in grandstream:ucm6204 firmware (high 8.8)
- [CVE-2019-10662](https://insights.sbomify.com/CVE-2019-10662/): Command injection in grandstream:ucm6204 firmware (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/146/