# Vulnerabilities published in 2019


- [CVE-2019-10281](https://insights.sbomify.com/CVE-2019-10281/): Jenkins Relution Enterprise Appstore Publisher Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-10280](https://insights.sbomify.com/CVE-2019-10280/): Jenkins Assembla Auth Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1028](https://insights.sbomify.com/CVE-2019-1028/): Windows Audio Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2019-10279](https://insights.sbomify.com/CVE-2019-10279/): Missing permission check in Jenkins jenkins-reviewbot Plugin (medium 6.5)
- [CVE-2019-10278](https://insights.sbomify.com/CVE-2019-10278/): CSRF vulnerability in jenkins-reviewbot Plugin (medium 6.5)
- [CVE-2019-10277](https://insights.sbomify.com/CVE-2019-10277/): Jenkins StarTeam Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-10276](https://insights.sbomify.com/CVE-2019-10276/): File upload in cobub:razor (critical 9.8)
- [CVE-2019-10273](https://insights.sbomify.com/CVE-2019-10273/): Auth bypass in zohocorp:manageengine servicedesk plus (medium 4.3)
- [CVE-2019-10272](https://insights.sbomify.com/CVE-2019-10272/): Other in weaver:e-cology (medium 6.1)
- [CVE-2019-10271](https://insights.sbomify.com/CVE-2019-10271/): Missing authorization in ultimatemember:ultimate member (medium 4.3)
- [CVE-2019-10270](https://insights.sbomify.com/CVE-2019-10270/): Auth bypass in ultimatemember:ultimate member (high 8.8)
- [CVE-2019-1027](https://insights.sbomify.com/CVE-2019-1027/): Windows Audio Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2019-10269](https://insights.sbomify.com/CVE-2019-10269/): Memory corruption in burrow-wheeler aligner project:burrow-wheeler aligner (critical 9.8)
- [CVE-2019-10267](https://insights.sbomify.com/CVE-2019-10267/): File upload in ahsay:cloud backup suite (high 8.8)
- [CVE-2019-10266](https://insights.sbomify.com/CVE-2019-10266/): XML external entity in ahsay:cloud backup suite (high 7.5)
- [CVE-2019-10265](https://insights.sbomify.com/CVE-2019-10265/): Path traversal in ahsay:cloud backup suite (high 7.5)
- [CVE-2019-10264](https://insights.sbomify.com/CVE-2019-10264/): XML external entity in ahsay:cloud backup suite (high 7.2)
- [CVE-2019-10263](https://insights.sbomify.com/CVE-2019-10263/): Cross-site scripting in ahsay:cloud backup suite (medium 6.1)
- [CVE-2019-10262](https://insights.sbomify.com/CVE-2019-10262/): SQL injection in bluecms project:bluecms (critical 9.8)
- [CVE-2019-10261](https://insights.sbomify.com/CVE-2019-10261/): Cross-site scripting in centos-webpanel:centos web panel (medium 4.8)
- [CVE-2019-10260](https://insights.sbomify.com/CVE-2019-10260/): Moderate severity vulnerability that affects total.js (medium 6.1)
- [CVE-2019-1026](https://insights.sbomify.com/CVE-2019-1026/): Windows Audio Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2019-10257](https://insights.sbomify.com/CVE-2019-10257/): Path traversal in zucchetti:hr portal (high 7.5)
- [CVE-2019-10256](https://insights.sbomify.com/CVE-2019-10256/): Auth bypass in vivotek:camera (critical 9.8)
- [CVE-2019-10255](https://insights.sbomify.com/CVE-2019-10255/): Open Redirect vulnerability in jupyterhub and notebook (medium 6.1)
- [CVE-2019-10254](https://insights.sbomify.com/CVE-2019-10254/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2019-10253](https://insights.sbomify.com/CVE-2019-10253/): Cross-site request forgery in teammatesolutions:teammate\+ (medium 6.5)
- [CVE-2019-10251](https://insights.sbomify.com/CVE-2019-10251/): Weak cryptography in ucweb:uc browser (medium 5.9)
- [CVE-2019-10250](https://insights.sbomify.com/CVE-2019-10250/): Weak cryptography in ucweb:uc browser (medium 5.9)
- [CVE-2019-1025](https://insights.sbomify.com/CVE-2019-1025/): Windows Denial of Service Vulnerability (medium 6.5)
- [CVE-2019-10249](https://insights.sbomify.com/CVE-2019-10249/): Potentially compromised builds (high 8.1)
- [CVE-2019-10248](https://insights.sbomify.com/CVE-2019-10248/): Eclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS (high 8.1)
- [CVE-2019-10247](https://insights.sbomify.com/CVE-2019-10247/): Installation information leak in Eclipse Jetty (medium 5.3)
- [CVE-2019-10246](https://insights.sbomify.com/CVE-2019-10246/): Information Exposure vulnerability in Eclipse Jetty (medium 5.3)
- [CVE-2019-10245](https://insights.sbomify.com/CVE-2019-10245/): Memory corruption in Eclipse OpenJ9 (high 7.5)
- [CVE-2019-10244](https://insights.sbomify.com/CVE-2019-10244/): XML external entity in Eclipse Kura (high 7.5)
- [CVE-2019-10243](https://insights.sbomify.com/CVE-2019-10243/): Information disclosure in Eclipse Kura (medium 5.3)
- [CVE-2019-10242](https://insights.sbomify.com/CVE-2019-10242/): Path traversal in Eclipse Kura (medium 5.3)
- [CVE-2019-10241](https://insights.sbomify.com/CVE-2019-10241/): Cross-site Scripting in Eclipse Jetty (medium 6.1)
- [CVE-2019-10240](https://insights.sbomify.com/CVE-2019-10240/): Cleartext Transmission of Sensitive Information, Inclusion of Functionality from Untrusted Control Sphere , and Download of Code Without Integrity Check in Eclipse hawkBit (high 8.1)
- [CVE-2019-1024](https://insights.sbomify.com/CVE-2019-1024/): Chakra Scripting Engine Memory Corruption Vulnerability (medium 4.2)
- [CVE-2019-10239](https://insights.sbomify.com/CVE-2019-10239/): Information disclosure in robotronic:runasspc (high 7.8)
- [CVE-2019-10238](https://insights.sbomify.com/CVE-2019-10238/): Cross-site scripting in sitemagic:sitemagic (medium 6.1)
- [CVE-2019-10237](https://insights.sbomify.com/CVE-2019-10237/): Cross-site request forgery in s-cms:s-cms (high 8.8)
- [CVE-2019-10233](https://insights.sbomify.com/CVE-2019-10233/): Information disclosure in glpi-project:glpi (high 8.1)
- [CVE-2019-10232](https://insights.sbomify.com/CVE-2019-10232/): SQL injection in teclib-edition:gestionnaire libre de parc informatique (critical 9.8)
- [CVE-2019-10231](https://insights.sbomify.com/CVE-2019-10231/): Auth bypass in teclib-edition:gestionnaire libre de parc informatique (critical 9.8)
- [CVE-2019-1023](https://insights.sbomify.com/CVE-2019-1023/): Scripting Engine Information Disclosure Vulnerability (medium 6.5)
- [CVE-2019-10229](https://insights.sbomify.com/CVE-2019-10229/): Auth bypass in mailstore:mailstore (high 8.8)
- [CVE-2019-10227](https://insights.sbomify.com/CVE-2019-10227/): Cross-site scripting in it-novum:openitcockpit (medium 6.1)
- [CVE-2019-10226](https://insights.sbomify.com/CVE-2019-10226/): Cross-site scripting in fatfreecrm:fat free crm (medium 5.4)
- [CVE-2019-10225](https://insights.sbomify.com/CVE-2019-10225/): Information disclosure in atomic-openshift (medium 6.3)
- [CVE-2019-10224](https://insights.sbomify.com/CVE-2019-10224/): Information disclosure in 389-ds-base (medium 4.3)
- [CVE-2019-10223](https://insights.sbomify.com/CVE-2019-10223/): Duplicate Advisory: k8s.io/kube-state-metrics Exposure of Sensitive Information (medium 5.3)
- [CVE-2019-10222](https://insights.sbomify.com/CVE-2019-10222/): Denial of service in ceph (high 7.5)
- [CVE-2019-10221](https://insights.sbomify.com/CVE-2019-10221/): Cross-site scripting in pki-core (medium 4.3)
- [CVE-2019-10220](https://insights.sbomify.com/CVE-2019-10220/): Path traversal in kernel: (high 8.0)
- [CVE-2019-1022](https://insights.sbomify.com/CVE-2019-1022/): Windows Audio Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2019-10219](https://insights.sbomify.com/CVE-2019-10219/): The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks (medium 6.5)
- [CVE-2019-10218](https://insights.sbomify.com/CVE-2019-10218/): Path traversal in samba (medium 5.3)
- [CVE-2019-10217](https://insights.sbomify.com/CVE-2019-10217/): Exposure of Sensitive Information to an Unauthorized Actor in ansible (medium 5.7)
- [CVE-2019-10216](https://insights.sbomify.com/CVE-2019-10216/): Security feature bypass in ghostscript (high 7.3)
- [CVE-2019-10215](https://insights.sbomify.com/CVE-2019-10215/): Cross-site scripting in bootstrap3-typeahead.js (medium 6.1)
- [CVE-2019-10214](https://insights.sbomify.com/CVE-2019-10214/): containers/image library Insufficiently Protects Credentials (medium 6.4)
- [CVE-2019-10213](https://insights.sbomify.com/CVE-2019-10213/): Sensitive Data Exposure in Openshift Container Platform (medium 5.3)
- [CVE-2019-10212](https://insights.sbomify.com/CVE-2019-10212/): Potential to access user credentials from the log files when debug logging enabled (medium 4.8)
- [CVE-2019-10211](https://insights.sbomify.com/CVE-2019-10211/): Code injection in postgresql (high 7.8)
- [CVE-2019-10210](https://insights.sbomify.com/CVE-2019-10210/): Information disclosure in postgresql (medium 6.7)
- [CVE-2019-1021](https://insights.sbomify.com/CVE-2019-1021/): Windows Audio Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2019-10209](https://insights.sbomify.com/CVE-2019-10209/): Information disclosure in postgresql (low 3.1)
- [CVE-2019-10208](https://insights.sbomify.com/CVE-2019-10208/): SQL injection in postgresql (high 7.5)
- [CVE-2019-10207](https://insights.sbomify.com/CVE-2019-10207/): Null dereference in kernel (medium 4.7)
- [CVE-2019-10206](https://insights.sbomify.com/CVE-2019-10206/): Ansible password prompts could expose passwords (medium 6.4)
- [CVE-2019-10205](https://insights.sbomify.com/CVE-2019-10205/): Information disclosure in quay (medium 6.0)
- [CVE-2019-10203](https://insights.sbomify.com/CVE-2019-10203/): Denial of service in pdns (medium 4.3)
- [CVE-2019-10202](https://insights.sbomify.com/CVE-2019-10202/): Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl (high 8.1)
- [CVE-2019-10201](https://insights.sbomify.com/CVE-2019-10201/): Improper Verification of Cryptographic Signature in keycloak (high 8.1)
- [CVE-2019-1020019](https://insights.sbomify.com/CVE-2019-1020019/): Cross-site Scripting in invenio-previewer (medium 6.1)
- [CVE-2019-1020018](https://insights.sbomify.com/CVE-2019-1020018/): Auth bypass in Discourse (high 7.3)
- [CVE-2019-1020017](https://insights.sbomify.com/CVE-2019-1020017/): Security feature bypass in Discourse (medium 5.3)
- [CVE-2019-1020016](https://insights.sbomify.com/CVE-2019-1020016/): Open redirect in ASH-AIO (medium 6.1)
- [CVE-2019-1020015](https://insights.sbomify.com/CVE-2019-1020015/): Auth bypass in graphql-engine (high 7.5)
- [CVE-2019-1020014](https://insights.sbomify.com/CVE-2019-1020014/): Memory corruption in docker-credential-helpers (medium 5.5)
- [CVE-2019-1020013](https://insights.sbomify.com/CVE-2019-1020013/): Sensitive Data Exposure in parse-server (medium 5.3)
- [CVE-2019-1020012](https://insights.sbomify.com/CVE-2019-1020012/): Parse Server before v3.4.1 vulnerable to Denial of Service (high 7.5)
- [CVE-2019-1020011](https://insights.sbomify.com/CVE-2019-1020011/): Missing authorization in SmokeDetector (critical 9.0)
- [CVE-2019-1020010](https://insights.sbomify.com/CVE-2019-1020010/): Cross-site scripting in Misskey (medium 6.1)
- [CVE-2019-1020009](https://insights.sbomify.com/CVE-2019-1020009/): Information disclosure in Fleet (high 7.5)
- [CVE-2019-1020008](https://insights.sbomify.com/CVE-2019-1020008/): stacktable.js before 1.0.4 allows XSS. (medium 6.1)
- [CVE-2019-1020007](https://insights.sbomify.com/CVE-2019-1020007/): Cross-site scripting in Dependency-Track (medium 5.4)
- [CVE-2019-1020006](https://insights.sbomify.com/CVE-2019-1020006/): Invenio-App vulnerable to host header injection attack (medium 6.1)
- [CVE-2019-1020005](https://insights.sbomify.com/CVE-2019-1020005/): Cross-site Scripting in invenio-communities (medium 5.4)
- [CVE-2019-1020004](https://insights.sbomify.com/CVE-2019-1020004/): Other in Tridactyl (high 7.5)
- [CVE-2019-1020003](https://insights.sbomify.com/CVE-2019-1020003/): Cross-site scripting invenio-records (medium 5.4)
- [CVE-2019-1020002](https://insights.sbomify.com/CVE-2019-1020002/): Pterodactyl vulnerable to 2FA Sniffing (high 7.5)
- [CVE-2019-1020001](https://insights.sbomify.com/CVE-2019-1020001/): Path Traversal vulnerability that affects yard (high 7.5)
- [CVE-2019-10200](https://insights.sbomify.com/CVE-2019-10200/): Privilege escalation in OpenShift Container Platform (high 7.2)
- [CVE-2019-10199](https://insights.sbomify.com/CVE-2019-10199/): Improper Input Validation and Cross-Site Request Forgery in Keycloak (medium 4.6)
- [CVE-2019-10198](https://insights.sbomify.com/CVE-2019-10198/): Missing authorization in foreman-tasks (medium 6.5)
- [CVE-2019-10197](https://insights.sbomify.com/CVE-2019-10197/): Path traversal in samba (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/151/