# Vulnerabilities published in 2019


- [GHSA-cff4-rrq6-h78w](https://insights.sbomify.com/GHSA-cff4-rrq6-h78w/): Command Injection in command-exists (not scored)
- [GHSA-c35v-qwqg-87jc](https://insights.sbomify.com/GHSA-c35v-qwqg-87jc/): express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison (not scored)
- [GHSA-9xr8-8hmc-389f](https://insights.sbomify.com/GHSA-9xr8-8hmc-389f/): Cross-Site Scripting in vant (not scored)
- [GHSA-984p-xq9m-4rjw](https://insights.sbomify.com/GHSA-984p-xq9m-4rjw/): Rate Limiting Bypass in express-brute (not scored)
- [GHSA-8xqr-4cpm-wx7g](https://insights.sbomify.com/GHSA-8xqr-4cpm-wx7g/): Cross-Site Scripting in react-svg (not scored)
- [GHSA-8w57-jfpm-945m](https://insights.sbomify.com/GHSA-8w57-jfpm-945m/): Denial of Service in http-proxy-agent (not scored)
- [GHSA-8v5f-hp78-jgxq](https://insights.sbomify.com/GHSA-8v5f-hp78-jgxq/): Signature Verification Bypass in jwt-simple (not scored)
- [GHSA-8j8c-7jfh-h6hx](https://insights.sbomify.com/GHSA-8j8c-7jfh-h6hx/): Code Injection in js-yaml (not scored)
- [GHSA-8f93-rv4p-x4jw](https://insights.sbomify.com/GHSA-8f93-rv4p-x4jw/): SQL Injection in sql (not scored)
- [GHSA-8948-ffc6-jg52](https://insights.sbomify.com/GHSA-8948-ffc6-jg52/): Insecure Default Configuration in redbird (not scored)
- [GHSA-886v-mm6p-4m66](https://insights.sbomify.com/GHSA-886v-mm6p-4m66/): High severity vulnerability that affects gun (not scored)
- [GHSA-87mg-h5r3-hw88](https://insights.sbomify.com/GHSA-87mg-h5r3-hw88/): Cross-Site Scripting in bootbox (not scored)
- [GHSA-86p3-4gfq-38f2](https://insights.sbomify.com/GHSA-86p3-4gfq-38f2/): Denial of Service in url-relative (not scored)
- [GHSA-83rx-c8cr-6j8q](https://insights.sbomify.com/GHSA-83rx-c8cr-6j8q/): Insecure Default Configuration in tesseract.js (not scored)
- [GHSA-7jfh-2xc9-ccv7](https://insights.sbomify.com/GHSA-7jfh-2xc9-ccv7/): Cross-Site Scripting in public (not scored)
- [GHSA-7cg8-pq9v-x98q](https://insights.sbomify.com/GHSA-7cg8-pq9v-x98q/): Sandbox Breakout in realms-shim (not scored)
- [GHSA-74cr-77xc-8g6r](https://insights.sbomify.com/GHSA-74cr-77xc-8g6r/): Prototype Pollution in @apollo/gateway (not scored)
- [GHSA-74cp-qw7f-7hpw](https://insights.sbomify.com/GHSA-74cp-qw7f-7hpw/): Path Traversal in statics-server (not scored)
- [GHSA-73cw-jxmm-qpgh](https://insights.sbomify.com/GHSA-73cw-jxmm-qpgh/): Path Traversal in localhost-now (not scored)
- [GHSA-6qqf-vvcr-7qrv](https://insights.sbomify.com/GHSA-6qqf-vvcr-7qrv/): Cryptographically Weak PRNG in generate-password (not scored)
- [GHSA-6qh5-wx38-q92g](https://insights.sbomify.com/GHSA-6qh5-wx38-q92g/): Directory Traversal in ltt.js (not scored)
- [GHSA-6jg8-7333-554w](https://insights.sbomify.com/GHSA-6jg8-7333-554w/): Sandbox Breakout in realms-shim (not scored)
- [GHSA-68gr-cmcp-g3mj](https://insights.sbomify.com/GHSA-68gr-cmcp-g3mj/): Directory Traversal in lactate (not scored)
- [GHSA-67cx-rhhq-mfhq](https://insights.sbomify.com/GHSA-67cx-rhhq-mfhq/): High severity vulnerability that affects indico (not scored)
- [GHSA-65p8-3hm4-h9h8](https://insights.sbomify.com/GHSA-65p8-3hm4-h9h8/): Denial of Service in rgb2hex (not scored)
- [GHSA-6394-6h9h-cfjg](https://insights.sbomify.com/GHSA-6394-6h9h-cfjg/): Regular Expression Denial of Service (not scored)
- [GHSA-5w65-6875-rhq8](https://insights.sbomify.com/GHSA-5w65-6875-rhq8/): Undefined Behavior in sailsjs-cacheman (not scored)
- [GHSA-5v72-xg48-5rpm](https://insights.sbomify.com/GHSA-5v72-xg48-5rpm/): Denial of Service in ws (not scored)
- [GHSA-5f7m-mmpc-qhh4](https://insights.sbomify.com/GHSA-5f7m-mmpc-qhh4/): mysql Node.JS Module Vulnerable to Remote Memory Exposure (not scored)
- [GHSA-57cf-349j-352g](https://insights.sbomify.com/GHSA-57cf-349j-352g/): Out-of-bounds Read in npmconf (not scored)
- [GHSA-4xcv-9jjx-gfj3](https://insights.sbomify.com/GHSA-4xcv-9jjx-gfj3/): Denial of Service in mem (not scored)
- [GHSA-4vr3-9v7h-5f8v](https://insights.sbomify.com/GHSA-4vr3-9v7h-5f8v/): Low severity vulnerability that affects Gw2Sharp (not scored)
- [GHSA-4vmm-mhcq-4x9j](https://insights.sbomify.com/GHSA-4vmm-mhcq-4x9j/): Sandbox Bypass Leading to Arbitrary Code Execution in constantinople (not scored)
- [GHSA-4qhx-g9wp-g9m6](https://insights.sbomify.com/GHSA-4qhx-g9wp-g9m6/): Failure to sanitize quotes which can lead to sql injection in squel (not scored)
- [GHSA-4j6x-w426-6rc6](https://insights.sbomify.com/GHSA-4j6x-w426-6rc6/): Default Express middleware security check is ignored in production (not scored)
- [GHSA-49r3-3h96-rwj6](https://insights.sbomify.com/GHSA-49r3-3h96-rwj6/): Cross-Site Scripting in ids-enterprise (not scored)
- [GHSA-4859-gpc7-4j66](https://insights.sbomify.com/GHSA-4859-gpc7-4j66/): Command Injection in dot (not scored)
- [GHSA-3xc7-xg67-pw99](https://insights.sbomify.com/GHSA-3xc7-xg67-pw99/): Sensitive Data Exposure in sequelize-cli (not scored)
- [GHSA-3p92-886g-qxpq](https://insights.sbomify.com/GHSA-3p92-886g-qxpq/): Remote Memory Exposure in floody (not scored)
- [GHSA-2xv3-h762-ccxv](https://insights.sbomify.com/GHSA-2xv3-h762-ccxv/): Out-of-bounds Read in concat-with-sourcemaps (not scored)
- [GHSA-2pr6-76vf-7546](https://insights.sbomify.com/GHSA-2pr6-76vf-7546/): Denial of Service in js-yaml (not scored)
- [GHSA-2hwp-g4g7-mwwj](https://insights.sbomify.com/GHSA-2hwp-g4g7-mwwj/): Reflected Cross-Site Scripting in jquery.terminal (not scored)
- [GHSA-28xh-wpgr-7fm8](https://insights.sbomify.com/GHSA-28xh-wpgr-7fm8/): Command Injection in open (not scored)
- [GHSA-28hp-fgcr-2r4h](https://insights.sbomify.com/GHSA-28hp-fgcr-2r4h/): Cross-Site Scripting via JSONP (not scored)
- [GHSA-27v7-qhfv-rqq8](https://insights.sbomify.com/GHSA-27v7-qhfv-rqq8/): Insecure Credential Storage in web3 (not scored)
- [DRUPAL-CORE-2019-012](https://insights.sbomify.com/DRUPAL-CORE-2019-012/): The Drupal project uses the third-party library [Archive\_Tar](https://pear.php.net/package/Archive_Tar/), which has released a security imp (not scored)
- [DRUPAL-CORE-2019-011](https://insights.sbomify.com/DRUPAL-CORE-2019-011/): The Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in certain configurations. (not scored)
- [DRUPAL-CORE-2019-010](https://insights.sbomify.com/DRUPAL-CORE-2019-010/): Drupal 8 core's `file_save_upload()` function does not strip the leading and trailing dot ('.') from filenames, like Drupal 7 did. (not scored)
- [DRUPAL-CORE-2019-009](https://insights.sbomify.com/DRUPAL-CORE-2019-009/): A visit to `install.php` can cause cached data to become corrupted. (not scored)
- [DRUPAL-CORE-2019-005](https://insights.sbomify.com/DRUPAL-CORE-2019-005/): This security release fixes third-party dependencies included in or required by Drupal core. (not scored)
- [DRUPAL-CONTRIB-2019-095](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-095/): The Permissions by Term module extends Drupal by functionality for restricting access to single nodes via taxonomy terms. (not scored)
- [DRUPAL-CONTRIB-2019-094](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-094/): This project enables administrators to create modal dialogs. (not scored)
- [DRUPAL-CONTRIB-2019-093](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-093/): This module extends access handling of Drupal Core's Taxonomy module. (not scored)
- [DRUPAL-CONTRIB-2019-092](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-092/): The Smart Trim module allows site builders additional control with text summary fields. (not scored)
- [DRUPAL-CONTRIB-2019-089](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-089/): The security team is marking this project unsupported. (not scored)
- [DRUPAL-CONTRIB-2019-088](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-088/): **Update:** This module had an access bypass vulnerability which has now been addressed by the module’s current maintainers. (not scored)
- [DRUPAL-CONTRIB-2019-081](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-081/): The security team is marking this project unsupported. (not scored)
- [DRUPAL-CONTRIB-2019-078](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-078/): The security team is marking this project unsupported. (not scored)
- [DRUPAL-CONTRIB-2019-074](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-074/): The Bat module provides a foundation through which a wide range of availability management, reservation and booking use cases can be addressed. (not scored)
- [DRUPAL-CONTRIB-2019-071](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-071/): This module allows display of a site's content in AMP format. (not scored)
- [DRUPAL-CONTRIB-2019-069](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-069/): This module provides a new UI experience for node editing - Gutenberg editor. (not scored)
- [DRUPAL-CONTRIB-2019-068](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-068/): This module enables you to control access to content based on taxonomy terms. (not scored)
- [DRUPAL-CONTRIB-2019-067](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-067/): This module allows you to attach tabular data to an entity. (not scored)
- [DRUPAL-CONTRIB-2019-066](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-066/): This module enables you to have a separate permission only for creating users. (not scored)
- [DRUPAL-CONTRIB-2019-065](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-065/): This module that allows you to store external images on your server and apply your own Image Styles. (not scored)
- [DRUPAL-CONTRIB-2019-064](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-064/): Forms Steps provides an UI to create form workflows using form modes. (not scored)
- [DRUPAL-CONTRIB-2019-063](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-063/): The External Link Filter module provides an input filter that replaces external links by a local link that redirects to the target URL. (not scored)
- [DRUPAL-CONTRIB-2019-062](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-062/): This module improves the Drupal login page with the new features and layout. (not scored)
- [DRUPAL-CONTRIB-2019-060](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-060/): This module provides an autocomplete widget for text fields that suggests all existing (previously entered) values for that field. (not scored)
- [DRUPAL-CONTRIB-2019-058](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-058/): This module enables you to customize meta tags to help with a site's search engine ranking and improve the display of page summaries when sh (not scored)
- [DRUPAL-CONTRIB-2019-055](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-055/): This module enables you to add and manage additional custom permissions through the administration UI. (not scored)
- [DRUPAL-CONTRIB-2019-050](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-050/): This module enables you to handle fields for Custom Menu Links. (not scored)
- [DRUPAL-CONTRIB-2019-048](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-048/): This module enables you to use special routes for user registration with special roles and custom field sets defined for the role. (not scored)
- [DRUPAL-CONTRIB-2019-047](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-047/): In certain configuration cases, when a learning path is configured as semi-private, anonymous users are allowed to join a learning path when they should not. (not scored)
- [DRUPAL-CONTRIB-2019-046](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-046/): In certain circumstances it is possible that certain forum information is available to unprivileged users because the access check is done w (not scored)
- [DRUPAL-CONTRIB-2019-039](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-039/): This module enables you to add social media share buttons on your website to its content and pages. (not scored)
- [DRUPAL-CONTRIB-2019-033](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-033/): This module addresses the General Data Protection Regulation (GDPR) that came into effect 25th May 2018, and the EU Directive on Privacy and (not scored)
- [DRUPAL-CONTRIB-2019-030](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-030/): This module enables you to create facet-filters for results of a search query and exposes them as blocks The module doesn't sufficiently esc (not scored)
- [DRUPAL-CONTRIB-2019-025](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-025/): This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module. (not scored)
- [DRUPAL-CONTRIB-2019-024](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-024/): This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module. (not scored)
- [DRUPAL-CONTRIB-2019-023](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-023/): This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module. (not scored)
- [DRUPAL-CONTRIB-2019-022](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-022/): This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module. (not scored)
- [DRUPAL-CONTRIB-2019-021](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-021/): This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module. (not scored)
- [DRUPAL-CONTRIB-2019-019](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-019/): This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module. (not scored)
- [DRUPAL-CONTRIB-2019-014](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-014/): Acquia Connector facilitates sending certain telemetry data to Acquia for the purposes of analysis. (not scored)
- [DRUPAL-CONTRIB-2019-013](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-013/): This module provides a field on user profiles which allows users to get a notification when their account logs in to the site. (not scored)
- [DRUPAL-CONTRIB-2019-010](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-010/): Anti-spam module by CleanTalk to protect your Drupal sites from spambot registration and spam comments publications thru comment and contact forms. (not scored)
- [DRUPAL-CONTRIB-2019-004](https://insights.sbomify.com/DRUPAL-CONTRIB-2019-004/): The Preview Link module enables you to generate preview links so anonymous users can access unpublished revisions of content. (not scored)
- [CVE-2019-9978](https://insights.sbomify.com/CVE-2019-9978/): WordPress Social Warfare Plugin Cross-Site Scripting (XSS) (medium 6.1, exploited in the wild)
- [CVE-2019-9977](https://insights.sbomify.com/CVE-2019-9977/): Code injection in n/a (high 8.8)
- [CVE-2019-9976](https://insights.sbomify.com/CVE-2019-9976/): Information disclosure in n/a (high 8.8)
- [CVE-2019-9975](https://insights.sbomify.com/CVE-2019-9975/): Hardcoded credentials in n/a (high 7.5)
- [CVE-2019-9974](https://insights.sbomify.com/CVE-2019-9974/): Missing authorization in n/a (critical 9.1)
- [CVE-2019-9972](https://insights.sbomify.com/CVE-2019-9972/): Command injection in n/a (high 8.8)
- [CVE-2019-9971](https://insights.sbomify.com/CVE-2019-9971/): Privilege escalation in n/a (high 8.8)
- [CVE-2019-9970](https://insights.sbomify.com/CVE-2019-9970/): Other in n/a (medium 6.5)
- [CVE-2019-9969](https://insights.sbomify.com/CVE-2019-9969/): Memory corruption in n/a (high 7.8)
- [CVE-2019-9968](https://insights.sbomify.com/CVE-2019-9968/): Memory corruption in n/a (high 7.8)
- [CVE-2019-9967](https://insights.sbomify.com/CVE-2019-9967/): Denial of service in n/a (high 7.8)
- [CVE-2019-9966](https://insights.sbomify.com/CVE-2019-9966/): Memory corruption in n/a (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/2/