# Vulnerabilities published in 2019 - [CVE-2019-7000](https://insights.sbomify.com/CVE-2019-7000/): Avaya Aura Conferencing XSS (medium 5.9) - [CVE-2019-6997](https://insights.sbomify.com/CVE-2019-6997/): Missing authorization in n/a (medium 4.3) - [CVE-2019-6996](https://insights.sbomify.com/CVE-2019-6996/): Missing authorization in n/a (medium 4.3) - [CVE-2019-6995](https://insights.sbomify.com/CVE-2019-6995/): Missing authorization in n/a (medium 6.5) - [CVE-2019-6992](https://insights.sbomify.com/CVE-2019-6992/): Cross-site scripting in n/a (medium 6.1) - [CVE-2019-6991](https://insights.sbomify.com/CVE-2019-6991/): Memory corruption in n/a (critical 9.8) - [CVE-2019-6990](https://insights.sbomify.com/CVE-2019-6990/): Cross-site scripting in n/a (medium 5.4) - [CVE-2019-6989](https://insights.sbomify.com/CVE-2019-6989/): Memory corruption in n/a (high 8.8) - [CVE-2019-6988](https://insights.sbomify.com/CVE-2019-6988/): Denial of service in n/a (medium 6.5) - [CVE-2019-6986](https://insights.sbomify.com/CVE-2019-6986/): Command Injection in VIVO Vitro (high 7.5) - [CVE-2019-6985](https://insights.sbomify.com/CVE-2019-6985/): Memory corruption in n/a (high 8.8) - [CVE-2019-6984](https://insights.sbomify.com/CVE-2019-6984/): Use after free in n/a (medium 6.5) - [CVE-2019-6983](https://insights.sbomify.com/CVE-2019-6983/): Integer overflow in n/a (medium 6.5) - [CVE-2019-6982](https://insights.sbomify.com/CVE-2019-6982/): Memory corruption in n/a (medium 5.5) - [CVE-2019-6981](https://insights.sbomify.com/CVE-2019-6981/): Server-side request forgery in n/a (medium 6.5) - [CVE-2019-6980](https://insights.sbomify.com/CVE-2019-6980/): Deserialization in n/a (critical 9.8) - [CVE-2019-6979](https://insights.sbomify.com/CVE-2019-6979/): Cross-site scripting in n/a (medium 6.1) - [CVE-2019-6978](https://insights.sbomify.com/CVE-2019-6978/): Use after free in n/a (critical 9.8) - [CVE-2019-6977](https://insights.sbomify.com/CVE-2019-6977/): Memory corruption in n/a (high 8.8) - [CVE-2019-6976](https://insights.sbomify.com/CVE-2019-6976/): Information disclosure in n/a (medium 5.3) - [CVE-2019-6975](https://insights.sbomify.com/CVE-2019-6975/): Uncontrolled Memory Consumption in Django (high 7.5) - [CVE-2019-6974](https://insights.sbomify.com/CVE-2019-6974/): Use after free in n/a (high 8.1) - [CVE-2019-6973](https://insights.sbomify.com/CVE-2019-6973/): Denial of service in n/a (high 7.5) - [CVE-2019-6972](https://insights.sbomify.com/CVE-2019-6972/): Weak cryptography in n/a (high 7.5) - [CVE-2019-6971](https://insights.sbomify.com/CVE-2019-6971/): Auth bypass in n/a (critical 9.8) - [CVE-2019-6970](https://insights.sbomify.com/CVE-2019-6970/): Moodle SSRF Vulnerability (high 7.5) - [CVE-2019-6969](https://insights.sbomify.com/CVE-2019-6969/): Auth bypass in n/a (high 7.5) - [CVE-2019-6968](https://insights.sbomify.com/CVE-2019-6968/): Cross-site scripting in n/a (medium 6.1) - [CVE-2019-6967](https://insights.sbomify.com/CVE-2019-6967/): Cross-site request forgery in n/a (high 8.8) - [CVE-2019-6966](https://insights.sbomify.com/CVE-2019-6966/): Denial of service in n/a (medium 6.5) - [CVE-2019-6965](https://insights.sbomify.com/CVE-2019-6965/): Cross-site scripting in n/a (medium 6.1) - [CVE-2019-6964](https://insights.sbomify.com/CVE-2019-6964/): Memory corruption in n/a (high 8.8) - [CVE-2019-6963](https://insights.sbomify.com/CVE-2019-6963/): Memory corruption in n/a (high 8.8) - [CVE-2019-6962](https://insights.sbomify.com/CVE-2019-6962/): Command injection in n/a (high 7.5) - [CVE-2019-6961](https://insights.sbomify.com/CVE-2019-6961/): Missing authorization in n/a (medium 6.5) - [CVE-2019-6960](https://insights.sbomify.com/CVE-2019-6960/): Missing authorization in n/a (critical 9.8) - [CVE-2019-6958](https://insights.sbomify.com/CVE-2019-6958/): Improper Access Control for Bosch Video Systems, PSIM and Access Control Systems (critical 9.8) - [CVE-2019-6957](https://insights.sbomify.com/CVE-2019-6957/): Buffer Overflow for Bosch Video Systems, PSIM and Access Control Systems (critical 9.8) - [CVE-2019-6956](https://insights.sbomify.com/CVE-2019-6956/): Memory corruption in n/a (high 7.1) - [CVE-2019-6859](https://insights.sbomify.com/CVE-2019-6859/): Hardcoded credentials in Modicon Controllers (All versions of the following CPUs and Communication Module product references listed in the Security Notifications) (high 7.5) - [CVE-2019-6858](https://insights.sbomify.com/CVE-2019-6858/): Privilege escalation in MSX Configurator (Software Version prior to V1.0.8.1) (high 7.8) - [CVE-2019-6857](https://insights.sbomify.com/CVE-2019-6857/): Denial of service in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions) (high 7.5) - [CVE-2019-6856](https://insights.sbomify.com/CVE-2019-6856/): Denial of service in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions) (high 7.5) - [CVE-2019-6855](https://insights.sbomify.com/CVE-2019-6855/): Auth bypass in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20) , and Modicon M580 (all versions prior to V3.10) (high 7.3) - [CVE-2019-6854](https://insights.sbomify.com/CVE-2019-6854/): Missing authorization in EcoStruxure Geo SCADA Expert (ClearSCADA) with initial releases before 1 January 2019 (see notification for more details) (high 7.8) - [CVE-2019-6853](https://insights.sbomify.com/CVE-2019-6853/): Cross-site scripting in Andover Continuum models 9680, 5740 and 5720, bCX4040, bCX9640, 9900, 9940, 9924 and 9702 (medium 6.1) - [CVE-2019-6852](https://insights.sbomify.com/CVE-2019-6852/): Hardcoded credentials in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions) (high 7.5) - [CVE-2019-6851](https://insights.sbomify.com/CVE-2019-6851/): Information disclosure in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions) (high 7.5) - [CVE-2019-6850](https://insights.sbomify.com/CVE-2019-6850/): Information disclosure in Modicon M580, Modicon BMENOC 0311, Modicon BMENOC 0321 (high 7.5) - [CVE-2019-6849](https://insights.sbomify.com/CVE-2019-6849/): Information disclosure in Modicon M580, Modicon BMENOC 0311, Modicon BMENOC 0321 (high 7.5) - [CVE-2019-6848](https://insights.sbomify.com/CVE-2019-6848/): Denial of service in Modicon M580 CPU (BMEx58*) and Modicon M580 communication module (BMENOC0311, BMENOC0321) (see notification for version info) (high 8.6) - [CVE-2019-6847](https://insights.sbomify.com/CVE-2019-6847/): Denial of service in Modicon M580, Modicon M340, and Modicon BMxCRA / 140CRA modules (see notification for version info) (medium 4.9) - [CVE-2019-6846](https://insights.sbomify.com/CVE-2019-6846/): Information disclosure in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions) (medium 6.5) - [CVE-2019-6845](https://insights.sbomify.com/CVE-2019-6845/): Information disclosure in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions) (high 7.5) - [CVE-2019-6844](https://insights.sbomify.com/CVE-2019-6844/): Denial of service in Modicon M580, Modicon M340, and Modicon BMxCRA / 140CRA modules (see notification for version info) (medium 4.9) - [CVE-2019-6843](https://insights.sbomify.com/CVE-2019-6843/): Denial of service in Modicon M580, Modicon M340, and Modicon BMxCRA / 140CRA modules (see notification for version info) (medium 4.9) - [CVE-2019-6842](https://insights.sbomify.com/CVE-2019-6842/): Denial of service in Modicon M580, Modicon M340, and Modicon BMxCRA / 140CRA modules (see notification for version info) (medium 4.9) - [CVE-2019-6841](https://insights.sbomify.com/CVE-2019-6841/): Denial of service in Modicon M580, Modicon M340, and Modicon BMxCRA / 140CRA modules (see notification for version info) (medium 4.9) - [CVE-2019-6840](https://insights.sbomify.com/CVE-2019-6840/): Code injection in U.motion Server (critical 9.8) - [CVE-2019-6839](https://insights.sbomify.com/CVE-2019-6839/): File upload in U.motion Servers (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, and MEG6260-0415 - U.motion KNX Server Plus, Touch 1) (high 8.8) - [CVE-2019-6838](https://insights.sbomify.com/CVE-2019-6838/): Missing authorization in U.motion Servers (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, and MEG6260-0415 - U.motion KNX Server Plus, Touch 1) (medium 6.5) - [CVE-2019-6837](https://insights.sbomify.com/CVE-2019-6837/): Server-side request forgery in U.motion Server (critical 9.1) - [CVE-2019-6836](https://insights.sbomify.com/CVE-2019-6836/): Missing authorization in U.motion Servers (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, and MEG6260-0415 - U.motion KNX Server Plus, Touch 1) (high 7.5) - [CVE-2019-6835](https://insights.sbomify.com/CVE-2019-6835/): Cross-site scripting in U.motion Server (medium 5.4) - [CVE-2019-6834](https://insights.sbomify.com/CVE-2019-6834/): Deserialization in Software Update (SESU) – SUT Service component (high 7.3) - [CVE-2019-6833](https://insights.sbomify.com/CVE-2019-6833/): Denial of service in Magelis HMI Panels (medium 6.5) - [CVE-2019-6832](https://insights.sbomify.com/CVE-2019-6832/): Auth bypass in Wiser for KNX (high 8.3) - [CVE-2019-6831](https://insights.sbomify.com/CVE-2019-6831/): Denial of service in BMXNOR0200H Ethernet / Serial RTU module (high 8.6) - [CVE-2019-6830](https://insights.sbomify.com/CVE-2019-6830/): Denial of service in Modicon M580 (medium 5.9) - [CVE-2019-6829](https://insights.sbomify.com/CVE-2019-6829/): Denial of service in Modicon M340 (high 7.5) - [CVE-2019-6828](https://insights.sbomify.com/CVE-2019-6828/): Denial of service in Modicon M340 (high 7.5) - [CVE-2019-6827](https://insights.sbomify.com/CVE-2019-6827/): Memory corruption in Interactive Graphical SCADA System (IGSS) Version 14 and prior (high 7.8) - [CVE-2019-6826](https://insights.sbomify.com/CVE-2019-6826/): Other in SoMachine HVAC (high 7.8) - [CVE-2019-6825](https://insights.sbomify.com/CVE-2019-6825/): Other in ProClima all versions prior to version 8.0.0 (high 7.8) - [CVE-2019-6824](https://insights.sbomify.com/CVE-2019-6824/): Memory corruption in ProClima all versions prior to version 8.0.0 (critical 9.8) - [CVE-2019-6823](https://insights.sbomify.com/CVE-2019-6823/): A CWE-94: Code Injection vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow an unauthenticated, remote (critical 9.8) - [CVE-2019-6822](https://insights.sbomify.com/CVE-2019-6822/): Use after free in Zelio Soft 2 V5.2 and prior (high 7.8) - [CVE-2019-6821](https://insights.sbomify.com/CVE-2019-6821/): Weak cryptography in Modicon Controllers, Modicon M580 firmware versions prior to V2.30, and all firmware versions of Modicon M340, Modicon Premium, Modicon Quantum (medium 6.5) - [CVE-2019-6820](https://insights.sbomify.com/CVE-2019-6820/): Missing authorization in Modicon and PacDrive Controller, All versions of: Modicon M100, Modicon M200, Modicon M221, ATV IMC drive controller, Modicon M241, Modicon M251, Modicon M258, Modicon LMC058, Modicon LMC078, PacDrive Eco ,PacDrive Pro, PacDrive Pro2 (high 8.2) - [CVE-2019-6819](https://insights.sbomify.com/CVE-2019-6819/): Denial of service in Modicon Controllers, Modicon M340 - firmware versions prior to V3.01 Modicon M580 - firmware versions prior to V2.80 All firmware versions of Modicon Quantum and Modicon Premium (high 7.5) - [CVE-2019-6816](https://insights.sbomify.com/CVE-2019-6816/): Code injection in Modicon Quantum - all firmware versions (critical 9.1) - [CVE-2019-6815](https://insights.sbomify.com/CVE-2019-6815/): Missing authorization in Modicon Quantum - all firmware versions (critical 9.1) - [CVE-2019-6814](https://insights.sbomify.com/CVE-2019-6814/): Auth bypass in ÊNET55XX Encoder with firmware prior to version 2.1.9.Ê (critical 9.8) - [CVE-2019-6813](https://insights.sbomify.com/CVE-2019-6813/): Denial of service in BMXNOR0200H Ethernet / Serial RTU module (high 7.5) - [CVE-2019-6812](https://insights.sbomify.com/CVE-2019-6812/): Hardcoded credentials in Modicon RTU Module, BMX-NOR-0200H with firmware versions prior to V1.7 IR 19 (high 7.2) - [CVE-2019-6811](https://insights.sbomify.com/CVE-2019-6811/): Denial of service in Modicon Quantum 140 NOE771x1 (high 7.5) - [CVE-2019-6810](https://insights.sbomify.com/CVE-2019-6810/): Missing authorization in BMXNOR0200H Ethernet / Serial RTU module (high 8.8) - [CVE-2019-6809](https://insights.sbomify.com/CVE-2019-6809/): Denial of service in Modicon M340 (high 7.5) - [CVE-2019-6808](https://insights.sbomify.com/CVE-2019-6808/): Missing authorization in Modicon M580 Modicon M340 Modicon Quantum Modicon Premium (critical 9.8) - [CVE-2019-6807](https://insights.sbomify.com/CVE-2019-6807/): Denial of service in Modicon M580 Modicon M340 Modicon Quantum Modicon Premium (high 7.5) - [CVE-2019-6806](https://insights.sbomify.com/CVE-2019-6806/): Information disclosure in Modicon M580 Modicon M340 Modicon Quantum Modicon Premium (high 7.5) - [CVE-2019-6805](https://insights.sbomify.com/CVE-2019-6805/): SQL injection in n/a (critical 9.8) - [CVE-2019-6804](https://insights.sbomify.com/CVE-2019-6804/): Rundeck Community Edition vulnerable to Cross-site Scripting (medium 6.1) - [CVE-2019-6803](https://insights.sbomify.com/CVE-2019-6803/): Cross-site scripting in n/a (medium 6.1) - [CVE-2019-6802](https://insights.sbomify.com/CVE-2019-6802/): CRLF Injection in pypiserver (medium 6.1) - [CVE-2019-6800](https://insights.sbomify.com/CVE-2019-6800/): Command injection in n/a (high 7.5) - [CVE-2019-6799](https://insights.sbomify.com/CVE-2019-6799/): phpMyAdmin Arbitrary file read vulnerability (medium 5.9) - [CVE-2019-6798](https://insights.sbomify.com/CVE-2019-6798/): phpMyAdmin SQL injection in Designer feature (critical 9.8) - [CVE-2019-6797](https://insights.sbomify.com/CVE-2019-6797/): Information disclosure in n/a (high 7.5) - [CVE-2019-6796](https://insights.sbomify.com/CVE-2019-6796/): Cross-site scripting in n/a (medium 6.1) --- From sbomify Insights: https://insights.sbomify.com/years/2019/page/27/