# Vulnerabilities published in 2019


- [CVE-2019-6578](https://insights.sbomify.com/CVE-2019-6578/): Denial of service in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (high 7.5)
- [CVE-2019-6577](https://insights.sbomify.com/CVE-2019-6577/): Cross-site scripting in SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (medium 5.4)
- [CVE-2019-6576](https://insights.sbomify.com/CVE-2019-6576/): Weak cryptography in SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (medium 6.5)
- [CVE-2019-6575](https://insights.sbomify.com/CVE-2019-6575/): Denial of service in SIMATIC CP 443-1 OPC UA (high 7.5)
- [CVE-2019-6574](https://insights.sbomify.com/CVE-2019-6574/): Denial of service in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (high 7.5)
- [CVE-2019-6572](https://insights.sbomify.com/CVE-2019-6572/): Hardcoded credentials in SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (critical 9.1)
- [CVE-2019-6571](https://insights.sbomify.com/CVE-2019-6571/): Denial of service in SIEMENS LOGO!8 (high 7.5)
- [CVE-2019-6570](https://insights.sbomify.com/CVE-2019-6570/): Missing authorization in SINEMA Remote Connect Server (high 8.8)
- [CVE-2019-6569](https://insights.sbomify.com/CVE-2019-6569/): Other in SCALANCE X204-2 (critical 9.1)
- [CVE-2019-6568](https://insights.sbomify.com/CVE-2019-6568/): Denial of service in SIMATIC CP 1604 (high 7.5)
- [CVE-2019-6567](https://insights.sbomify.com/CVE-2019-6567/): Information disclosure in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (medium 5.5)
- [CVE-2019-6566](https://insights.sbomify.com/CVE-2019-6566/): Privilege escalation in GE Communicator (high 7.8)
- [CVE-2019-6565](https://insights.sbomify.com/CVE-2019-6565/): Cross-site scripting in Moxa IKS, EDS (medium 6.1)
- [CVE-2019-6564](https://insights.sbomify.com/CVE-2019-6564/): Privilege escalation in GE Communicator (high 7.8)
- [CVE-2019-6563](https://insights.sbomify.com/CVE-2019-6563/): Weak cryptography in Moxa IKS, EDS (critical 9.8)
- [CVE-2019-6562](https://insights.sbomify.com/CVE-2019-6562/): Cross-site scripting in Philips Tasy EMR (medium 5.4)
- [CVE-2019-6561](https://insights.sbomify.com/CVE-2019-6561/): Cross-site request forgery in Moxa IKS, EDS (high 8.8)
- [CVE-2019-6560](https://insights.sbomify.com/CVE-2019-6560/): Auth bypass in Auto-Maskin RP210E Versions 3.7 and prior DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App) (critical 9.1)
- [CVE-2019-6559](https://insights.sbomify.com/CVE-2019-6559/): Denial of service in Moxa IKS, EDS (medium 6.5)
- [CVE-2019-6558](https://insights.sbomify.com/CVE-2019-6558/): Auth bypass in Auto-Maskin RP210E Versions 3.7 and prior DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App) (high 7.5)
- [CVE-2019-6557](https://insights.sbomify.com/CVE-2019-6557/): Memory corruption in Moxa IKS, EDS (critical 9.8)
- [CVE-2019-6556](https://insights.sbomify.com/CVE-2019-6556/): Use after free in CX-Programmer within CX-One (medium 6.6)
- [CVE-2019-6555](https://insights.sbomify.com/CVE-2019-6555/): Other in Cscape (high 7.8)
- [CVE-2019-6554](https://insights.sbomify.com/CVE-2019-6554/): Missing authorization in WebAccess/SCADA (high 7.5)
- [CVE-2019-6553](https://insights.sbomify.com/CVE-2019-6553/): Memory corruption in RSLinx Classic (critical 9.8)
- [CVE-2019-6552](https://insights.sbomify.com/CVE-2019-6552/): Command injection in WebAccess/SCADA (critical 9.8)
- [CVE-2019-6551](https://insights.sbomify.com/CVE-2019-6551/): Auth bypass in Pangea Communications Internet FAX ATA (high 7.5)
- [CVE-2019-6550](https://insights.sbomify.com/CVE-2019-6550/): Memory corruption in WebAccess/SCADA (critical 9.8)
- [CVE-2019-6549](https://insights.sbomify.com/CVE-2019-6549/): Information disclosure in PR100088 Modbus gateway (high 7.2)
- [CVE-2019-6548](https://insights.sbomify.com/CVE-2019-6548/): Hardcoded credentials in GE Communicator (critical 9.8)
- [CVE-2019-6547](https://insights.sbomify.com/CVE-2019-6547/): Memory corruption in Delta Industrial Automation CNCSoft (medium 5.5)
- [CVE-2019-6546](https://insights.sbomify.com/CVE-2019-6546/): Path traversal in GE Communicator (high 7.8)
- [CVE-2019-6545](https://insights.sbomify.com/CVE-2019-6545/): Code injection in AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update (high 7.5)
- [CVE-2019-6544](https://insights.sbomify.com/CVE-2019-6544/): Privilege escalation in GE Communicator (medium 5.6)
- [CVE-2019-6543](https://insights.sbomify.com/CVE-2019-6543/): Missing authorization in AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update (critical 9.8)
- [CVE-2019-6542](https://insights.sbomify.com/CVE-2019-6542/): Missing authorization in Datagate MK2 (high 7.5)
- [CVE-2019-6541](https://insights.sbomify.com/CVE-2019-6541/): Memory corruption in WECON LeviStudioU (high 7.8)
- [CVE-2019-6540](https://insights.sbomify.com/CVE-2019-6540/): Medtronic Conexus Radio Frequency Telemetry Protocol Cleartext Transmission of Sensitive Information (medium 6.5)
- [CVE-2019-6539](https://insights.sbomify.com/CVE-2019-6539/): Memory corruption in WECON LeviStudioU (high 7.8)
- [CVE-2019-6538](https://insights.sbomify.com/CVE-2019-6538/): Medtronic Conexus Radio Frequency Telemetry Protocol Improper Access Control (critical 9.3)
- [CVE-2019-6537](https://insights.sbomify.com/CVE-2019-6537/): Memory corruption in WECON LeviStudioU (high 7.8)
- [CVE-2019-6536](https://insights.sbomify.com/CVE-2019-6536/): Memory corruption in LAquis SCADA (high 7.8)
- [CVE-2019-6535](https://insights.sbomify.com/CVE-2019-6535/): Mitsubishi Electric MELSEC-Q Series PLCs Resource Exhaustion (high 7.5)
- [CVE-2019-6534](https://insights.sbomify.com/CVE-2019-6534/): Other in Sentinel UltraPro (high 7.8)
- [CVE-2019-6533](https://insights.sbomify.com/CVE-2019-6533/): Missing authorization in PR100088 Modbus gateway (critical 9.1)
- [CVE-2019-6532](https://insights.sbomify.com/CVE-2019-6532/): Code injection in FPWIN Pro (high 7.8)
- [CVE-2019-6531](https://insights.sbomify.com/CVE-2019-6531/): Information disclosure in PR100088 Modbus gateway (high 8.1)
- [CVE-2019-6530](https://insights.sbomify.com/CVE-2019-6530/): Memory corruption in FPWIN Pro (high 7.8)
- [CVE-2019-6529](https://insights.sbomify.com/CVE-2019-6529/): Denial of service in PR100088 Modbus gateway (medium 4.9)
- [CVE-2019-6528](https://insights.sbomify.com/CVE-2019-6528/): Cross-site scripting in PSI GridConnect GmbH (formerly known as PSI Nentec GmbH) Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy. (high 8.8)
- [CVE-2019-6527](https://insights.sbomify.com/CVE-2019-6527/): Auth bypass in PR100088 Modbus gateway (critical 9.8)
- [CVE-2019-6526](https://insights.sbomify.com/CVE-2019-6526/): Information disclosure in IKS, EDS (critical 9.8)
- [CVE-2019-6525](https://insights.sbomify.com/CVE-2019-6525/): Information disclosure in Wonderware System Platform (high 8.8)
- [CVE-2019-6524](https://insights.sbomify.com/CVE-2019-6524/): Auth bypass in Moxa IKS, EDS (critical 9.8)
- [CVE-2019-6523](https://insights.sbomify.com/CVE-2019-6523/): SQL injection in n/a (critical 9.8)
- [CVE-2019-6522](https://insights.sbomify.com/CVE-2019-6522/): Information disclosure in Moxa IKS, EDS (critical 9.1)
- [CVE-2019-6521](https://insights.sbomify.com/CVE-2019-6521/): Auth bypass in n/a (high 8.6)
- [CVE-2019-6520](https://insights.sbomify.com/CVE-2019-6520/): Missing authorization in Moxa IKS, EDS (high 7.5)
- [CVE-2019-6519](https://insights.sbomify.com/CVE-2019-6519/): Auth bypass in n/a (critical 9.8)
- [CVE-2019-6518](https://insights.sbomify.com/CVE-2019-6518/): Information disclosure in Moxa IKS, EDS (high 7.5)
- [CVE-2019-6517](https://insights.sbomify.com/CVE-2019-6517/): Missing authorization in BD FACSLyric (medium 6.8)
- [CVE-2019-6516](https://insights.sbomify.com/CVE-2019-6516/): Server-side request forgery in n/a (medium 5.8)
- [CVE-2019-6515](https://insights.sbomify.com/CVE-2019-6515/): Missing authorization in n/a (medium 5.3)
- [CVE-2019-6514](https://insights.sbomify.com/CVE-2019-6514/): Cross-site scripting in n/a (medium 4.8)
- [CVE-2019-6513](https://insights.sbomify.com/CVE-2019-6513/): File upload in n/a (medium 5.4)
- [CVE-2019-6512](https://insights.sbomify.com/CVE-2019-6512/): Server-side request forgery in n/a (medium 4.1)
- [CVE-2019-6510](https://insights.sbomify.com/CVE-2019-6510/): Cross-site request forgery in n/a (high 8.8)
- [CVE-2019-6509](https://insights.sbomify.com/CVE-2019-6509/): Cross-site request forgery in n/a (high 8.8)
- [CVE-2019-6508](https://insights.sbomify.com/CVE-2019-6508/): Cross-site request forgery in n/a (high 8.8)
- [CVE-2019-6507](https://insights.sbomify.com/CVE-2019-6507/): Cross-site request forgery in n/a (high 8.8)
- [CVE-2019-6506](https://insights.sbomify.com/CVE-2019-6506/): SQL injection in n/a (critical 9.8)
- [CVE-2019-6504](https://insights.sbomify.com/CVE-2019-6504/): Cross-site scripting in CA Automic Workload Automation (medium 6.1)
- [CVE-2019-6503](https://insights.sbomify.com/CVE-2019-6503/): Deserialization in n/a (critical 9.8)
- [CVE-2019-6502](https://insights.sbomify.com/CVE-2019-6502/): Denial of service in n/a (high 7.5)
- [CVE-2019-6501](https://insights.sbomify.com/CVE-2019-6501/): Memory corruption in n/a (medium 5.5)
- [CVE-2019-6500](https://insights.sbomify.com/CVE-2019-6500/): Path traversal in n/a (high 7.5)
- [CVE-2019-6499](https://insights.sbomify.com/CVE-2019-6499/): Hardcoded credentials in n/a (high 8.1)
- [CVE-2019-6498](https://insights.sbomify.com/CVE-2019-6498/): Memory corruption in n/a (high 8.8)
- [CVE-2019-6497](https://insights.sbomify.com/CVE-2019-6497/): SQL injection in n/a (critical 9.8)
- [CVE-2019-6496](https://insights.sbomify.com/CVE-2019-6496/): Memory corruption in n/a (high 8.8)
- [CVE-2019-6494](https://insights.sbomify.com/CVE-2019-6494/): Missing authorization in n/a (medium 6.5)
- [CVE-2019-6493](https://insights.sbomify.com/CVE-2019-6493/): Information disclosure in n/a (medium 5.5)
- [CVE-2019-6492](https://insights.sbomify.com/CVE-2019-6492/): Information disclosure in n/a (medium 5.5)
- [CVE-2019-6491](https://insights.sbomify.com/CVE-2019-6491/): SQL injection in n/a (high 8.8)
- [CVE-2019-6489](https://insights.sbomify.com/CVE-2019-6489/): Missing authorization in n/a (medium 5.3)
- [CVE-2019-6488](https://insights.sbomify.com/CVE-2019-6488/): Denial of service in n/a (high 7.8)
- [CVE-2019-6487](https://insights.sbomify.com/CVE-2019-6487/): Command injection in n/a (high 8.8)
- [CVE-2019-6486](https://insights.sbomify.com/CVE-2019-6486/): Denial of service in n/a (high 8.2)
- [CVE-2019-6485](https://insights.sbomify.com/CVE-2019-6485/): Information disclosure in n/a (medium 5.9)
- [CVE-2019-6481](https://insights.sbomify.com/CVE-2019-6481/): Auth bypass in n/a (high 7.5)
- [CVE-2019-6477](https://insights.sbomify.com/CVE-2019-6477/): TCP-pipelined queries can bypass tcp-clients limit (high 7.5)
- [CVE-2019-6476](https://insights.sbomify.com/CVE-2019-6476/): An error in QNAME minimization code can cause BIND to exit with an assertion failure (medium 5.9)
- [CVE-2019-6475](https://insights.sbomify.com/CVE-2019-6475/): A flaw in mirror zone validity checking can allow zone data to be spoofed (medium 5.9)
- [CVE-2019-6474](https://insights.sbomify.com/CVE-2019-6474/): A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate (medium 5.7)
- [CVE-2019-6473](https://insights.sbomify.com/CVE-2019-6473/): A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate (medium 6.5)
- [CVE-2019-6472](https://insights.sbomify.com/CVE-2019-6472/): A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate (medium 6.5)
- [CVE-2019-6471](https://insights.sbomify.com/CVE-2019-6471/): A race condition when discarding malformed packets can cause BIND to exit with an assertion failure (medium 5.9)
- [CVE-2019-6470](https://insights.sbomify.com/CVE-2019-6470/): dhcpd: use-after-free error leads crash in IPv6 mode when using mismatched BIND libraries (medium 6.5)
- [CVE-2019-6469](https://insights.sbomify.com/CVE-2019-6469/): BIND Supported Preview Edition can exit with an assertion failure if ECS is in use (medium 5.9)
- [CVE-2019-6468](https://insights.sbomify.com/CVE-2019-6468/): BIND Supported Preview Edition can exit with an assertion failure if nxdomain-redirect is used (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/30/