# Vulnerabilities published in 2019


- [CVE-2019-3819](https://insights.sbomify.com/CVE-2019-3819/): Denial of service in kernel: (medium 4.2)
- [CVE-2019-3818](https://insights.sbomify.com/CVE-2019-3818/): Weak cryptography in kube-rbac-proxy (low 3.7)
- [CVE-2019-3817](https://insights.sbomify.com/CVE-2019-3817/): Use after free in libcomps (high 7.5)
- [CVE-2019-3816](https://insights.sbomify.com/CVE-2019-3816/): Path traversal in openwsman (high 7.5)
- [CVE-2019-3815](https://insights.sbomify.com/CVE-2019-3815/): Denial of service in systemd (low 3.3)
- [CVE-2019-3814](https://insights.sbomify.com/CVE-2019-3814/): Auth bypass in dovecot (high 7.7)
- [CVE-2019-3813](https://insights.sbomify.com/CVE-2019-3813/): Memory corruption in Spice (high 7.5)
- [CVE-2019-3812](https://insights.sbomify.com/CVE-2019-3812/): Memory corruption in qemu (medium 4.4)
- [CVE-2019-3811](https://insights.sbomify.com/CVE-2019-3811/): Security feature bypass in sssd (medium 4.1)
- [CVE-2019-3810](https://insights.sbomify.com/CVE-2019-3810/): Moodle XSS Vulnerability (medium 4.3)
- [CVE-2019-3809](https://insights.sbomify.com/CVE-2019-3809/): Moodle Blind SSRF Risk in /badges/mybackpack.php (medium 6.5)
- [CVE-2019-3808](https://insights.sbomify.com/CVE-2019-3808/): Moodle XSS Vulnerability (medium 4.3)
- [CVE-2019-3807](https://insights.sbomify.com/CVE-2019-3807/): Security feature bypass in pdns-recursor (low 3.7)
- [CVE-2019-3806](https://insights.sbomify.com/CVE-2019-3806/): Security feature bypass in pdns-recursor (medium 5.4)
- [CVE-2019-3805](https://insights.sbomify.com/CVE-2019-3805/): Privilege escalation in wildfly (medium 5.5)
- [CVE-2019-3804](https://insights.sbomify.com/CVE-2019-3804/): Denial of service in cockpit (high 7.5)
- [CVE-2019-3803](https://insights.sbomify.com/CVE-2019-3803/): Concourse includes token in CLI authentication callback (medium 4.5)
- [CVE-2019-3802](https://insights.sbomify.com/CVE-2019-3802/): Additional information exposure with Spring Data JPA example matcher (low 3.5)
- [CVE-2019-3801](https://insights.sbomify.com/CVE-2019-3801/): Java Projects using HTTP to fetch dependencies (high 8.7)
- [CVE-2019-3800](https://insights.sbomify.com/CVE-2019-3800/): CF CLI writes the client id and secret to config file (medium 6.3)
- [CVE-2019-3799](https://insights.sbomify.com/CVE-2019-3799/): Directory Traversal with spring-cloud-config-server (medium 6.5)
- [CVE-2019-3798](https://insights.sbomify.com/CVE-2019-3798/): Escalation of Privileges in Cloud Controller (medium 6.0)
- [CVE-2019-3797](https://insights.sbomify.com/CVE-2019-3797/): Additional information exposure with Spring Data JPA derived queries (low 3.5)
- [CVE-2019-3795](https://insights.sbomify.com/CVE-2019-3795/): Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security (low 3.8)
- [CVE-2019-3794](https://insights.sbomify.com/CVE-2019-3794/): UAA - Login app subject to clickjacking attack (medium 6.5)
- [CVE-2019-3793](https://insights.sbomify.com/CVE-2019-3793/): Invitations Service supports HTTP connections (high 8.1)
- [CVE-2019-3792](https://insights.sbomify.com/CVE-2019-3792/): Concourse 5.0.0 SQL Injection vulnerability (medium 6.8)
- [CVE-2019-3790](https://insights.sbomify.com/CVE-2019-3790/): Ops Manager uaa client issues tokens after refresh token expiration (medium 6.1)
- [CVE-2019-3789](https://insights.sbomify.com/CVE-2019-3789/): Gorouter allows space developer to hijack route services hosted outside the platform (high 8.8)
- [CVE-2019-3788](https://insights.sbomify.com/CVE-2019-3788/): UAA redirect-uri allows wildcard in the subdomain (high 8.7)
- [CVE-2019-3787](https://insights.sbomify.com/CVE-2019-3787/): UAA defaults email address to an insecure domain (high 8.3)
- [CVE-2019-3786](https://insights.sbomify.com/CVE-2019-3786/): BBR could run arbitrary scripts on deployment VMs (high 7.7)
- [CVE-2019-3785](https://insights.sbomify.com/CVE-2019-3785/): Cloud Controller provides signed URL with write authorization to read only user (medium 6.5)
- [CVE-2019-3784](https://insights.sbomify.com/CVE-2019-3784/): Cloud Foundry Stratos contains a Session Collision Vulnerability (high 8.2)
- [CVE-2019-3783](https://insights.sbomify.com/CVE-2019-3783/): Cloud Foundry Stratos Deploys With Public Default Session Store Secret (high 8.7)
- [CVE-2019-3782](https://insights.sbomify.com/CVE-2019-3782/): CredHub CLI writes environment variable credentials to disk (medium 6.3)
- [CVE-2019-3781](https://insights.sbomify.com/CVE-2019-3781/): CF CLI does not sanitize user's password in verbose/trace/debug (high 8.2)
- [CVE-2019-3780](https://insights.sbomify.com/CVE-2019-3780/): Cloud Foundry Container Runtime Leaks IAAS Credentials (critical 9.1)
- [CVE-2019-3779](https://insights.sbomify.com/CVE-2019-3779/): Cloud Foundry Container Runtime allows a user to bypass security policy when talking to ETCD (high 8.8)
- [CVE-2019-3778](https://insights.sbomify.com/CVE-2019-3778/): Open Redirect in spring-security-oauth2 (medium 6.5)
- [CVE-2019-3777](https://insights.sbomify.com/CVE-2019-3777/): Apps Manager unverified SSL certs in Cloud Controller proxy (high 8.0)
- [CVE-2019-3776](https://insights.sbomify.com/CVE-2019-3776/): Reflected XSS in Pivotal Operations Manager (high 7.2)
- [CVE-2019-3775](https://insights.sbomify.com/CVE-2019-3775/): UAA allows users to modify their own email address (high 7.1)
- [CVE-2019-3774](https://insights.sbomify.com/CVE-2019-3774/): Spring Batch XML External Entity Injection (XXE) (critical 9.8)
- [CVE-2019-3773](https://insights.sbomify.com/CVE-2019-3773/): Spring Web Services XML External Entity Injection (XXE) (critical 9.8)
- [CVE-2019-3772](https://insights.sbomify.com/CVE-2019-3772/): Spring Integration XML External Entity Injection (XXE) (critical 9.8)
- [CVE-2019-3770](https://insights.sbomify.com/CVE-2019-3770/): Cross-site scripting in Wyse Management Suite (medium 6.4)
- [CVE-2019-3769](https://insights.sbomify.com/CVE-2019-3769/): Cross-site scripting in Wyse Management Suite (medium 6.4)
- [CVE-2019-3768](https://insights.sbomify.com/CVE-2019-3768/): XML external entity in RSA Authentication Manager (medium 6.5)
- [CVE-2019-3767](https://insights.sbomify.com/CVE-2019-3767/): Information disclosure in ImageAssist (high 7.5)
- [CVE-2019-3766](https://insights.sbomify.com/CVE-2019-3766/): Auth bypass in Elastic Cloud Storage (high 8.1)
- [CVE-2019-3765](https://insights.sbomify.com/CVE-2019-3765/): Misconfiguration in Avamar (high 8.1)
- [CVE-2019-3764](https://insights.sbomify.com/CVE-2019-3764/): Missing authorization in Integrated Dell Remote Access Controller (iDRAC) (medium 5.0)
- [CVE-2019-3763](https://insights.sbomify.com/CVE-2019-3763/): Information disclosure in RSA Identity Governance and Lifecycle (high 8.8)
- [CVE-2019-3762](https://insights.sbomify.com/CVE-2019-3762/): Security feature bypass in Data Protection Central (high 7.5)
- [CVE-2019-3761](https://insights.sbomify.com/CVE-2019-3761/): Cross-site scripting in RSA Identity Governance and Lifecycle (medium 5.4)
- [CVE-2019-3760](https://insights.sbomify.com/CVE-2019-3760/): SQL injection in RSA Identity Governance and Lifecycle (medium 6.4)
- [CVE-2019-3759](https://insights.sbomify.com/CVE-2019-3759/): Code injection in RSA Identity Governance and Lifecycle (medium 6.4)
- [CVE-2019-3758](https://insights.sbomify.com/CVE-2019-3758/): Auth bypass in RSA Archer (high 8.1)
- [CVE-2019-3756](https://insights.sbomify.com/CVE-2019-3756/): Information disclosure in RSA Archer (medium 6.5)
- [CVE-2019-3754](https://insights.sbomify.com/CVE-2019-3754/): Cross-site scripting in Unity Operating Environment (medium 4.7)
- [CVE-2019-3753](https://insights.sbomify.com/CVE-2019-3753/): Information disclosure in PowerConnect M8024-K (high 7.2)
- [CVE-2019-3752](https://insights.sbomify.com/CVE-2019-3752/): XML external entity in Avamar (high 8.2)
- [CVE-2019-3751](https://insights.sbomify.com/CVE-2019-3751/): Weak cryptography in Dell EMC Enterprise Copy Data Management (eCDM) (medium 6.4)
- [CVE-2019-3750](https://insights.sbomify.com/CVE-2019-3750/): Other in Dell Command Update (DCU) (medium 5.6)
- [CVE-2019-3749](https://insights.sbomify.com/CVE-2019-3749/): Path traversal in Dell Command Update (DCU) (medium 5.6)
- [CVE-2019-3747](https://insights.sbomify.com/CVE-2019-3747/): Cross-site scripting in Integrated Data Protection Appliance (high 8.4)
- [CVE-2019-3746](https://insights.sbomify.com/CVE-2019-3746/): Auth bypass in Integrated Data Protection Appliance (critical 9.8)
- [CVE-2019-3745](https://insights.sbomify.com/CVE-2019-3745/): Privilege escalation in Dell Encryption Enterprise (medium 6.7)
- [CVE-2019-3744](https://insights.sbomify.com/CVE-2019-3744/): Race condition in Alienware Digital Delivery (high 7.8)
- [CVE-2019-3742](https://insights.sbomify.com/CVE-2019-3742/): Deserialization in Alienware Digital Delivery (high 7.8)
- [CVE-2019-3741](https://insights.sbomify.com/CVE-2019-3741/): Information disclosure in Unity (high 7.8)
- [CVE-2019-3740](https://insights.sbomify.com/CVE-2019-3740/): Weak cryptography in RSA BSAFE Crypto-J (medium 6.5)
- [CVE-2019-3739](https://insights.sbomify.com/CVE-2019-3739/): Weak cryptography in RSA BSAFE Crypto-J (medium 6.5)
- [CVE-2019-3738](https://insights.sbomify.com/CVE-2019-3738/): Weak cryptography in RSA BSAFE Crypto-J (medium 6.5)
- [CVE-2019-3737](https://insights.sbomify.com/CVE-2019-3737/): Dell EMC Avamar Security Update for ADMe Web UI Vulnerability (high 8.6)
- [CVE-2019-3736](https://insights.sbomify.com/CVE-2019-3736/): Weak cryptography in Integrated Data Protection Appliance (high 8.2)
- [CVE-2019-3735](https://insights.sbomify.com/CVE-2019-3735/): Privilege escalation in Dell SupportAssist for Business PCs (high 7.0)
- [CVE-2019-3734](https://insights.sbomify.com/CVE-2019-3734/): Missing authorization in Unity (medium 5.4)
- [CVE-2019-3733](https://insights.sbomify.com/CVE-2019-3733/): Information disclosure in RSA BSAFE Crypto-C Micro Edition (medium 4.4)
- [CVE-2019-3732](https://insights.sbomify.com/CVE-2019-3732/): Weak cryptography in RSA BSAFE Crypto-C Micro Edition (medium 5.9)
- [CVE-2019-3731](https://insights.sbomify.com/CVE-2019-3731/): Weak cryptography in RSA BSAFE Crypto-C Micro Edition (medium 5.9)
- [CVE-2019-3730](https://insights.sbomify.com/CVE-2019-3730/): Weak cryptography in RSA BSAFE MES (medium 5.9)
- [CVE-2019-3729](https://insights.sbomify.com/CVE-2019-3729/): Memory corruption in RSA BSAFE MES (low 2.4)
- [CVE-2019-3728](https://insights.sbomify.com/CVE-2019-3728/): Memory corruption in RSA BSAFE Crypto-C Micro Edition (high 7.5)
- [CVE-2019-3727](https://insights.sbomify.com/CVE-2019-3727/): OS command injection vulnerability (medium 6.4)
- [CVE-2019-3726](https://insights.sbomify.com/CVE-2019-3726/): Other in Dell Client Platforms: Dell Update Packages (DUP) Framework file (medium 6.7)
- [CVE-2019-3725](https://insights.sbomify.com/CVE-2019-3725/): Command Injection vulnerability (critical 9.8)
- [CVE-2019-3724](https://insights.sbomify.com/CVE-2019-3724/): Authorization Bypass VulnerabilityRSA Netwitness Platform (medium 6.5)
- [CVE-2019-3723](https://insights.sbomify.com/CVE-2019-3723/): Web Parameter Tampering Vulnerability (critical 9.1)
- [CVE-2019-3722](https://insights.sbomify.com/CVE-2019-3722/): XML External Entity (XXE) Injection Vulnerability (high 7.5)
- [CVE-2019-3721](https://insights.sbomify.com/CVE-2019-3721/): Improper Range Header Processing Vulnerability (medium 4.3)
- [CVE-2019-3720](https://insights.sbomify.com/CVE-2019-3720/): Directory Traversal Vulnerability (medium 4.9)
- [CVE-2019-3719](https://insights.sbomify.com/CVE-2019-3719/): Code injection in SupportAssist Client (high 7.1)
- [CVE-2019-3718](https://insights.sbomify.com/CVE-2019-3718/): Cross-site request forgery in SupportAssist Client (high 7.6)
- [CVE-2019-3717](https://insights.sbomify.com/CVE-2019-3717/): Security feature bypass in Dell Client Commercial and Consumer platforms (high 7.1)
- [CVE-2019-3716](https://insights.sbomify.com/CVE-2019-3716/): Information Exposure Vulnerability (high 7.8)
- [CVE-2019-3715](https://insights.sbomify.com/CVE-2019-3715/): Information Exposure Vulnerability (high 7.8)
- [CVE-2019-3712](https://insights.sbomify.com/CVE-2019-3712/): DSA-2019-039: Dell Wyse Device Agent Buffer Overflow Vulnerability (high 8.2)
- [CVE-2019-3711](https://insights.sbomify.com/CVE-2019-3711/): DSA-2019-038: RSA® Authentication Manager Insecure Credential Management Vulnerability (medium 5.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/48/