# Vulnerabilities published in 2019


- [CVE-2019-3710](https://insights.sbomify.com/CVE-2019-3710/): DSA-2019-034: Dell EMC Networking OS10 Undocumented Default Cryptographic Key Vulnerability (high 8.3)
- [CVE-2019-3709](https://insights.sbomify.com/CVE-2019-3709/): Cross-Site Scripting Vulnerability while registering vCenter servers (high 8.3)
- [CVE-2019-3708](https://insights.sbomify.com/CVE-2019-3708/): Cross-Site Scripting Vulnerability in OVA file upload feature (high 8.3)
- [CVE-2019-3707](https://insights.sbomify.com/CVE-2019-3707/): WS-MAN Authentication Bypass Vulnerability (high 8.6)
- [CVE-2019-3706](https://insights.sbomify.com/CVE-2019-3706/): Web Interface Authentication Bypass Vulnerability (high 8.6)
- [CVE-2019-3705](https://insights.sbomify.com/CVE-2019-3705/): Buffer Overflow Vulnerability (high 8.1)
- [CVE-2019-3704](https://insights.sbomify.com/CVE-2019-3704/): Command injection in VNX Control Station in Dell EMC VNX2 OE for File (high 7.8)
- [CVE-2019-3702](https://insights.sbomify.com/CVE-2019-3702/): Command injection in lifesize:icon 300 firmware (high 8.8)
- [CVE-2019-3701](https://insights.sbomify.com/CVE-2019-3701/): Memory corruption in canonical:ubuntu linux (medium 4.4)
- [CVE-2019-3700](https://insights.sbomify.com/CVE-2019-3700/): yast: Fallback to DES without configuration in /etc/login.def (low 2.9)
- [CVE-2019-3699](https://insights.sbomify.com/CVE-2019-3699/): Local privilege escalation from user privoxy to root (high 7.7)
- [CVE-2019-3698](https://insights.sbomify.com/CVE-2019-3698/): nagios cron job allows privilege escalation from user nagios to root (medium 5.7)
- [CVE-2019-3697](https://insights.sbomify.com/CVE-2019-3697/): Local privilege escalation from user gnump3d to root (high 7.7)
- [CVE-2019-3696](https://insights.sbomify.com/CVE-2019-3696/): pcp: Local privilege escalation from user pcp to root through migrate_tempdirs (high 8.4)
- [CVE-2019-3695](https://insights.sbomify.com/CVE-2019-3695/): pcp: Local privilege escalation from user pcp to root (high 8.4)
- [CVE-2019-3694](https://insights.sbomify.com/CVE-2019-3694/): Local privilege escalation from munin to root in the packaging of munin (high 7.7)
- [CVE-2019-3693](https://insights.sbomify.com/CVE-2019-3693/): Local privilege escalation from user wwwrun to root in the packaging of mailman (high 7.7)
- [CVE-2019-3692](https://insights.sbomify.com/CVE-2019-3692/): Local privilege escalation from user news to root in the packaging of inn (high 7.7)
- [CVE-2019-3691](https://insights.sbomify.com/CVE-2019-3691/): Local privilege escalation from user munge to root (high 7.7)
- [CVE-2019-3690](https://insights.sbomify.com/CVE-2019-3690/): chkstat follows untrusted symbolic links (medium 6.8)
- [CVE-2019-3689](https://insights.sbomify.com/CVE-2019-3689/): nfs-utils: root-owned files stored in insecure /var/lib/nfs directory (medium 5.1)
- [CVE-2019-3688](https://insights.sbomify.com/CVE-2019-3688/): squid: /usr/sbin/pinger packaged with wrong permission (medium 5.1)
- [CVE-2019-3687](https://insights.sbomify.com/CVE-2019-3687/): "easy" permission profile allows everyone execute dumpcap and read all network traffic (medium 4.0)
- [CVE-2019-3686](https://insights.sbomify.com/CVE-2019-3686/): XSS in distri and version parameter in openQA (medium 6.5)
- [CVE-2019-3685](https://insights.sbomify.com/CVE-2019-3685/): Missing TLS certificate validation for HTTPS connections in osc (high 7.4)
- [CVE-2019-3684](https://insights.sbomify.com/CVE-2019-3684/): susemanager installer creates world-readable swap files (medium 4.0)
- [CVE-2019-3683](https://insights.sbomify.com/CVE-2019-3683/): keystone_json_assignment backend granted access to any project for users in user-project-map.json (high 8.8)
- [CVE-2019-3682](https://insights.sbomify.com/CVE-2019-3682/): Insecure API port exposed to all Master Node guest containers (high 8.4)
- [CVE-2019-3681](https://insights.sbomify.com/CVE-2019-3681/): osc: stores downloaded (supposed) RPM in network-controlled filesystem paths (high 7.5)
- [CVE-2019-3670](https://insights.sbomify.com/CVE-2019-3670/): Remote Code Execution vulnerability (high 8.0)
- [CVE-2019-3667](https://insights.sbomify.com/CVE-2019-3667/): DLL Search Order Hijacking (medium 6.6)
- [CVE-2019-3666](https://insights.sbomify.com/CVE-2019-3666/): API Abuse Vulnerability (medium 6.5)
- [CVE-2019-3665](https://insights.sbomify.com/CVE-2019-3665/): Code Injection vulnerability (medium 6.5)
- [CVE-2019-3663](https://insights.sbomify.com/CVE-2019-3663/): Advanced Threat Defense (ATD) - Unprotected storage of shared credentials vulnerability (critical 9.8)
- [CVE-2019-3662](https://insights.sbomify.com/CVE-2019-3662/): Advanced Threat Defense (ATD) - Path Traversal: '/absolute/pathname/here' vulnerability (medium 6.5)
- [CVE-2019-3661](https://insights.sbomify.com/CVE-2019-3661/): Advanced Threat Defense (ATD) - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (high 8.1)
- [CVE-2019-3660](https://insights.sbomify.com/CVE-2019-3660/): Advanced Threat Defense (ATD) - Improper Neutralization of HTTP requests (high 8.4)
- [CVE-2019-3654](https://insights.sbomify.com/CVE-2019-3654/): Client Proxy (MCP) - Authentication Bypass vulnerability (medium 5.3)
- [CVE-2019-3653](https://insights.sbomify.com/CVE-2019-3653/): ESConfig Tool access not controlled (medium 4.6)
- [CVE-2019-3652](https://insights.sbomify.com/CVE-2019-3652/): ENS code injection in EPSetup.exe (medium 5.0)
- [CVE-2019-3651](https://insights.sbomify.com/CVE-2019-3651/): Advanced Threat Defense (ATD) - Information Disclosure vulnerability (high 8.8)
- [CVE-2019-3650](https://insights.sbomify.com/CVE-2019-3650/): Advanced Threat Defense (ATD) - Information Disclosure vulnerability (medium 5.3)
- [CVE-2019-3649](https://insights.sbomify.com/CVE-2019-3649/): Advanced Threat Defense (ATD) - Information Disclosure vulnerability (medium 5.3)
- [CVE-2019-3648](https://insights.sbomify.com/CVE-2019-3648/): Implicit loading of DLLs (medium 6.1)
- [CVE-2019-3646](https://insights.sbomify.com/CVE-2019-3646/): McAfee Total Protection - Free Antivirus Trial: DLL Search Order Hijacking vulnerability (medium 6.9)
- [CVE-2019-3644](https://insights.sbomify.com/CVE-2019-3644/): MWG scanners updated to address CVE-2019-9517 (high 7.5)
- [CVE-2019-3643](https://insights.sbomify.com/CVE-2019-3643/): MWG scanners updated to address CVE-2019-9511 (medium 5.3)
- [CVE-2019-3641](https://insights.sbomify.com/CVE-2019-3641/): Exploitation of Authorization in TIE Server (medium 4.5)
- [CVE-2019-3640](https://insights.sbomify.com/CVE-2019-3640/): Data Loss Prevention - Unprotected Transport of Credentials (medium 4.8)
- [CVE-2019-3639](https://insights.sbomify.com/CVE-2019-3639/): MWG UI: Cross-Frame Scripting vulnerability (high 7.1)
- [CVE-2019-3638](https://insights.sbomify.com/CVE-2019-3638/): Web Gateway (MWG) - Reflected Cross Site Scripting vulnerability (high 8.1)
- [CVE-2019-3637](https://insights.sbomify.com/CVE-2019-3637/): Privilege Escalation vulnerability in FRP 5.x earlier than 5.1.0.209 (medium 4.1)
- [CVE-2019-3636](https://insights.sbomify.com/CVE-2019-3636/): File masquerade attack vulnerability in McAfee Total Protection (high 7.5)
- [CVE-2019-3635](https://insights.sbomify.com/CVE-2019-3635/): MWG Proxy: Cross-Frame Scripting vulnerability (medium 4.3)
- [CVE-2019-3634](https://insights.sbomify.com/CVE-2019-3634/): Buffer overflow in DLP Endpoint for Windows (medium 4.4)
- [CVE-2019-3633](https://insights.sbomify.com/CVE-2019-3633/): Buffer overflow in DLP Endpoint for Windows (medium 4.4)
- [CVE-2019-3632](https://insights.sbomify.com/CVE-2019-3632/): Directory Traversal vulnerability could lead to elevated privileges (high 8.5)
- [CVE-2019-3631](https://insights.sbomify.com/CVE-2019-3631/): Command Injection could allow authenticated users to execute arbitrary code (high 8.0)
- [CVE-2019-3630](https://insights.sbomify.com/CVE-2019-3630/): Command Injection could allow authenticated users to execute arbitrary code (high 8.0)
- [CVE-2019-3629](https://insights.sbomify.com/CVE-2019-3629/): Application protections bypass vulnerability could allow unauthenticated user to impersonate system users (high 8.3)
- [CVE-2019-3628](https://insights.sbomify.com/CVE-2019-3628/): Privilege escalation could allow authenticated user to gain access to a core system (high 7.5)
- [CVE-2019-3622](https://insights.sbomify.com/CVE-2019-3622/): DLP Endpoint log file redirection to arbitrary locations (high 7.5)
- [CVE-2019-3621](https://insights.sbomify.com/CVE-2019-3621/): DLP Endpoint Windows lock screen bypass with physical access (medium 6.8)
- [CVE-2019-3619](https://insights.sbomify.com/CVE-2019-3619/): Information disclosure in McAfee ePolicy Orchestrator (ePO) (medium 6.8)
- [CVE-2019-3617](https://insights.sbomify.com/CVE-2019-3617/): Privilege escalation in ToPS for Mac (high 7.5)
- [CVE-2019-3615](https://insights.sbomify.com/CVE-2019-3615/): Data Leakage Vulnerability in McAfee Database Security web interface (medium 5.3)
- [CVE-2019-3613](https://insights.sbomify.com/CVE-2019-3613/): DLL search order hijacking in MA (medium 5.9)
- [CVE-2019-3612](https://insights.sbomify.com/CVE-2019-3612/): Information disclosure vulnerability in McAfee TIE Server and DXL Platform (high 8.2)
- [CVE-2019-3610](https://insights.sbomify.com/CVE-2019-3610/): True Key Browser Extension 3.1.9219.0 update fixes Sensitive Data Exposure vulnerability (medium 5.6)
- [CVE-2019-3606](https://insights.sbomify.com/CVE-2019-3606/): Data leakage when in an MDR pair by McAfee Network Security Manager 9.x (high 7.7)
- [CVE-2019-3604](https://insights.sbomify.com/CVE-2019-3604/): ePolicy Orchestrator Cloud update fixes multiple Cross-Site Request Forgery vulnerabilities (medium 4.8)
- [CVE-2019-3602](https://insights.sbomify.com/CVE-2019-3602/): Cross site scripting vulnerability in McAfee NSM impacting authenticated users (medium 4.8)
- [CVE-2019-3599](https://insights.sbomify.com/CVE-2019-3599/): McAfee Agent update fixes an Information Disclosure vulnerability (medium 6.5)
- [CVE-2019-3598](https://insights.sbomify.com/CVE-2019-3598/): McAfee Agent update fixes a vulnerability in handling UDP requests (medium 5.3)
- [CVE-2019-3597](https://insights.sbomify.com/CVE-2019-3597/): Authentication bypass in McAfee Network Security Manager 9.x (medium 6.5)
- [CVE-2019-3595](https://insights.sbomify.com/CVE-2019-3595/): DLP Endpoint ePO extension not sanitizing CSV exports (low 2.0)
- [CVE-2019-3593](https://insights.sbomify.com/CVE-2019-3593/): Exploitation of Privilege/Trust vulnerability (high 7.5)
- [CVE-2019-3592](https://insights.sbomify.com/CVE-2019-3592/): MA for Windows update addresses weak directory permissions (high 7.2)
- [CVE-2019-3591](https://insights.sbomify.com/CVE-2019-3591/): DLP Endpoint ePO extension vulnerable to XSS (low 3.9)
- [CVE-2019-3588](https://insights.sbomify.com/CVE-2019-3588/): Using VSE to bypass Windows Credentials on Lock screen (medium 6.3)
- [CVE-2019-3587](https://insights.sbomify.com/CVE-2019-3587/): DLL Search Order Hijacking vulnerability (high 7.2)
- [CVE-2019-3586](https://insights.sbomify.com/CVE-2019-3586/): McAfee Endpoint Security firewall not always acting on GTI lookup results (high 7.5)
- [CVE-2019-3585](https://insights.sbomify.com/CVE-2019-3585/): VSE Escalation of Privileges through Alert pop-up window (high 7.0)
- [CVE-2019-3584](https://insights.sbomify.com/CVE-2019-3584/): Exploitation of Authentication vulnerability (high 7.4)
- [CVE-2019-3582](https://insights.sbomify.com/CVE-2019-3582/): McAfee Endpoint Security updates fix a privilege escalation vulnerability (high 8.6)
- [CVE-2019-3581](https://insights.sbomify.com/CVE-2019-3581/): McAfee Web Gateway denial of service attack due to Improper Input Validation (high 7.5)
- [CVE-2019-3580](https://insights.sbomify.com/CVE-2019-3580/): Path traversal in openrefine:openrefine (high 7.5)
- [CVE-2019-3579](https://insights.sbomify.com/CVE-2019-3579/): Information disclosure in mybb:mybb (medium 5.3)
- [CVE-2019-3578](https://insights.sbomify.com/CVE-2019-3578/): Cross-site scripting in mybb:mybb (medium 6.1)
- [CVE-2019-3577](https://insights.sbomify.com/CVE-2019-3577/): SQL injection in bijiadao:waimai super cms (critical 9.8)
- [CVE-2019-3576](https://insights.sbomify.com/CVE-2019-3576/): SQL injection in inxedu project:inxedu (critical 9.8)
- [CVE-2019-3575](https://insights.sbomify.com/CVE-2019-3575/): sqla-yaml-fixtures is vulnerable to Code Injection (high 7.8)
- [CVE-2019-3574](https://insights.sbomify.com/CVE-2019-3574/): Memory corruption in saitoha:libsixel (high 7.8)
- [CVE-2019-3573](https://insights.sbomify.com/CVE-2019-3573/): Denial of service in saitoha:libsixel (medium 5.5)
- [CVE-2019-3572](https://insights.sbomify.com/CVE-2019-3572/): Memory corruption in libming:libming (medium 6.5)
- [CVE-2019-3571](https://insights.sbomify.com/CVE-2019-3571/): Other in WhatsApp Desktop (medium 5.3)
- [CVE-2019-3570](https://insights.sbomify.com/CVE-2019-3570/): Memory corruption in HHVM (critical 9.8)
- [CVE-2019-3569](https://insights.sbomify.com/CVE-2019-3569/): Misconfiguration in HHVM (high 7.5)
- [CVE-2019-3568](https://insights.sbomify.com/CVE-2019-3568/): WhatsApp VOIP Stack Buffer Overflow (critical 9.8, exploited in the wild)
- [CVE-2019-3567](https://insights.sbomify.com/CVE-2019-3567/): Privilege escalation in osquery (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/49/