# Vulnerabilities published in 2019


- [CVE-2019-2581](https://insights.sbomify.com/CVE-2019-2581/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2019-2580](https://insights.sbomify.com/CVE-2019-2580/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2019-2579](https://insights.sbomify.com/CVE-2019-2579/): Information disclosure in WebCenter Sites (medium 4.3)
- [CVE-2019-25781](https://insights.sbomify.com/CVE-2019-25781/): Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing (high 8.7)
- [CVE-2019-2578](https://insights.sbomify.com/CVE-2019-2578/): Other in WebCenter Sites (high 8.6)
- [CVE-2019-25779](https://insights.sbomify.com/CVE-2019-25779/): WooThemes Diarise 1.5.9 Local File Disclosure via download.php (high 8.7)
- [CVE-2019-25778](https://insights.sbomify.com/CVE-2019-25778/): SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter (high 8.8)
- [CVE-2019-25777](https://insights.sbomify.com/CVE-2019-25777/): YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. (high 7.3)
- [CVE-2019-25776](https://insights.sbomify.com/CVE-2019-25776/): Weaver E-cology SQL Injection via SyncUserInfo.jsp (high 8.7)
- [CVE-2019-2577](https://insights.sbomify.com/CVE-2019-2577/): Denial of service in Solaris Operating System (low 3.3)
- [CVE-2019-25766](https://insights.sbomify.com/CVE-2019-25766/): Renovate before 19.38.7 Credential Exposure via Go Modules (high 8.7)
- [CVE-2019-25765](https://insights.sbomify.com/CVE-2019-25765/): ASP-CMS SQL Injection via commentList.asp id Parameter (high 8.7)
- [CVE-2019-25764](https://insights.sbomify.com/CVE-2019-25764/): Privilege escalation in AURA SYNC (high 7.3)
- [CVE-2019-25763](https://insights.sbomify.com/CVE-2019-25763/): WordPress Ultimate Addons for Beaver Builder 1.2.4.1 Authentication Bypass (critical 9.3)
- [CVE-2019-25762](https://insights.sbomify.com/CVE-2019-25762/): Joomla! Component JoomProject 1.1.3.2 Information Disclosure (high 8.7)
- [CVE-2019-25761](https://insights.sbomify.com/CVE-2019-25761/): Joomla! Component JoomCRM 1.1.1 SQL Injection via deal_id (high 7.1)
- [CVE-2019-25760](https://insights.sbomify.com/CVE-2019-25760/): Joomla! Component Easy Shop 1.2.3 Local File Inclusion (medium 6.9)
- [CVE-2019-2576](https://insights.sbomify.com/CVE-2019-2576/): Denial of service in Service Bus (medium 5.3)
- [CVE-2019-25759](https://insights.sbomify.com/CVE-2019-25759/): Joomla! Component vBizz 1.0.7 SQL Injection (high 7.1)
- [CVE-2019-25758](https://insights.sbomify.com/CVE-2019-25758/): Joomla! Component vBizz 1.0.7 Remote Code Execution (high 8.7)
- [CVE-2019-25757](https://insights.sbomify.com/CVE-2019-25757/): Joomla vWishlist 1.0.1 SQL Injection via vproductid Parameter (high 7.1)
- [CVE-2019-25756](https://insights.sbomify.com/CVE-2019-25756/): Joomla! Component vAccount 2.0.2 SQL Injection via vaccount-dashboard (high 8.8)
- [CVE-2019-25755](https://insights.sbomify.com/CVE-2019-25755/): Joomla vReview 1.9.11 SQL Injection via editReview (high 8.8)
- [CVE-2019-25754](https://insights.sbomify.com/CVE-2019-25754/): Joomla vRestaurant 1.9.4 SQL Injection via menu-listing-layout (high 8.8)
- [CVE-2019-25753](https://insights.sbomify.com/CVE-2019-25753/): Joomla! Component VMap 1.9.6 SQL Injection via loadmarker (high 8.8)
- [CVE-2019-25752](https://insights.sbomify.com/CVE-2019-25752/): Joomla! Component J-BusinessDirectory 4.9.7 SQL Injection (high 8.8)
- [CVE-2019-25751](https://insights.sbomify.com/CVE-2019-25751/): Joomla J-ClassifiedsManager 3.0.5 SQL Injection (high 8.8)
- [CVE-2019-25750](https://insights.sbomify.com/CVE-2019-25750/): Joomla J-MultipleHotelReservation 6.0.7 SQL Injection (high 8.8)
- [CVE-2019-2575](https://insights.sbomify.com/CVE-2019-2575/): Information disclosure in AutoVue 3D Professional Advanced (medium 5.3)
- [CVE-2019-25749](https://insights.sbomify.com/CVE-2019-25749/): Joomla J-CruisePortal 6.0.4 SQL Injection via cruises (high 7.1)
- [CVE-2019-25748](https://insights.sbomify.com/CVE-2019-25748/): Joomla JHotelReservation 6.0.7 SQL Injection via search-hotels (high 8.8)
- [CVE-2019-25747](https://insights.sbomify.com/CVE-2019-25747/): Network Inventory Advisor 5.0.26.0 Unquoted Service Path Privilege Escalation (high 8.5)
- [CVE-2019-25746](https://insights.sbomify.com/CVE-2019-25746/): WordPress Sliced Invoices 3.8.2 SQL Injection via post Parameter (high 7.1)
- [CVE-2019-25745](https://insights.sbomify.com/CVE-2019-25745/): WordPress Plugin Google Review Slider 6.1 SQL Injection via tid (high 8.8)
- [CVE-2019-25744](https://insights.sbomify.com/CVE-2019-25744/): WordPress Popup Builder 3.49 Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2019-25743](https://insights.sbomify.com/CVE-2019-25743/): WordPress Soliloquy Lite 2.5.6 Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2019-25742](https://insights.sbomify.com/CVE-2019-25742/): WordPress Theme Zoner Real Estate 4.1.1 Persistent XSS (medium 5.1)
- [CVE-2019-25741](https://insights.sbomify.com/CVE-2019-25741/): Mobatek MobaXterm 12.1 Buffer Overflow via Sessions File (critical 9.3)
- [CVE-2019-25740](https://insights.sbomify.com/CVE-2019-25740/): Joomla com_jsjobs 1.2.6 Arbitrary File Deletion (high 7.1)
- [CVE-2019-2574](https://insights.sbomify.com/CVE-2019-2574/): Information disclosure in VM VirtualBox (medium 6.5)
- [CVE-2019-25739](https://insights.sbomify.com/CVE-2019-25739/): GigToDo Freelance Marketplace Script 1.3 Persistent XSS (medium 5.1)
- [CVE-2019-25738](https://insights.sbomify.com/CVE-2019-25738/): WordPress Hybrid Composer 1.4.6 Unauthenticated Settings Change (critical 9.3)
- [CVE-2019-25737](https://insights.sbomify.com/CVE-2019-25737/): Live Chat Unlimited 2.8.3 Stored Cross-Site Scripting (medium 5.3)
- [CVE-2019-25736](https://insights.sbomify.com/CVE-2019-25736/): LabF nfsAxe 3.7 Ping Client Buffer Overflow (high 8.6)
- [CVE-2019-25735](https://insights.sbomify.com/CVE-2019-25735/): AllPlayer 7.4 Local Buffer Overflow via SEH Unicode (high 8.6)
- [CVE-2019-25734](https://insights.sbomify.com/CVE-2019-25734/): Contact Form by WD 1.13.1 CSRF to Local File Inclusion (medium 5.1)
- [CVE-2019-25733](https://insights.sbomify.com/CVE-2019-25733/): NetShareWatcher 1.5.8.0 SEH Buffer Overflow (high 8.6)
- [CVE-2019-25732](https://insights.sbomify.com/CVE-2019-25732/): PHP EI-Tube Script 3 SQL Injection via search parameter (high 8.8)
- [CVE-2019-25731](https://insights.sbomify.com/CVE-2019-25731/): Zuz Music 2.1 Persistent Cross-site Scripting via zuzconsole Contact (medium 5.3)
- [CVE-2019-25730](https://insights.sbomify.com/CVE-2019-25730/): Listing Hub CMS 1.0 SQL Injection via pages.php id (high 8.8)
- [CVE-2019-2573](https://insights.sbomify.com/CVE-2019-2573/): Other in PeopleSoft Enterprise PT PeopleTools (medium 4.3)
- [CVE-2019-25729](https://insights.sbomify.com/CVE-2019-25729/): PDF Signer 3.0 Server-Side Template Injection RCE via CSRF Cookie (critical 9.3)
- [CVE-2019-25728](https://insights.sbomify.com/CVE-2019-25728/): Care2x 2.7 Hospital Information System SQL Injection via ck_config (high 8.8)
- [CVE-2019-25727](https://insights.sbomify.com/CVE-2019-25727/): WordPress Plugin ad manager wd 1.0.11 Arbitrary File Download (critical 9.3)
- [CVE-2019-25726](https://insights.sbomify.com/CVE-2019-25726/): All in One Video Downloader 1.2 SQL Injection via admin page-edit (high 8.8)
- [CVE-2019-25724](https://insights.sbomify.com/CVE-2019-25724/): Dräger Infinity M300 VG2.x Network-Based Denial of Service (high 7.1)
- [CVE-2019-25723](https://insights.sbomify.com/CVE-2019-25723/): Dräger Perseus A500 2.00-2.02 DoS via Medibus Interface (medium 6.3)
- [CVE-2019-25722](https://insights.sbomify.com/CVE-2019-25722/): Dräger SC Monitoring Devices Hard-coded Credentials and DoS (high 7.2)
- [CVE-2019-25721](https://insights.sbomify.com/CVE-2019-25721/): Dräger Infinity M300 VG2.3.1 Network-Based Denial of Service (high 7.1)
- [CVE-2019-25720](https://insights.sbomify.com/CVE-2019-25720/): Dräger SC Monitoring Devices DoS via Malformed Network Packet (high 7.1)
- [CVE-2019-2572](https://insights.sbomify.com/CVE-2019-2572/): Information disclosure in Business Process Management Suite (medium 5.3)
- [CVE-2019-25719](https://insights.sbomify.com/CVE-2019-25719/): Dräger Infinity M540 VG4.1.1 Spoofing and DoS via Network Message Handling (high 8.8)
- [CVE-2019-25718](https://insights.sbomify.com/CVE-2019-25718/): Dräger Infinity Explorer C700 Privilege Escalation via Kiosk Mode Bypass (high 8.6)
- [CVE-2019-25717](https://insights.sbomify.com/CVE-2019-25717/): Dräger Infinity Delta/Kappa Patient Monitors Unauthenticated Log File Disclosure (medium 5.3)
- [CVE-2019-25716](https://insights.sbomify.com/CVE-2019-25716/): Dräger Infinity Delta/Kappa Patient Monitor DoS via Malformed Network Packet (high 7.1)
- [CVE-2019-25714](https://insights.sbomify.com/CVE-2019-25714/): Seeyon Office Anywhere (OA) A8 Unauthenticated Arbitrary File Write via htmlofficeservlet (critical 9.3)
- [CVE-2019-25713](https://insights.sbomify.com/CVE-2019-25713/): MyT-PM 1.5.1 SQL Injection via Charge[group_total] Parameter (high 7.1)
- [CVE-2019-25712](https://insights.sbomify.com/CVE-2019-25712/): BlueAuditor 1.7.2.0 Buffer Overflow Denial of Service via Registration Key (medium 6.9)
- [CVE-2019-25711](https://insights.sbomify.com/CVE-2019-25711/): SpotFTP Password Recover 2.4.2 Denial of Service via Name Field (medium 6.9)
- [CVE-2019-25710](https://insights.sbomify.com/CVE-2019-25710/): Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter (high 8.8)
- [CVE-2019-2571](https://insights.sbomify.com/CVE-2019-2571/): Other in Oracle Database (medium 6.6)
- [CVE-2019-25709](https://insights.sbomify.com/CVE-2019-25709/): CF Image Hosting Script 1.6.5 Unauthorized Database Access (critical 9.3)
- [CVE-2019-25708](https://insights.sbomify.com/CVE-2019-25708/): Heatmiser Wifi Thermostat 1.7 Cross-Site Request Forgery (medium 5.3)
- [CVE-2019-25707](https://insights.sbomify.com/CVE-2019-25707/): eBrigade ERP 4.5 SQL Injection via pdf.php (high 7.1)
- [CVE-2019-25706](https://insights.sbomify.com/CVE-2019-25706/): Across DR-810 ROM-0 Unauthenticated File Disclosure (high 8.7)
- [CVE-2019-25705](https://insights.sbomify.com/CVE-2019-25705/): Echo Mirage 3.1 Stack Buffer Overflow via Rules Action Field (high 8.6)
- [CVE-2019-25704](https://insights.sbomify.com/CVE-2019-25704/): Kados R10 GreenBee SQL Injection via filter_user_mail (high 8.8)
- [CVE-2019-25703](https://insights.sbomify.com/CVE-2019-25703/): ImpressCMS 1.3.11 SQL Injection via bid Parameter (high 7.1)
- [CVE-2019-25702](https://insights.sbomify.com/CVE-2019-25702/): Kados R10 GreenBee SQL Injection via id_project Parameter (high 8.8)
- [CVE-2019-25701](https://insights.sbomify.com/CVE-2019-25701/): Easy Video to iPod Converter 1.6.20 Local Buffer Overflow SEH (high 8.6)
- [CVE-2019-25700](https://insights.sbomify.com/CVE-2019-25700/): Kados R10 GreenBee SQL Injection via sort_direction Parameter (high 8.8)
- [CVE-2019-2570](https://insights.sbomify.com/CVE-2019-2570/): Other in Siebel Core - Server Framework (medium 4.7)
- [CVE-2019-25699](https://insights.sbomify.com/CVE-2019-25699/): Newsbull Haber Script 1.0.0 Authenticated SQL Injection via search parameter (high 7.1)
- [CVE-2019-25698](https://insights.sbomify.com/CVE-2019-25698/): Kados R10 GreenBee SQL Injection via id_to_delete Parameter (high 8.8)
- [CVE-2019-25697](https://insights.sbomify.com/CVE-2019-25697/): CMSsite 1.0 SQL Injection via category.php (high 8.8)
- [CVE-2019-25696](https://insights.sbomify.com/CVE-2019-25696/): Kados R10 GreenBee SQL Injection via language_tag Parameter (high 8.8)
- [CVE-2019-25695](https://insights.sbomify.com/CVE-2019-25695/): R 3.4.4 Local Buffer Overflow Windows XP SP3 (high 8.6)
- [CVE-2019-25694](https://insights.sbomify.com/CVE-2019-25694/): Kados R10 GreenBee SQL Injection via user2reset (high 8.8)
- [CVE-2019-25693](https://insights.sbomify.com/CVE-2019-25693/): ResourceSpace 8.6 SQL Injection via collection_edit.php (high 7.1)
- [CVE-2019-25692](https://insights.sbomify.com/CVE-2019-25692/): Kados R10 GreenBee SQL Injection via id_to_modify Parameter (high 8.8)
- [CVE-2019-25691](https://insights.sbomify.com/CVE-2019-25691/): Faleemi Desktop Software 1.8 Local Buffer Overflow SEH DEP Bypass (high 8.6)
- [CVE-2019-25690](https://insights.sbomify.com/CVE-2019-25690/): Kados R10 GreenBee SQL Injection via mng_profile_id (high 8.8)
- [CVE-2019-2569](https://insights.sbomify.com/CVE-2019-2569/): Other in Oracle Database (medium 4.0)
- [CVE-2019-25689](https://insights.sbomify.com/CVE-2019-25689/): HTML5 Video Player 1.2.5 Local Buffer Overflow Non-SEH (high 8.6)
- [CVE-2019-25688](https://insights.sbomify.com/CVE-2019-25688/): Kados R10 GreenBee SQL Injection via menu_lev1 Parameter (high 8.8)
- [CVE-2019-25687](https://insights.sbomify.com/CVE-2019-25687/): Pegasus CMS 1.0 Remote Code Execution via extra_fields.php (critical 9.3)
- [CVE-2019-25686](https://insights.sbomify.com/CVE-2019-25686/): Core FTP 2.0 build 653 PBSZ Unauthenticated Denial of Service (high 8.7)
- [CVE-2019-25684](https://insights.sbomify.com/CVE-2019-25684/): OpenDocMan 1.3.4 SQL Injection via where Parameter (high 8.8)
- [CVE-2019-25683](https://insights.sbomify.com/CVE-2019-25683/): FileZilla 3.40.0 Denial of Service via Local Search (medium 6.9)
- [CVE-2019-25682](https://insights.sbomify.com/CVE-2019-25682/): CMSsite 1.0 Cross-Site Request Forgery via users.php (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/55/