# Vulnerabilities published in 2019


- [CVE-2019-25496](https://insights.sbomify.com/CVE-2019-25496/): osCommerce 2.3.4.1 SQL Injection via products_id Parameter (high 8.8)
- [CVE-2019-25495](https://insights.sbomify.com/CVE-2019-25495/): osCommerce 2.3.4.1 SQL Injection via reviews_id Parameter (high 8.8)
- [CVE-2019-25494](https://insights.sbomify.com/CVE-2019-25494/): Homey BNB V4 SQL Injection Authentication Bypass via Admin Panel (high 8.8)
- [CVE-2019-25493](https://insights.sbomify.com/CVE-2019-25493/): Homey BNB V4 SQL Injection via getrecord.php (high 8.8)
- [CVE-2019-25492](https://insights.sbomify.com/CVE-2019-25492/): Homey BNB V4 SQL Injection via getcmsdata.php (high 8.8)
- [CVE-2019-25491](https://insights.sbomify.com/CVE-2019-25491/): Homey BNB V4 SQL Injection via cms_getpagetitle.php (high 8.8)
- [CVE-2019-25490](https://insights.sbomify.com/CVE-2019-25490/): Homey BNB V4 SQL Injection via admin edit.php (high 8.8)
- [CVE-2019-2549](https://insights.sbomify.com/CVE-2019-2549/): Other in FLEXCUBE Direct Banking (medium 6.1)
- [CVE-2019-25489](https://insights.sbomify.com/CVE-2019-25489/): Homey BNB V4 SQL Injection via ajax_refresh_subtotal (high 8.8)
- [CVE-2019-25488](https://insights.sbomify.com/CVE-2019-25488/): Jettweb Hazir Rent A Car Scripti V4 SQL Injection via admin (high 8.8)
- [CVE-2019-25487](https://insights.sbomify.com/CVE-2019-25487/): SAPIDO RB-1732 V2.0.43 Remote Command Execution via formSysCmd (critical 9.3)
- [CVE-2019-25486](https://insights.sbomify.com/CVE-2019-25486/): Varient 1.6.1 SQL Injection via user_id Parameter (high 8.8)
- [CVE-2019-25485](https://insights.sbomify.com/CVE-2019-25485/): R 3.4.4 Windows x64 Buffer Overflow SEH DEP ASLR Bypass (medium 6.9)
- [CVE-2019-25484](https://insights.sbomify.com/CVE-2019-25484/): WinMPG iPod Convert 3.0 Register Field Buffer Overflow DoS (medium 6.9)
- [CVE-2019-25483](https://insights.sbomify.com/CVE-2019-25483/): Comtrend AR-5310 GE31-412SSG-C01_R10.A2pG039u.d24k Restricted Shell Escape (high 8.6)
- [CVE-2019-25482](https://insights.sbomify.com/CVE-2019-25482/): Jettweb PHP Hazir Rent A Car Sitesi Scripti V2 SQL Injection (high 8.8)
- [CVE-2019-25481](https://insights.sbomify.com/CVE-2019-25481/): iScripts ReserveLogic Lastest SQL Injection via search endpoint (high 8.8)
- [CVE-2019-25480](https://insights.sbomify.com/CVE-2019-25480/): ARMBot Unrestricted File Upload via upload.php (high 8.7)
- [CVE-2019-2548](https://insights.sbomify.com/CVE-2019-2548/): Other in VM VirtualBox (high 7.8)
- [CVE-2019-25479](https://insights.sbomify.com/CVE-2019-25479/): Inout RealEstate Lastest SQL Injection via agentlistdetails (high 8.8)
- [CVE-2019-25478](https://insights.sbomify.com/CVE-2019-25478/): GetGo Download Manager 6.2.2.3300 Buffer Overflow DoS (high 8.7)
- [CVE-2019-25477](https://insights.sbomify.com/CVE-2019-25477/): RAR Password Recovery 1.80 Denial of Service Buffer Overflow (medium 6.9)
- [CVE-2019-25476](https://insights.sbomify.com/CVE-2019-25476/): Outlook Password Recovery 2.10 Denial of Service Buffer Overflow (medium 6.9)
- [CVE-2019-25475](https://insights.sbomify.com/CVE-2019-25475/): SQL Server Password Changer 1.90 Denial of Service Buffer Overflow (medium 6.9)
- [CVE-2019-25474](https://insights.sbomify.com/CVE-2019-25474/): Easy MP3 Downloader 4.7.8.8 Denial of Service Buffer Overflow (medium 6.9)
- [CVE-2019-25473](https://insights.sbomify.com/CVE-2019-25473/): Clinic Pro SQL Injection via monthly_expense_overview month Parameter (high 7.1)
- [CVE-2019-25472](https://insights.sbomify.com/CVE-2019-25472/): IntelBras Telefone IP TIP200/200 LITE Arbitrary File Read via dumpConfigFile (high 8.7)
- [CVE-2019-25471](https://insights.sbomify.com/CVE-2019-25471/): FileThingie 2.5.7 Arbitrary File Upload via ft2.php (critical 9.3)
- [CVE-2019-25470](https://insights.sbomify.com/CVE-2019-25470/): eWON Firmware 12.2-13.0 Authentication Bypass via wsdReadForm (high 8.7)
- [CVE-2019-2547](https://insights.sbomify.com/CVE-2019-2547/): Denial of service in Oracle Database (low 3.5)
- [CVE-2019-25469](https://insights.sbomify.com/CVE-2019-25469/): Folder Lock 7.7.9 Denial of Service via Serial Number Field (medium 6.9)
- [CVE-2019-25468](https://insights.sbomify.com/CVE-2019-25468/): NetGain EM Plus 10.1.68 Remote Code Execution via script_test.jsp (critical 9.3)
- [CVE-2019-25467](https://insights.sbomify.com/CVE-2019-25467/): Verypdf docPrint Pro 8.0 Local SEH Buffer Overflow (high 8.6)
- [CVE-2019-25466](https://insights.sbomify.com/CVE-2019-25466/): Easy File Sharing Web Server 7.2 Local SEH Overflow (high 8.6)
- [CVE-2019-25465](https://insights.sbomify.com/CVE-2019-25465/): Hisilicon HiIpcam V100R003 Information Disclosure via Directory Traversal (high 8.7)
- [CVE-2019-25464](https://insights.sbomify.com/CVE-2019-25464/): InputMapper 1.6.10 Local Denial of Service via Username Field (medium 6.7)
- [CVE-2019-25463](https://insights.sbomify.com/CVE-2019-25463/): SpotIE Internet Explorer Password Recovery 2.9.5 Key Field DoS (medium 6.9)
- [CVE-2019-25462](https://insights.sbomify.com/CVE-2019-25462/): Web Ofisi Rent a Car v3 SQL Injection via klima Parameter (high 8.8)
- [CVE-2019-25461](https://insights.sbomify.com/CVE-2019-25461/): Web Ofisi Platinum E-Ticaret v5 SQL Injection via ajax/productsFilterSearch (high 8.8)
- [CVE-2019-25460](https://insights.sbomify.com/CVE-2019-25460/): Web Ofisi Platinum E-Ticaret v5 SQL Injection via q Parameter (high 8.8)
- [CVE-2019-2546](https://insights.sbomify.com/CVE-2019-2546/): Other in Applications Manager (medium 4.3)
- [CVE-2019-25459](https://insights.sbomify.com/CVE-2019-25459/): Web Ofisi Emlak V2 SQL Injection via emlak-ara.html (high 8.8)
- [CVE-2019-25458](https://insights.sbomify.com/CVE-2019-25458/): Web Ofisi Firma Rehberi v1 SQL Injection via firmalar.html (high 8.8)
- [CVE-2019-25457](https://insights.sbomify.com/CVE-2019-25457/): Web Ofisi Firma v13 SQL Injection via oz Parameter (high 8.8)
- [CVE-2019-25456](https://insights.sbomify.com/CVE-2019-25456/): Web Ofisi Emlak v2 SQL Injection via ara Parameter (high 8.8)
- [CVE-2019-25455](https://insights.sbomify.com/CVE-2019-25455/): Web Ofisi E-Ticaret v3 SQL Injection via ara.html (high 8.8)
- [CVE-2019-25454](https://insights.sbomify.com/CVE-2019-25454/): phpMoAdmin 1.1.5 Stored Cross-Site Scripting via collection Parameter (medium 5.3)
- [CVE-2019-25453](https://insights.sbomify.com/CVE-2019-25453/): phpMoAdmin 1.1.5 Reflected Cross-Site Scripting via moadmin.php (medium 5.1)
- [CVE-2019-25452](https://insights.sbomify.com/CVE-2019-25452/): Dolibarr ERP/CRM 10.0.1 SQL Injection via elemid (high 8.8)
- [CVE-2019-25451](https://insights.sbomify.com/CVE-2019-25451/): phpMoAdmin 1.1.5 Cross-Site Request Forgery via moadmin.php (medium 5.3)
- [CVE-2019-25450](https://insights.sbomify.com/CVE-2019-25450/): Dolibarr ERP/CRM 10.0.1 SQL Injection via card.php (high 7.1)
- [CVE-2019-2545](https://insights.sbomify.com/CVE-2019-2545/): Denial of service in Solaris Operating System (medium 4.0)
- [CVE-2019-25449](https://insights.sbomify.com/CVE-2019-25449/): OrientDB 3.0.17 Reflected Cross-Site Scripting via document endpoint (medium 5.1)
- [CVE-2019-25448](https://insights.sbomify.com/CVE-2019-25448/): OrientDB 3.0.17 Stored Cross-Site Scripting via User Creation (medium 5.1)
- [CVE-2019-25447](https://insights.sbomify.com/CVE-2019-25447/): OrientDB 3.0.17 Cross-Site Request Forgery (medium 5.3)
- [CVE-2019-25446](https://insights.sbomify.com/CVE-2019-25446/): DIGIT CENTRIS ERP Every version SQL Injection via datum1 Parameter (high 8.8)
- [CVE-2019-25445](https://insights.sbomify.com/CVE-2019-25445/): Fiverr Clone Script 1.2.2 Cross-Site Scripting via search-results.php (medium 5.1)
- [CVE-2019-25444](https://insights.sbomify.com/CVE-2019-25444/): Fiverr Clone Script 1.2.2 SQL Injection via page Parameter (high 8.8)
- [CVE-2019-25443](https://insights.sbomify.com/CVE-2019-25443/): Inventory Webapp SQL Injection via add-item.php (high 8.8)
- [CVE-2019-25442](https://insights.sbomify.com/CVE-2019-25442/): Web Wiz Forums 12.01 SQL Injection via PF Parameter (high 8.8)
- [CVE-2019-25441](https://insights.sbomify.com/CVE-2019-25441/): thesystem 1.0 Command Injection via run_command endpoint (critical 9.3)
- [CVE-2019-25440](https://insights.sbomify.com/CVE-2019-25440/): WebIncorp ERP Every version SQL Injection via product_detail.php (high 8.8)
- [CVE-2019-2544](https://insights.sbomify.com/CVE-2019-2544/): Information disclosure in Solaris Operating System (medium 4.0)
- [CVE-2019-25439](https://insights.sbomify.com/CVE-2019-25439/): NoviSmart CMS SQL Injection via Referer HTTP Header (high 8.8)
- [CVE-2019-25438](https://insights.sbomify.com/CVE-2019-25438/): LabCollector 5.423 SQL Injection via login.php (high 8.8)
- [CVE-2019-25437](https://insights.sbomify.com/CVE-2019-25437/): Foscam Video Management System 1.1.6.6 Buffer Overflow Denial of Service (medium 6.7)
- [CVE-2019-25436](https://insights.sbomify.com/CVE-2019-25436/): Sricam DeviceViewer 3.12.0.1 Password Change Security Bypass (medium 5.1)
- [CVE-2019-25435](https://insights.sbomify.com/CVE-2019-25435/): Sricam DeviceViewer 3.12.0.1 Local Buffer Overflow DEP Bypass (high 8.4)
- [CVE-2019-25434](https://insights.sbomify.com/CVE-2019-25434/): SpotAuditor 5.3.1.0 Denial of Service via Registration Name Field (medium 6.7)
- [CVE-2019-25433](https://insights.sbomify.com/CVE-2019-25433/): XOOPS CMS 2.5.9 SQL Injection via gerar_pdf.php (high 8.8)
- [CVE-2019-25432](https://insights.sbomify.com/CVE-2019-25432/): Part-DB 0.4 Authentication Bypass via login.php (high 8.8)
- [CVE-2019-25431](https://insights.sbomify.com/CVE-2019-25431/): delpino73 Blue-Smiley-Organizer 1.32 SQL Injection via datetime (high 8.8)
- [CVE-2019-25430](https://insights.sbomify.com/CVE-2019-25430/): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via vpn_users (medium 5.1)
- [CVE-2019-2543](https://insights.sbomify.com/CVE-2019-2543/): Information disclosure in Solaris Operating System (medium 5.3)
- [CVE-2019-25429](https://insights.sbomify.com/CVE-2019-25429/): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via openvpn_advanced (medium 5.1)
- [CVE-2019-25428](https://insights.sbomify.com/CVE-2019-25428/): Comodo Dome Firewall 2.7.0 Cross-Site Scripting via openvpn_users (medium 5.1)
- [CVE-2019-25427](https://insights.sbomify.com/CVE-2019-25427/): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via antispyware (medium 5.1)
- [CVE-2019-25426](https://insights.sbomify.com/CVE-2019-25426/): Comodo Dome Firewall 2.7.0 Cross-Site Scripting via dnsmasq (medium 5.1)
- [CVE-2019-25425](https://insights.sbomify.com/CVE-2019-25425/): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via smtpconfig (medium 5.1)
- [CVE-2019-25424](https://insights.sbomify.com/CVE-2019-25424/): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via https_exceptions (medium 5.1)
- [CVE-2019-25423](https://insights.sbomify.com/CVE-2019-25423/): Comodo Dome Firewall 2.7.0 Cross-Site Scripting via proxyconfig (medium 5.1)
- [CVE-2019-25422](https://insights.sbomify.com/CVE-2019-25422/): Comodo Dome Firewall 2.7.0 Cross-Site Scripting via vpnfw (medium 5.3)
- [CVE-2019-25421](https://insights.sbomify.com/CVE-2019-25421/): Comodo Dome Firewall 2.7.0 Cross-Site Scripting via policyfw (medium 5.1)
- [CVE-2019-25420](https://insights.sbomify.com/CVE-2019-25420/): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via snat (medium 5.1)
- [CVE-2019-25419](https://insights.sbomify.com/CVE-2019-25419/): Comodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via schedule (medium 5.3)
- [CVE-2019-25418](https://insights.sbomify.com/CVE-2019-25418/): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via fwgroups (medium 5.1)
- [CVE-2019-25417](https://insights.sbomify.com/CVE-2019-25417/): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via QoS Rules (medium 5.1)
- [CVE-2019-25416](https://insights.sbomify.com/CVE-2019-25416/): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via device Parameter (medium 5.1)
- [CVE-2019-25415](https://insights.sbomify.com/CVE-2019-25415/): Comodo Dome Firewall 2.7.0 Cross-Site Scripting via hotspot_permanent_users (medium 5.1)
- [CVE-2019-25414](https://insights.sbomify.com/CVE-2019-25414/): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via ID Parameter Appid (medium 5.1)
- [CVE-2019-25413](https://insights.sbomify.com/CVE-2019-25413/): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via ID Parameter (medium 5.1)
- [CVE-2019-25412](https://insights.sbomify.com/CVE-2019-25412/): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via NTP_SERVER_LIST (medium 5.1)
- [CVE-2019-25411](https://insights.sbomify.com/CVE-2019-25411/): Comodo Dome Firewall 2.7.0 Cross-Site Scripting via DHCP (medium 5.1)
- [CVE-2019-25410](https://insights.sbomify.com/CVE-2019-25410/): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via policy_routing (medium 5.1)
- [CVE-2019-2541](https://insights.sbomify.com/CVE-2019-2541/): Other in Solaris Operating System (high 7.5)
- [CVE-2019-25409](https://insights.sbomify.com/CVE-2019-25409/): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via routing (medium 5.1)
- [CVE-2019-25408](https://insights.sbomify.com/CVE-2019-25408/): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via netwizard2 (medium 5.1)
- [CVE-2019-25407](https://insights.sbomify.com/CVE-2019-25407/): Comodo Dome Firewall 2.7.0 Cross-Site Scripting via backupschedule (medium 5.1)
- [CVE-2019-25406](https://insights.sbomify.com/CVE-2019-25406/): Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via organization Parameter (medium 5.1)
- [CVE-2019-25405](https://insights.sbomify.com/CVE-2019-25405/): Comodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via license_activation (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/58/