# Vulnerabilities published in 2019


- [CVE-2019-25404](https://insights.sbomify.com/CVE-2019-25404/): Comodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via admins (medium 5.1)
- [CVE-2019-25403](https://insights.sbomify.com/CVE-2019-25403/): Comodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via admin_profiles (medium 5.1)
- [CVE-2019-25402](https://insights.sbomify.com/CVE-2019-25402/): Comodo Dome Firewall 2.7.0 Cross-Site Scripting via login (medium 5.1)
- [CVE-2019-25401](https://insights.sbomify.com/CVE-2019-25401/): Bematech Printer MP-4200 TH Denial of Service (high 8.7)
- [CVE-2019-25400](https://insights.sbomify.com/CVE-2019-25400/): IPFire 2.21 Core Update 127 Multiple XSS via fwhosts.cgi (medium 4.8)
- [CVE-2019-2540](https://insights.sbomify.com/CVE-2019-2540/): Other in Java (medium 6.1)
- [CVE-2019-25399](https://insights.sbomify.com/CVE-2019-25399/): IPFire 2.21 Core Update 127 Stored XSS via extrahd.cgi (medium 5.1)
- [CVE-2019-25398](https://insights.sbomify.com/CVE-2019-25398/): IPFire 2.21 Core Update 127 Cross-Site Scripting via ovpnmain.cgi (medium 5.1)
- [CVE-2019-25397](https://insights.sbomify.com/CVE-2019-25397/): IPFire 2.21 Core Update 127 Cross-Site Scripting via hosts.cgi (medium 5.1)
- [CVE-2019-25396](https://insights.sbomify.com/CVE-2019-25396/): IPFire 2.21 Core Update 127 Reflected XSS via updatexlrator.cgi (medium 5.1)
- [CVE-2019-25395](https://insights.sbomify.com/CVE-2019-25395/): Smoothwall Express 3.1 'preferences.cgi' Cross-Site Scripting (medium 5.3)
- [CVE-2019-25394](https://insights.sbomify.com/CVE-2019-25394/): Smoothwall Express 3.1 'modem.cgi' Cross-Site Scripting (medium 5.3)
- [CVE-2019-25393](https://insights.sbomify.com/CVE-2019-25393/): Smoothwall Express 3.1 'smoothinfo.cgi' Cross-Site Scripting (medium 5.1)
- [CVE-2019-25392](https://insights.sbomify.com/CVE-2019-25392/): Smoothwall Express 3.1 'iptools.cgi' Cross-Site Scripting (medium 5.1)
- [CVE-2019-25391](https://insights.sbomify.com/CVE-2019-25391/): Ashop Shopping Cart Software Lastest Latest SQL Injection via bannedcustomers.php (high 8.8)
- [CVE-2019-25390](https://insights.sbomify.com/CVE-2019-25390/): Smoothwall Express 3.1 'interfaces.cgi' Cross-Site Scripting (medium 4.8)
- [CVE-2019-2539](https://insights.sbomify.com/CVE-2019-2539/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2019-25389](https://insights.sbomify.com/CVE-2019-25389/): Smoothwall Express 3.1 'timedaccess.cgi' Cross-Site Scripting (medium 5.1)
- [CVE-2019-25388](https://insights.sbomify.com/CVE-2019-25388/): Smoothwall Express 3.1 'ipblock.cgi' Cross-Site Scripting (medium 5.1)
- [CVE-2019-25387](https://insights.sbomify.com/CVE-2019-25387/): Smoothwall Express 3.1 'xtaccess.cgi' Cross-Site Scripting (medium 5.1)
- [CVE-2019-25386](https://insights.sbomify.com/CVE-2019-25386/): Smoothwall Express 3.1 'dmzholes.cgi' Cross-Site Scripting (medium 5.1)
- [CVE-2019-25385](https://insights.sbomify.com/CVE-2019-25385/): Smoothwall Express 3.1 'outgoing.cgi' Cross-Site Scripting (medium 5.1)
- [CVE-2019-25384](https://insights.sbomify.com/CVE-2019-25384/): Smoothwall Express 3.1 'portfw.cgi' Cross-Site Scripting (medium 5.1)
- [CVE-2019-25383](https://insights.sbomify.com/CVE-2019-25383/): Smoothwall Express 3.1 'apcupsd.cgi' Cross-Site Scripting (medium 5.1)
- [CVE-2019-25382](https://insights.sbomify.com/CVE-2019-25382/): Smoothwall Express 3.1 'time.cgi' Cross-Site Scripting (medium 5.1)
- [CVE-2019-25381](https://insights.sbomify.com/CVE-2019-25381/): Smoothwall Express 3.1 'hosts.cgi' Cross-Site Scripting (medium 5.1)
- [CVE-2019-25380](https://insights.sbomify.com/CVE-2019-25380/): Smoothwall Express 3.1 'dhcp.cgi' Cross-Site Scripting (medium 5.1)
- [CVE-2019-2538](https://insights.sbomify.com/CVE-2019-2538/): Other in Managed File Transfer (high 7.1)
- [CVE-2019-25379](https://insights.sbomify.com/CVE-2019-25379/): Smoothwall Express 3.1 'urlfilter.cgi' Cross-Site Scripting (medium 5.3)
- [CVE-2019-25378](https://insights.sbomify.com/CVE-2019-25378/): Smoothwall Express 3.1 'proxy.cgi' Cross-Site Scripting (medium 5.1)
- [CVE-2019-25377](https://insights.sbomify.com/CVE-2019-25377/): OPNsense 19.1 Reflected XSS via system_advanced_sysctl.php (medium 4.8)
- [CVE-2019-25376](https://insights.sbomify.com/CVE-2019-25376/): OPNsense 19.1 Reflected XSS via proxy endpoint (medium 5.1)
- [CVE-2019-25375](https://insights.sbomify.com/CVE-2019-25375/): OPNsense 19.1 Reflected XSS via monit interface (medium 5.1)
- [CVE-2019-25374](https://insights.sbomify.com/CVE-2019-25374/): OPNsense 19.1 Reflected XSS via vpn_ipsec_settings.php (medium 5.1)
- [CVE-2019-25373](https://insights.sbomify.com/CVE-2019-25373/): OPNsense 19.1 Stored XSS via firewall_rules_edit.php (medium 5.1)
- [CVE-2019-25372](https://insights.sbomify.com/CVE-2019-25372/): OPNsense 19.1 Reflected XSS via diag_traceroute.php (medium 5.1)
- [CVE-2019-25371](https://insights.sbomify.com/CVE-2019-25371/): OPNsense 19.1 Reflected XSS via diag_ping.php (medium 5.1)
- [CVE-2019-25370](https://insights.sbomify.com/CVE-2019-25370/): OPNsense 19.1 Reflected XSS via interfaces_vlan_edit.php (medium 5.1)
- [CVE-2019-2537](https://insights.sbomify.com/CVE-2019-2537/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2019-25369](https://insights.sbomify.com/CVE-2019-25369/): OPNsense 19.1 Stored XSS via system_advanced_sysctl.php (medium 5.1)
- [CVE-2019-25368](https://insights.sbomify.com/CVE-2019-25368/): OPNsense 19.1 Reflected XSS via diag_backup.php (medium 4.8)
- [CVE-2019-25367](https://insights.sbomify.com/CVE-2019-25367/): ArangoDB Community Edition 3.4.2-1 XSS via aardvark admin interface (medium 4.8)
- [CVE-2019-25366](https://insights.sbomify.com/CVE-2019-25366/): microASP Portal+ CMS SQL Injection via pagina.phtml (high 8.8)
- [CVE-2019-25365](https://insights.sbomify.com/CVE-2019-25365/): ChaosPro 2.0 - Buffer Overflow (high 8.4)
- [CVE-2019-25364](https://insights.sbomify.com/CVE-2019-25364/): Win10 MailCarrier 2.51 - 'POP3 User' Remote Buffer Overflow (critical 9.3)
- [CVE-2019-25363](https://insights.sbomify.com/CVE-2019-25363/): WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Denial of Service (high 8.4)
- [CVE-2019-25362](https://insights.sbomify.com/CVE-2019-25362/): WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Buffer OverFlow (critical 9.3)
- [CVE-2019-25361](https://insights.sbomify.com/CVE-2019-25361/): Ayukov NFTP client 1.71 - 'SYST' Buffer Overflow (high 8.6)
- [CVE-2019-25360](https://insights.sbomify.com/CVE-2019-25360/): Aida64 6.10.5200 - Buffer Overflow (high 8.4)
- [CVE-2019-2536](https://insights.sbomify.com/CVE-2019-2536/): Denial of service in MySQL Server (medium 5.0)
- [CVE-2019-25359](https://insights.sbomify.com/CVE-2019-25359/): SD.NET RIM 4.7.3c - 'idtyp' SQL Injection (high 8.8)
- [CVE-2019-25358](https://insights.sbomify.com/CVE-2019-25358/): FileOptimizer 14.00.2524 - Denial of Service (high 8.7)
- [CVE-2019-25357](https://insights.sbomify.com/CVE-2019-25357/): Control Center PRO 6.2.9 - Local Stack Based BufferOverflow (high 8.4)
- [CVE-2019-25356](https://insights.sbomify.com/CVE-2019-25356/): Bematech Printer MP-4200 TH Cross-Site Scripting (medium 5.1)
- [CVE-2019-25355](https://insights.sbomify.com/CVE-2019-25355/): Genivia gSOAP 2.8 - 'gSOAP' Path Traversal (high 8.7)
- [CVE-2019-25354](https://insights.sbomify.com/CVE-2019-25354/): iSmartViewPro 1.3.34 - Denial of Service (medium 4.6)
- [CVE-2019-25353](https://insights.sbomify.com/CVE-2019-25353/): Foscam Video Management System 1.1.4.9 - 'Username' Denial of Service (medium 4.6)
- [CVE-2019-25352](https://insights.sbomify.com/CVE-2019-25352/): Genivia Crystal Live HTTP Server 6.01 - 'Crystal Live HTTP Server' Path Traversal (high 8.7)
- [CVE-2019-25351](https://insights.sbomify.com/CVE-2019-25351/): Centova Cast 3.2.11 - Arbitrary File Download (high 7.1)
- [CVE-2019-25350](https://insights.sbomify.com/CVE-2019-25350/): XMedia Recode 3.4.8.6 - '.m3u' Denial Of Service (medium 4.6)
- [CVE-2019-2535](https://insights.sbomify.com/CVE-2019-2535/): Denial of service in MySQL Server (medium 4.1)
- [CVE-2019-25349](https://insights.sbomify.com/CVE-2019-25349/): scadaApp for iOS 1.1.4.0 - 'Servername' Denial of Service (medium 4.6)
- [CVE-2019-25347](https://insights.sbomify.com/CVE-2019-25347/): thesystem App 1.0 - 'username' SQL Injection (high 7.1)
- [CVE-2019-25346](https://insights.sbomify.com/CVE-2019-25346/): thesystem 1.0 - 'server_name' SQL Injection (high 7.1)
- [CVE-2019-25345](https://insights.sbomify.com/CVE-2019-25345/): RTK IIS Codec Service 6.4.10041.133 - 'RtkI2SCodec' Unquote Service Path (high 8.5)
- [CVE-2019-25344](https://insights.sbomify.com/CVE-2019-25344/): MobileGo 8.5.0 - Insecure File Permissions (high 8.5)
- [CVE-2019-25343](https://insights.sbomify.com/CVE-2019-25343/): NextVPN 4.10 - Insecure File Permissions (high 8.5)
- [CVE-2019-25342](https://insights.sbomify.com/CVE-2019-25342/): Centova Cast 3.2.12 - Denial of Service (high 7.1)
- [CVE-2019-25341](https://insights.sbomify.com/CVE-2019-25341/): iNetTools for iOS 8.20 - 'Whois' Denial of Service (medium 6.7)
- [CVE-2019-25340](https://insights.sbomify.com/CVE-2019-25340/): SpotAuditor 5.3.2 - 'Base64' Denial Of Service (medium 6.7)
- [CVE-2019-2534](https://insights.sbomify.com/CVE-2019-2534/): Other in MySQL Server (high 7.1)
- [CVE-2019-25339](https://insights.sbomify.com/CVE-2019-25339/): GHIA CamIP 1.2 for iOS - 'Password' Denial of Service (medium 6.7)
- [CVE-2019-25338](https://insights.sbomify.com/CVE-2019-25338/): Dokuwiki 2018-04-22b - Username Enumeration (medium 6.9)
- [CVE-2019-25337](https://insights.sbomify.com/CVE-2019-25337/): OwnCloud 8.1.8 - Username Disclosure (medium 5.3)
- [CVE-2019-25336](https://insights.sbomify.com/CVE-2019-25336/): SpotAuditor 5.3.2 - 'Base64' Local Buffer Overflow (SEH) (high 8.4)
- [CVE-2019-25335](https://insights.sbomify.com/CVE-2019-25335/): PRO-7070 Hazır Profesyonel Web Sitesi 1.0 - Authentication Bypass (high 8.8)
- [CVE-2019-25334](https://insights.sbomify.com/CVE-2019-25334/): Product Key Explorer 4.2.0.0 - 'Name' Denial of Service (medium 6.7)
- [CVE-2019-25333](https://insights.sbomify.com/CVE-2019-25333/): Path traversal in Momentum Series JAWS (high 8.7)
- [CVE-2019-25332](https://insights.sbomify.com/CVE-2019-25332/): FTP Commander Pro 8.03 - Local Stack Overflow (high 8.4)
- [CVE-2019-25331](https://insights.sbomify.com/CVE-2019-25331/): AVS Audio Converter 9.1 - 'Exit folder' Buffer Overflow (high 8.4)
- [CVE-2019-25330](https://insights.sbomify.com/CVE-2019-25330/): SurfOffline Professional 2.2.0.103 - 'Project Name' Denial of Service (SEH) (medium 6.7)
- [CVE-2019-2533](https://insights.sbomify.com/CVE-2019-2533/): Other in MySQL Server (medium 6.5)
- [CVE-2019-25329](https://insights.sbomify.com/CVE-2019-25329/): FTP Navigator 8.03 - 'Custom Command' Denial of Service (SEH) (medium 6.7)
- [CVE-2019-25328](https://insights.sbomify.com/CVE-2019-25328/): XnConvert 1.82 - Denial of Service (medium 6.7)
- [CVE-2019-25327](https://insights.sbomify.com/CVE-2019-25327/): Prime95 Version 29.8 build 6 - Buffer Overflow (SEH) (high 8.4)
- [CVE-2019-25326](https://insights.sbomify.com/CVE-2019-25326/): ipPulse 1.92 - 'Enter Key' Denial of Service (medium 4.6)
- [CVE-2019-25325](https://insights.sbomify.com/CVE-2019-25325/): Thrive Smart Home 1.1 - 'Smart Home' Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (high 8.8)
- [CVE-2019-25324](https://insights.sbomify.com/CVE-2019-25324/): RICOH Web Image Monitor 1.09 - HTML Injection (medium 5.1)
- [CVE-2019-25323](https://insights.sbomify.com/CVE-2019-25323/): Heatmiser Netmonitor 3.03 - HTML Injection (medium 5.1)
- [CVE-2019-25322](https://insights.sbomify.com/CVE-2019-25322/): Heatmiser Netmonitor 3.03 - Hardcoded Credentials (critical 9.3)
- [CVE-2019-25321](https://insights.sbomify.com/CVE-2019-25321/): FTP Navigator 8.03 - Stack Overflow (SEH) (high 8.4)
- [CVE-2019-25320](https://insights.sbomify.com/CVE-2019-25320/): elearning-script 1.0 - Authentication Bypass (high 8.8)
- [CVE-2019-2532](https://insights.sbomify.com/CVE-2019-2532/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2019-25319](https://insights.sbomify.com/CVE-2019-25319/): Domain Quester Pro 6.02 - Stack Overflow (SEH) (high 8.4)
- [CVE-2019-25318](https://insights.sbomify.com/CVE-2019-25318/): AVS Audio Converter 9.1.2.600 - Stack Overflow (high 8.4)
- [CVE-2019-25317](https://insights.sbomify.com/CVE-2019-25317/): Kimai 2- persistent cross-site scripting (XSS) (medium 5.1)
- [CVE-2019-25316](https://insights.sbomify.com/CVE-2019-25316/): GOautodial 4.0 - 'CreateEvent' Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2019-25315](https://insights.sbomify.com/CVE-2019-25315/): WP Server Log Viewer 1.0 - 'logfile' Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2019-25314](https://insights.sbomify.com/CVE-2019-25314/): Duplicate-Post 3.2.3 - Persistent Cross-Site Scripting (medium 4.8)
- [CVE-2019-25313](https://insights.sbomify.com/CVE-2019-25313/): FlexNet Publisher 11.12.1 - Cross-Site Request Forgery (Add Local Admin) (medium 5.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/59/