# Vulnerabilities published in 2019


- [CVE-2019-9614](https://insights.sbomify.com/CVE-2019-9614/): An issue was discovered in OFCMS before 1.1.3. (high 8.8)
- [CVE-2019-9613](https://insights.sbomify.com/CVE-2019-9613/): File upload in n/a (high 7.2)
- [CVE-2019-9612](https://insights.sbomify.com/CVE-2019-9612/): File upload in n/a (high 8.8)
- [CVE-2019-9611](https://insights.sbomify.com/CVE-2019-9611/): Path traversal in n/a (medium 6.5)
- [CVE-2019-9610](https://insights.sbomify.com/CVE-2019-9610/): Path traversal in n/a (medium 4.3)
- [CVE-2019-9609](https://insights.sbomify.com/CVE-2019-9609/): File upload in n/a (high 8.8)
- [CVE-2019-9608](https://insights.sbomify.com/CVE-2019-9608/): File upload in n/a (high 8.8)
- [CVE-2019-9607](https://insights.sbomify.com/CVE-2019-9607/): Path traversal in n/a (medium 5.3)
- [CVE-2019-9606](https://insights.sbomify.com/CVE-2019-9606/): Cross-site scripting in n/a (medium 5.4)
- [CVE-2019-9605](https://insights.sbomify.com/CVE-2019-9605/): Cross-site scripting in n/a (medium 5.4)
- [CVE-2019-9604](https://insights.sbomify.com/CVE-2019-9604/): Cross-site request forgery in n/a (high 8.8)
- [CVE-2019-9603](https://insights.sbomify.com/CVE-2019-9603/): Cross-site request forgery in n/a (medium 6.5)
- [CVE-2019-9601](https://insights.sbomify.com/CVE-2019-9601/): Denial of service in n/a (high 7.5)
- [CVE-2019-9600](https://insights.sbomify.com/CVE-2019-9600/): Denial of service in n/a (high 7.5)
- [CVE-2019-9599](https://insights.sbomify.com/CVE-2019-9599/): Denial of service in n/a (high 7.5)
- [CVE-2019-9598](https://insights.sbomify.com/CVE-2019-9598/): Cross-site request forgery in n/a (medium 6.5)
- [CVE-2019-9597](https://insights.sbomify.com/CVE-2019-9597/): Cross-site request forgery in n/a (medium 6.5)
- [CVE-2019-9596](https://insights.sbomify.com/CVE-2019-9596/): Cross-site request forgery in n/a (medium 6.5)
- [CVE-2019-9595](https://insights.sbomify.com/CVE-2019-9595/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2019-9594](https://insights.sbomify.com/CVE-2019-9594/): SQL injection in n/a (critical 9.8)
- [CVE-2019-9593](https://insights.sbomify.com/CVE-2019-9593/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2019-9592](https://insights.sbomify.com/CVE-2019-9592/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2019-9591](https://insights.sbomify.com/CVE-2019-9591/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2019-9590](https://insights.sbomify.com/CVE-2019-9590/): Denial of service in n/a (high 7.5)
- [CVE-2019-9589](https://insights.sbomify.com/CVE-2019-9589/): Null dereference in n/a (high 7.8)
- [CVE-2019-9588](https://insights.sbomify.com/CVE-2019-9588/): Memory corruption in n/a (high 7.8)
- [CVE-2019-9587](https://insights.sbomify.com/CVE-2019-9587/): Denial of service in n/a (high 7.8)
- [CVE-2019-9585](https://insights.sbomify.com/CVE-2019-9585/): Missing authorization in n/a (critical 9.8)
- [CVE-2019-9584](https://insights.sbomify.com/CVE-2019-9584/): Missing authorization in n/a (critical 9.8)
- [CVE-2019-9583](https://insights.sbomify.com/CVE-2019-9583/): Denial of service in n/a (high 8.2)
- [CVE-2019-9582](https://insights.sbomify.com/CVE-2019-9582/): Denial of service in n/a (high 7.5)
- [CVE-2019-9581](https://insights.sbomify.com/CVE-2019-9581/): File upload in n/a (high 8.8)
- [CVE-2019-9580](https://insights.sbomify.com/CVE-2019-9580/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2019-9579](https://insights.sbomify.com/CVE-2019-9579/): Missing authorization in n/a (high 8.1)
- [CVE-2019-9578](https://insights.sbomify.com/CVE-2019-9578/): Information disclosure in n/a (high 7.5)
- [CVE-2019-9576](https://insights.sbomify.com/CVE-2019-9576/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2019-9575](https://insights.sbomify.com/CVE-2019-9575/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2019-9574](https://insights.sbomify.com/CVE-2019-9574/): Missing authorization in n/a (high 7.5)
- [CVE-2019-9573](https://insights.sbomify.com/CVE-2019-9573/): Business logic in n/a (high 7.5)
- [CVE-2019-9572](https://insights.sbomify.com/CVE-2019-9572/): File upload in n/a (high 7.2)
- [CVE-2019-9570](https://insights.sbomify.com/CVE-2019-9570/): Cross-site scripting in n/a (medium 4.8)
- [CVE-2019-9569](https://insights.sbomify.com/CVE-2019-9569/): Memory corruption in n/a (critical 9.8)
- [CVE-2019-9568](https://insights.sbomify.com/CVE-2019-9568/): SQL injection in n/a (medium 6.5)
- [CVE-2019-9567](https://insights.sbomify.com/CVE-2019-9567/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2019-9566](https://insights.sbomify.com/CVE-2019-9566/): SQL injection in n/a (critical 9.8)
- [CVE-2019-9565](https://insights.sbomify.com/CVE-2019-9565/): Information disclosure in n/a (critical 9.1)
- [CVE-2019-9564](https://insights.sbomify.com/CVE-2019-9564/): Authentication bypass in Wyze Cam Pan v2, Cam v2 and Cam v3 (high 7.5)
- [CVE-2019-9563](https://insights.sbomify.com/CVE-2019-9563/): File upload in n/a (high 7.5)
- [CVE-2019-9558](https://insights.sbomify.com/CVE-2019-9558/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2019-9557](https://insights.sbomify.com/CVE-2019-9557/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2019-9556](https://insights.sbomify.com/CVE-2019-9556/): Cross-site scripting in n/a (medium 5.4)
- [CVE-2019-9555](https://insights.sbomify.com/CVE-2019-9555/): Weak cryptography in n/a (medium 5.3)
- [CVE-2019-9554](https://insights.sbomify.com/CVE-2019-9554/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2019-9553](https://insights.sbomify.com/CVE-2019-9553/): Bolt Cross-site Scripting via the slug, teaser or title parameters (medium 6.1)
- [CVE-2019-9552](https://insights.sbomify.com/CVE-2019-9552/): Information disclosure in n/a (critical 9.8)
- [CVE-2019-9551](https://insights.sbomify.com/CVE-2019-9551/): Cross-site scripting in n/a (medium 4.8)
- [CVE-2019-9550](https://insights.sbomify.com/CVE-2019-9550/): Cross-site scripting in n/a (medium 4.8)
- [CVE-2019-9549](https://insights.sbomify.com/CVE-2019-9549/): Cross-site request forgery in n/a (high 8.8)
- [CVE-2019-9548](https://insights.sbomify.com/CVE-2019-9548/): Missing authorization in n/a (critical 10.0)
- [CVE-2019-9547](https://insights.sbomify.com/CVE-2019-9547/): Denial of service in n/a (medium 5.3)
- [CVE-2019-9546](https://insights.sbomify.com/CVE-2019-9546/): Privilege escalation in n/a (critical 9.8)
- [CVE-2019-9545](https://insights.sbomify.com/CVE-2019-9545/): Denial of service in n/a (high 8.8)
- [CVE-2019-9544](https://insights.sbomify.com/CVE-2019-9544/): Memory corruption in n/a (high 8.8)
- [CVE-2019-9543](https://insights.sbomify.com/CVE-2019-9543/): Denial of service in n/a (high 8.8)
- [CVE-2019-9542](https://insights.sbomify.com/CVE-2019-9542/): Telos Automated Message Handling System reflected XSS in itemlookup.asp (medium 6.1)
- [CVE-2019-9541](https://insights.sbomify.com/CVE-2019-9541/): Telos Automated Message Handling System information disclosure in itemlookup.asp (medium 6.1)
- [CVE-2019-9540](https://insights.sbomify.com/CVE-2019-9540/): Telos Automated Message Handling System reflected XSS in prefs.asp (medium 6.1)
- [CVE-2019-9539](https://insights.sbomify.com/CVE-2019-9539/): Telos Automated Message Handling System reflected XSS in ModalWindowPopup.asp (medium 6.1)
- [CVE-2019-9538](https://insights.sbomify.com/CVE-2019-9538/): Telos Automated Message Handling System reflected XSS in LDAP cbURL parameter (medium 6.1)
- [CVE-2019-9537](https://insights.sbomify.com/CVE-2019-9537/): Telos Automated Message Handling System reflected XSS in uploaditem.asp (medium 6.1)
- [CVE-2019-9536](https://insights.sbomify.com/CVE-2019-9536/): Null dereference in iPhone (medium 6.1)
- [CVE-2019-9535](https://insights.sbomify.com/CVE-2019-9535/): iTerm2, up to and including version 3.3.5, with tmux integration is vulnerable to remote command execution (critical 9.8)
- [CVE-2019-9534](https://insights.sbomify.com/CVE-2019-9534/): The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image (high 7.8)
- [CVE-2019-9533](https://insights.sbomify.com/CVE-2019-9533/): The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08 (critical 9.8)
- [CVE-2019-9532](https://insights.sbomify.com/CVE-2019-9532/): The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext (high 7.8)
- [CVE-2019-9531](https://insights.sbomify.com/CVE-2019-9531/): Auth bypass in Explorer 710 (critical 9.8)
- [CVE-2019-9530](https://insights.sbomify.com/CVE-2019-9530/): Missing authorization in Explorer 710 (medium 5.5)
- [CVE-2019-9529](https://insights.sbomify.com/CVE-2019-9529/): The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default (medium 5.5)
- [CVE-2019-9518](https://insights.sbomify.com/CVE-2019-9518/): Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service (high 7.5)
- [CVE-2019-9517](https://insights.sbomify.com/CVE-2019-9517/): Denial of service in n/a (high 7.5)
- [CVE-2019-9516](https://insights.sbomify.com/CVE-2019-9516/): Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service (high 7.5)
- [CVE-2019-9515](https://insights.sbomify.com/CVE-2019-9515/): Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service (high 7.5)
- [CVE-2019-9514](https://insights.sbomify.com/CVE-2019-9514/): Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service (high 7.5)
- [CVE-2019-9513](https://insights.sbomify.com/CVE-2019-9513/): Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service (high 7.5)
- [CVE-2019-9512](https://insights.sbomify.com/CVE-2019-9512/): Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service (high 7.5)
- [CVE-2019-9511](https://insights.sbomify.com/CVE-2019-9511/): Denial of service in n/a (high 7.5)
- [CVE-2019-9510](https://insights.sbomify.com/CVE-2019-9510/): Microsoft Windows RDP can bypass the Windows lock screen (medium 5.3)
- [CVE-2019-9509](https://insights.sbomify.com/CVE-2019-9509/): The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to reflected cross site scripting (medium 6.3)
- [CVE-2019-9508](https://insights.sbomify.com/CVE-2019-9508/): Vertiv Avocent UMG-4000 version 4.2.1.19 web interface is vulnerable to stored cross site scripting (medium 6.3)
- [CVE-2019-9507](https://insights.sbomify.com/CVE-2019-9507/): The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to arbitrary remote code execution (high 8.3)
- [CVE-2019-9506](https://insights.sbomify.com/CVE-2019-9506/): Weak cryptography in BR/EDR (high 7.6)
- [CVE-2019-9505](https://insights.sbomify.com/CVE-2019-9505/): PrinterLogic Print Management Software does not sanitize special characters (critical 9.8)
- [CVE-2019-9503](https://insights.sbomify.com/CVE-2019-9503/): Broadcom brcmfmac driver is vulnerable to a frame validation bypass (high 7.9)
- [CVE-2019-9502](https://insights.sbomify.com/CVE-2019-9502/): Broadcom wl driver is vulnerable to heap buffer overflow (high 7.9)
- [CVE-2019-9501](https://insights.sbomify.com/CVE-2019-9501/): Broadcom wl driver is vulnerable to heap buffer overflow (high 7.9)
- [CVE-2019-9500](https://insights.sbomify.com/CVE-2019-9500/): Broadcom brcmfmac driver is vulnerable to a heap buffer overflow (high 7.9)
- [CVE-2019-9499](https://insights.sbomify.com/CVE-2019-9499/): Auth bypass in hostapd with EAP-pwd support (high 8.1)
- [CVE-2019-9498](https://insights.sbomify.com/CVE-2019-9498/): The implementations of EAP-PWD in hostapd EAP Server do not validate the scalar and element values in EAP-pwd-Commit (high 8.1)
- [CVE-2019-9497](https://insights.sbomify.com/CVE-2019-9497/): Auth bypass in hostapd with EAP-pwd support (high 8.1)
- [CVE-2019-9496](https://insights.sbomify.com/CVE-2019-9496/): Denial of service in hostapd with SAE support (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/6/