# Vulnerabilities published in 2019


- [CVE-2019-25312](https://insights.sbomify.com/CVE-2019-25312/): InoERP 0.7.2 - Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2019-25311](https://insights.sbomify.com/CVE-2019-25311/): thesystem Persistent XSS (medium 5.1)
- [CVE-2019-25310](https://insights.sbomify.com/CVE-2019-25310/): ActiveFax Server 6.92 Build 0316 - 'ActiveFaxServiceNT' Unquoted Service Path (high 8.5)
- [CVE-2019-2531](https://insights.sbomify.com/CVE-2019-2531/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2019-25309](https://insights.sbomify.com/CVE-2019-25309/): Zilab Remote Console Server 3.2.9 - 'Zilab Remote Console Server' Unquoted Service Path (high 8.5)
- [CVE-2019-25308](https://insights.sbomify.com/CVE-2019-25308/): Mikogo 5.2.2.150317 - 'Mikogo-Service' Unquoted Service Path (high 8.5)
- [CVE-2019-25307](https://insights.sbomify.com/CVE-2019-25307/): WorkgroupMail 7.5.1 - 'WorkgroupMail' Unquoted Service Path (high 8.5)
- [CVE-2019-25306](https://insights.sbomify.com/CVE-2019-25306/): BlackMoon FTP Server 3.1.2.1731 - 'BMFTP-RELEASE' Unquoted Serive Path (high 8.5)
- [CVE-2019-25305](https://insights.sbomify.com/CVE-2019-25305/): JumpStart 0.6.0.0 - 'jswpbapi' Unquoted Service Path (high 8.5)
- [CVE-2019-25304](https://insights.sbomify.com/CVE-2019-25304/): Intelligent Security System SecurOS Enterprise 10.2 - 'SecurosCtrlService' Unquoted Service Path (high 8.5)
- [CVE-2019-25303](https://insights.sbomify.com/CVE-2019-25303/): TheJshen contentManagementSystem 1.04 - 'id' SQL Injection (high 7.1)
- [CVE-2019-25302](https://insights.sbomify.com/CVE-2019-25302/): Acer Launch Manager 6.1.7600.16385 - 'DsiWMIService' Unquoted Service Path (high 8.5)
- [CVE-2019-25301](https://insights.sbomify.com/CVE-2019-25301/): thrsrossi Millhouse-Project 1.414 - 'content' Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2019-25300](https://insights.sbomify.com/CVE-2019-25300/): thejshen Globitek CMS 1.4 - 'id' SQL Injection (high 7.1)
- [CVE-2019-2530](https://insights.sbomify.com/CVE-2019-2530/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2019-25299](https://insights.sbomify.com/CVE-2019-25299/): rimbalinux AhadPOS 1.11 - 'alamatCustomer' SQL Injection (high 7.1)
- [CVE-2019-25298](https://insights.sbomify.com/CVE-2019-25298/): html5_snmp 1.11 - 'Router_ID' SQL Injection (high 7.1)
- [CVE-2019-25297](https://insights.sbomify.com/CVE-2019-25297/): Poll, Survey & Quiz Maker Plugin by Opinion Stage < 19.6.25 Stored XSS (medium 5.1)
- [CVE-2019-25296](https://insights.sbomify.com/CVE-2019-25296/): WP Cost Estimation <= 9.642 - Missing Authorization to Arbitrary File Upload/Delete (critical 9.8)
- [CVE-2019-25295](https://insights.sbomify.com/CVE-2019-25295/): WP Cost Estimation < 9.660 - Upload Directory Traversal (medium 6.5)
- [CVE-2019-25294](https://insights.sbomify.com/CVE-2019-25294/): html5_snmp 1.11 - 'Remark' Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2019-25293](https://insights.sbomify.com/CVE-2019-25293/): Blue Stacks App Player 2.4.44.62.57 - "BstHdLogRotatorSvc" Unquote Service Path (high 8.5)
- [CVE-2019-25292](https://insights.sbomify.com/CVE-2019-25292/): Alps HID Monitor Service 8.1.0.10 - 'ApHidMonitorService' Unquote Service Path (high 8.5)
- [CVE-2019-25291](https://insights.sbomify.com/CVE-2019-25291/): INIM Electronics Smartliving SmartLAN/G/SI <=6.x Hard-coded Credentials Vulnerability (critical 9.3)
- [CVE-2019-25290](https://insights.sbomify.com/CVE-2019-25290/): INIM Electronics Smartliving SmartLAN/G/SI <=6.x Unauthenticated SSRF via GetImage (medium 6.9)
- [CVE-2019-2529](https://insights.sbomify.com/CVE-2019-2529/): Denial of service in MySQL Server (medium 6.5)
- [CVE-2019-25289](https://insights.sbomify.com/CVE-2019-25289/): INIM Electronics SmartLiving SmartLAN/G/SI <=6.x Remote Command Execution (high 8.7)
- [CVE-2019-25288](https://insights.sbomify.com/CVE-2019-25288/): Wacom WTabletService 6.6.7-3 - 'WTabletServicePro' Unquoted Service Path (high 8.5)
- [CVE-2019-25287](https://insights.sbomify.com/CVE-2019-25287/): Adaware Web Companion version 4.8.2078.3950 - 'WCAssistantService' Unquoted Service Path (high 8.5)
- [CVE-2019-25286](https://insights.sbomify.com/CVE-2019-25286/): _GCafé 3.0 - 'gbClienService' Unquoted Service Path (high 8.5)
- [CVE-2019-25285](https://insights.sbomify.com/CVE-2019-25285/): Alps Pointing-device Controller 8.1202.1711.04 - 'ApHidMonitorService' Unquoted Service Path (high 8.5)
- [CVE-2019-25284](https://insights.sbomify.com/CVE-2019-25284/): V-SOL GPON/EPON OLT Platform V2.03.62R_IPv6 v2.03 Reflected Cross-Site Scripting Vulnerability (medium 5.1)
- [CVE-2019-25283](https://insights.sbomify.com/CVE-2019-25283/): Shrew Soft VPN Client 2.2.2 - 'iked' Unquoted Service Path (high 8.5)
- [CVE-2019-25282](https://insights.sbomify.com/CVE-2019-25282/): V-SOL GPON/EPON OLT Platform V2.03.62R_IPv6 v2.03 Open Redirect via bindProfile.html (medium 5.1)
- [CVE-2019-25281](https://insights.sbomify.com/CVE-2019-25281/): NCP_Secure_Entry_Client 9.2 - Unquoted Service Paths (high 8.5)
- [CVE-2019-25280](https://insights.sbomify.com/CVE-2019-25280/): Yahei-PHP Prober 0.4.7 Remote HTML Injection via Speed Parameter (medium 5.1)
- [CVE-2019-2528](https://insights.sbomify.com/CVE-2019-2528/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2019-25279](https://insights.sbomify.com/CVE-2019-25279/): FaceSentry Access Control System 6.4.8 Cleartext Password Storage Vulnerability (medium 6.8)
- [CVE-2019-25278](https://insights.sbomify.com/CVE-2019-25278/): FaceSentry Access Control System 6.4.8 Authentication Credentials MiTM Disclosure (critical 9.1)
- [CVE-2019-25277](https://insights.sbomify.com/CVE-2019-25277/): FaceSentry Access Control System 6.4.8 Reflected Cross-Site Scripting via pluginInstall.php (medium 5.1)
- [CVE-2019-25276](https://insights.sbomify.com/CVE-2019-25276/): Studio 5000 Logix Designer 30.01.00 - 'FactoryTalk Activation Service' Unquoted Service Path (high 8.5)
- [CVE-2019-25275](https://insights.sbomify.com/CVE-2019-25275/): BartVPN 1.2.2 - 'BartVPNService' Unquoted Service Path (high 8.5)
- [CVE-2019-25274](https://insights.sbomify.com/CVE-2019-25274/): ProShow Producer 9.0.3797 - Unquoted Service Path (high 8.5)
- [CVE-2019-25273](https://insights.sbomify.com/CVE-2019-25273/): Easy-Hide-IP 5.0.0.3 - 'EasyRedirect' Unquoted Service Path (high 8.5)
- [CVE-2019-25272](https://insights.sbomify.com/CVE-2019-25272/): TexasSoft CyberPlanet 6.4.131 - 'CCSrvProxy' Unquoted Service Path (high 8.5)
- [CVE-2019-25271](https://insights.sbomify.com/CVE-2019-25271/): NETGATE Data Backup 3.0.620 - 'NGDatBckpSrv' Unquoted Service Path (high 8.5)
- [CVE-2019-25270](https://insights.sbomify.com/CVE-2019-25270/): SOCA Access Control System 180612 Reflected Cross-Site Scripting via logged_page.php (medium 5.1)
- [CVE-2019-2527](https://insights.sbomify.com/CVE-2019-2527/): Denial of service in VM VirtualBox (medium 6.5)
- [CVE-2019-25269](https://insights.sbomify.com/CVE-2019-25269/): Amiti Antivirus 25.0.640 - Unquoted Service Path Vulnerability (high 8.5)
- [CVE-2019-25268](https://insights.sbomify.com/CVE-2019-25268/): NREL BEopt 2.8.0 Insecure Library Loading Arbitrary Code Execution (high 8.6)
- [CVE-2019-25267](https://insights.sbomify.com/CVE-2019-25267/): Wing FTP Server 6.0.7 - Unquoted Service Path (high 8.5)
- [CVE-2019-25266](https://insights.sbomify.com/CVE-2019-25266/): Wondershare Application Framework Service 2.4.3.231 - 'WsAppService' Unquote Service Path (high 8.5)
- [CVE-2019-25265](https://insights.sbomify.com/CVE-2019-25265/): Online Inventory Manager 3.2 - Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2019-25264](https://insights.sbomify.com/CVE-2019-25264/): Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2019-25263](https://insights.sbomify.com/CVE-2019-25263/): Zendesk App SweetHawk Survey 1.6 - Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2019-25262](https://insights.sbomify.com/CVE-2019-25262/): elinicksic Razgover Chat Message send.php cross site scripting (medium 5.1)
- [CVE-2019-25261](https://insights.sbomify.com/CVE-2019-25261/): AnyDesk 5.4.0 - Unquoted Service Path (high 8.5)
- [CVE-2019-25260](https://insights.sbomify.com/CVE-2019-25260/): OXID eShop 6.3.4 - 'sorting' SQL Injection (high 8.8)
- [CVE-2019-2526](https://insights.sbomify.com/CVE-2019-2526/): Other in VM VirtualBox (high 7.8)
- [CVE-2019-25259](https://insights.sbomify.com/CVE-2019-25259/): Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 Cross-Site Request Forgery (medium 5.1)
- [CVE-2019-25258](https://insights.sbomify.com/CVE-2019-25258/): LogicalDOC Enterprise 7.7.4 Multiple Post-Authentication Directory Traversal Vulnerabilities (high 7.1)
- [CVE-2019-25257](https://insights.sbomify.com/CVE-2019-25257/): LogicalDOC Enterprise 7.7.4 Authenticated Command Execution via Binary Path Manipulation (high 8.7)
- [CVE-2019-25256](https://insights.sbomify.com/CVE-2019-25256/): VideoFlow Digital Video Protection DVP 2.10 Authenticated Directory Traversal (high 7.1)
- [CVE-2019-25255](https://insights.sbomify.com/CVE-2019-25255/): VideoFlow Digital Video Protection DVP 2.10 Authenticated Remote Code Execution (high 8.7)
- [CVE-2019-25254](https://insights.sbomify.com/CVE-2019-25254/): KYOCERA Net Admin 3.4.0906 Cross-Site Request Forgery via User Administration (medium 5.1)
- [CVE-2019-25253](https://insights.sbomify.com/CVE-2019-25253/): KYOCERA Net Admin 3.4.0906 Unauthenticated XML External Entity Injection (high 7.1)
- [CVE-2019-25252](https://insights.sbomify.com/CVE-2019-25252/): Teradek VidiU Pro 3.0.3 Cross-Site Request Forgery via Password Change (medium 5.1)
- [CVE-2019-25251](https://insights.sbomify.com/CVE-2019-25251/): Teradek VidiU Pro 3.0.3 Server-Side Request Forgery via RTMP Settings (medium 6.9)
- [CVE-2019-25250](https://insights.sbomify.com/CVE-2019-25250/): Devolo dLAN 500 AV Wireless+ 3.1.0-1 Cross-Site Request Forgery (medium 5.1)
- [CVE-2019-2525](https://insights.sbomify.com/CVE-2019-2525/): Information disclosure in VM VirtualBox (medium 5.6)
- [CVE-2019-25249](https://insights.sbomify.com/CVE-2019-25249/): devolo dLAN 500 AV Wireless+ 3.1.0-1 Remote Code Execution via htmlmgr (high 8.7)
- [CVE-2019-25248](https://insights.sbomify.com/CVE-2019-25248/): Beward N100 M2.1.6 Unauthenticated RTSP Video Stream Disclosure (high 8.7)
- [CVE-2019-25247](https://insights.sbomify.com/CVE-2019-25247/): Beward N100 H.264 VGA IP Camera M2.1.6 CSRF Add Admin Vulnerability (medium 5.1)
- [CVE-2019-25246](https://insights.sbomify.com/CVE-2019-25246/): Beward N100 H.264 VGA IP Camera M2.1.6 Authenticated File Disclosure (high 7.1)
- [CVE-2019-25245](https://insights.sbomify.com/CVE-2019-25245/): Ross Video DashBoard 8.5.1 Privilege Escalation via Insecure Permissions (high 8.5)
- [CVE-2019-25244](https://insights.sbomify.com/CVE-2019-25244/): Legrand BTicino Driver Manager F454 1.0.51 CSRF and Stored XSS Vulnerabilities (medium 5.1)
- [CVE-2019-25243](https://insights.sbomify.com/CVE-2019-25243/): FaceSentry 6.4.8 Authenticated Remote Command Injection via Ping Test (high 8.7)
- [CVE-2019-25242](https://insights.sbomify.com/CVE-2019-25242/): FaceSentry Access Control System 6.4.8 Cross-Site Request Forgery via Web Interface (medium 5.1)
- [CVE-2019-25241](https://insights.sbomify.com/CVE-2019-25241/): FaceSentry Access Control System 6.4.8 Remote SSH Root Access (critical 9.8)
- [CVE-2019-25240](https://insights.sbomify.com/CVE-2019-25240/): Missing authorization in DVR (high 8.7)
- [CVE-2019-2524](https://insights.sbomify.com/CVE-2019-2524/): Other in VM VirtualBox (high 8.8)
- [CVE-2019-25239](https://insights.sbomify.com/CVE-2019-25239/): V-SOL GPON/EPON OLT Platform 2.03 Unauthenticated Configuration Download (high 8.7)
- [CVE-2019-25238](https://insights.sbomify.com/CVE-2019-25238/): V-SOL GPON/EPON OLT Platform 2.03 Cross-Site Request Forgery Vulnerability (medium 5.1)
- [CVE-2019-25237](https://insights.sbomify.com/CVE-2019-25237/): V-SOL GPON/EPON OLT Platform 2.03 Privilege Escalation via User Role Parameter (high 8.7)
- [CVE-2019-25236](https://insights.sbomify.com/CVE-2019-25236/): iSeeQ Hybrid DVR WH-H4 1.03R Unauthenticated Live Stream Disclosure (high 8.7)
- [CVE-2019-25235](https://insights.sbomify.com/CVE-2019-25235/): Smartwares HOME easy 1.0.9 Client-Side Authentication Bypass via Web Pages (high 8.8)
- [CVE-2019-25234](https://insights.sbomify.com/CVE-2019-25234/): Carlo Gavazzi SmartHouse Webapp 6.5.33 Cross-Site Request Forgery and XSS (medium 5.1)
- [CVE-2019-25233](https://insights.sbomify.com/CVE-2019-25233/): AVE DOMINAplus 1.10.x Cross-Site Request Forgery and XSS Vulnerabilities (medium 5.1)
- [CVE-2019-25232](https://insights.sbomify.com/CVE-2019-25232/): NetPCLinker 1.0.0.0 - Buffer Overflow (high 8.4)
- [CVE-2019-25231](https://insights.sbomify.com/CVE-2019-25231/): devolo dLAN Cockpit 4.3.1 Unquoted Service Path Privilege Escalation (high 8.5)
- [CVE-2019-25230](https://insights.sbomify.com/CVE-2019-25230/): Kentico Xperience <= 12.0.0 User Widget Information Disclosure (medium 5.3)
- [CVE-2019-2523](https://insights.sbomify.com/CVE-2019-2523/): Other in VM VirtualBox (high 7.8)
- [CVE-2019-25229](https://insights.sbomify.com/CVE-2019-25229/): Kentico Xperience <= 12.0.29 MVC Forms Unrestricted File Upload (high 8.7)
- [CVE-2019-25228](https://insights.sbomify.com/CVE-2019-25228/): Kentico Xperience <= 12.0.47 Virtual Context Information Disclosure (medium 5.1)
- [CVE-2019-25227](https://insights.sbomify.com/CVE-2019-25227/): Tellion HN-2204AP Unauthenticated Configuration Disclosure (high 8.7)
- [CVE-2019-25226](https://insights.sbomify.com/CVE-2019-25226/): Dongyoung Media DM-AP240T/W Unauthenticated Configuration Disclosure (high 8.7)
- [CVE-2019-25225](https://insights.sbomify.com/CVE-2019-25225/): sanitize-html is vulnerable to XSS through incomprehensive sanitization (medium 6.1)
- [CVE-2019-25224](https://insights.sbomify.com/CVE-2019-25224/): WP Database Backup < 5.2 - Unauthenticated OS Command Injection (critical 9.8)
- [CVE-2019-25223](https://insights.sbomify.com/CVE-2019-25223/): Team Circle Image Slider With Lightbox <= 1.0.4 - Authenticated (Admin+) SQL Injection (medium 4.9)
- [CVE-2019-25222](https://insights.sbomify.com/CVE-2019-25222/): Thumbnail carousel slider <= 1.0.4 - Authenticated (Admin+) SQL Injection (medium 4.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/60/