# Vulnerabilities published in 2019


- [CVE-2019-25221](https://insights.sbomify.com/CVE-2019-25221/): Responsive Filterable Portfolio <=1.0.8 - Authenticated (Admin+) SQL Injection (medium 6.5)
- [CVE-2019-25220](https://insights.sbomify.com/CVE-2019-25220/): Denial of service in bitcoin:bitcoin core (high 7.5)
- [CVE-2019-2522](https://insights.sbomify.com/CVE-2019-2522/): Other in VM VirtualBox (high 7.8)
- [CVE-2019-25219](https://insights.sbomify.com/CVE-2019-25219/): Asio C++ Library before 1.13.0 lacks a fallback error code in the case of SSL_ERROR_SYSCALL with no associated error information from the SSL library being used. (high 7.5)
- [CVE-2019-25218](https://insights.sbomify.com/CVE-2019-25218/): Photo Gallery Slideshow & Masonry Tiled Gallery <= 1.0.3 - Authenticated (Admin+) SQL Injection (medium 4.9)
- [CVE-2019-25217](https://insights.sbomify.com/CVE-2019-25217/): SiteGround Optimizer <= 5.0.12 - Missing Authorization (critical 9.8)
- [CVE-2019-25216](https://insights.sbomify.com/CVE-2019-25216/): Rich Reviews <= 1.7.4 - Stored Cross-Site Scripting (high 7.2)
- [CVE-2019-25215](https://insights.sbomify.com/CVE-2019-25215/): ARI-Adminer <= 1.1.14 - Missing Authorization and No Direct File Access Restrictions (high 7.3)
- [CVE-2019-25214](https://insights.sbomify.com/CVE-2019-25214/): ShopWP <= 2.0.4 - Missing Authorization to Stored Cross-Site Scripting (high 7.2)
- [CVE-2019-25213](https://insights.sbomify.com/CVE-2019-25213/): Advanced Access Manager <= 5.9.8.1 - Unauthenticated Arbitrary File Read (critical 9.8)
- [CVE-2019-25212](https://insights.sbomify.com/CVE-2019-25212/): video carousel slider with lightbox <= 1.0.6 - Authenticated (Admin+) SQL Injection (medium 4.9)
- [CVE-2019-25211](https://insights.sbomify.com/CVE-2019-25211/): Gin mishandles a wildcard at the end of an origin string (critical 9.1)
- [CVE-2019-25210](https://insights.sbomify.com/CVE-2019-25210/): Information disclosure in helm:helm (critical 9.1)
- [CVE-2019-2521](https://insights.sbomify.com/CVE-2019-2521/): Other in VM VirtualBox (high 7.8)
- [CVE-2019-2520](https://insights.sbomify.com/CVE-2019-2520/): Other in VM VirtualBox (high 7.8)
- [CVE-2019-2519](https://insights.sbomify.com/CVE-2019-2519/): Cross-site scripting in PeopleSoft Enterprise SCM eProcurement (medium 6.1)
- [CVE-2019-2518](https://insights.sbomify.com/CVE-2019-2518/): Other in Oracle Database (high 7.5)
- [CVE-2019-2517](https://insights.sbomify.com/CVE-2019-2517/): Other in Oracle Database (critical 9.1)
- [CVE-2019-25162](https://insights.sbomify.com/CVE-2019-25162/): i2c: Fix a potential use after free (high 7.8)
- [CVE-2019-25160](https://insights.sbomify.com/CVE-2019-25160/): netlabel: fix out-of-bounds memory accesses (critical 9.1)
- [CVE-2019-2516](https://insights.sbomify.com/CVE-2019-2516/): Other in Oracle Database (high 8.2)
- [CVE-2019-25159](https://insights.sbomify.com/CVE-2019-25159/): mpedraza2020 Intranet del Monterroso cargos.php sql injection (medium 5.5)
- [CVE-2019-25158](https://insights.sbomify.com/CVE-2019-25158/): pedroetb tts-api app.js onSpeechDone os command injection (medium 5.5)
- [CVE-2019-25157](https://insights.sbomify.com/CVE-2019-25157/): Ethex Contracts Monthly Jackpot EthexJackpot.sol access control (medium 4.3)
- [CVE-2019-25156](https://insights.sbomify.com/CVE-2019-25156/): dstar2018 Agency search.php cross site scripting (low 3.5)
- [CVE-2019-25155](https://insights.sbomify.com/CVE-2019-25155/): DOMPurify Open Redirect vulnerability (medium 6.1)
- [CVE-2019-25154](https://insights.sbomify.com/CVE-2019-25154/): Security feature bypass in Chrome (medium 5.3)
- [CVE-2019-25152](https://insights.sbomify.com/CVE-2019-25152/): Cross-site scripting in Abandoned Cart Lite for WooCommerce (high 7.2)
- [CVE-2019-25151](https://insights.sbomify.com/CVE-2019-25151/): Funnel Builder <= 1.3.0 - Arbitrary Plugin Activation (medium 5.4)
- [CVE-2019-25150](https://insights.sbomify.com/CVE-2019-25150/): Email Templates <= 1.3 - HTML Injection (high 8.8)
- [CVE-2019-25149](https://insights.sbomify.com/CVE-2019-25149/): Gallery Images Ape <= 2.0.6 - Authenticated Plugin Deactivation (high 7.6)
- [CVE-2019-25148](https://insights.sbomify.com/CVE-2019-25148/): WP HTML Mail < 2.9.1 - HTML Injection (medium 6.1)
- [CVE-2019-25147](https://insights.sbomify.com/CVE-2019-25147/): Pretty Links <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via track_link (high 7.2)
- [CVE-2019-25146](https://insights.sbomify.com/CVE-2019-25146/): DELUCKS SEO < 2.1.8 - Stored Cross Site Scripting (high 7.2)
- [CVE-2019-25145](https://insights.sbomify.com/CVE-2019-25145/): Contact Form & SMTP Plugin by PirateForms <= 2.5.1 - Unauthenticated HTML injection (high 7.2)
- [CVE-2019-25144](https://insights.sbomify.com/CVE-2019-25144/): WP HTML Mail < 2.2.11 - HTML injection (medium 5.4)
- [CVE-2019-25143](https://insights.sbomify.com/CVE-2019-25143/): GDPR Cookie Compliance <= 4.0.2 - Missing Authorization (medium 5.4)
- [CVE-2019-25142](https://insights.sbomify.com/CVE-2019-25142/): Mesmerize <= 1.6.89 & Materialis <= 1.0.172 - Authenticated Arbitrary Options Update (high 8.8)
- [CVE-2019-25141](https://insights.sbomify.com/CVE-2019-25141/): Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update (critical 9.8)
- [CVE-2019-25140](https://insights.sbomify.com/CVE-2019-25140/): Coming Soon Page & Maintenance Mode <= 1.8.1 - Stored Cross Site Scripting (high 7.2)
- [CVE-2019-25139](https://insights.sbomify.com/CVE-2019-25139/): Coming Soon Page & Maintenance Mode <= 1.8.1 - Unauthenticated Settings Reset (medium 6.5)
- [CVE-2019-25138](https://insights.sbomify.com/CVE-2019-25138/): User Submitted Posts <= 20190312 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2019-25137](https://insights.sbomify.com/CVE-2019-25137/): Code injection in umbraco:umbraco cms (high 7.2)
- [CVE-2019-25136](https://insights.sbomify.com/CVE-2019-25136/): Code injection in Firefox (critical 10.0)
- [CVE-2019-2513](https://insights.sbomify.com/CVE-2019-2513/): Other in MySQL Server (low 2.5)
- [CVE-2019-2512](https://insights.sbomify.com/CVE-2019-2512/): Other in Primavera P6 Enterprise Project Portfolio Management (medium 4.7)
- [CVE-2019-2511](https://insights.sbomify.com/CVE-2019-2511/): Denial of service in VM VirtualBox (high 7.5)
- [CVE-2019-25105](https://insights.sbomify.com/CVE-2019-25105/): dro.pm fileman.php cross site scripting (low 3.5)
- [CVE-2019-25104](https://insights.sbomify.com/CVE-2019-25104/): rtcwcoop Team Command ai_cast_script.c AICast_ScriptLoad denial of service (low 3.5)
- [CVE-2019-25103](https://insights.sbomify.com/CVE-2019-25103/): simple-markdown simple-markdown.js redos (medium 4.3)
- [CVE-2019-25102](https://insights.sbomify.com/CVE-2019-25102/): simple-markdown simple-markdown.js redos (medium 4.3)
- [CVE-2019-25101](https://insights.sbomify.com/CVE-2019-25101/): OnShift TurboGears HTTP Header controllers.py response splitting (medium 6.3)
- [CVE-2019-25100](https://insights.sbomify.com/CVE-2019-25100/): happyman twmap pointdata2.php sql injection (medium 5.5)
- [CVE-2019-2510](https://insights.sbomify.com/CVE-2019-2510/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2019-25099](https://insights.sbomify.com/CVE-2019-25099/): Arthmoor QSF-Portal index.php path traversal (medium 5.5)
- [CVE-2019-25098](https://insights.sbomify.com/CVE-2019-25098/): soerennb eXtplorer Archive archive.php path traversal (medium 5.5)
- [CVE-2019-25097](https://insights.sbomify.com/CVE-2019-25097/): soerennb eXtplorer Directory Content path traversal (medium 5.5)
- [CVE-2019-25096](https://insights.sbomify.com/CVE-2019-25096/): soerennb eXtplorer cross site scripting (low 3.5)
- [CVE-2019-25095](https://insights.sbomify.com/CVE-2019-25095/): kakwa LdapCherry URL cross site scripting (low 3.5)
- [CVE-2019-25094](https://insights.sbomify.com/CVE-2019-25094/): innologi appointments Extension Appointment cross site scripting (low 3.5)
- [CVE-2019-25093](https://insights.sbomify.com/CVE-2019-25093/): dragonexpert Recent Threads on Index Setting hooks.php recentthread_list_threads cross site scripting (low 2.4)
- [CVE-2019-25092](https://insights.sbomify.com/CVE-2019-25092/): Nakiami Mellivora Admin Panel user.inc.php print_user_ip_log cross site scripting (low 2.4)
- [CVE-2019-25091](https://insights.sbomify.com/CVE-2019-25091/): nsupdate.info CSRF Cookie base.py cookie httponly flag (low 3.7)
- [CVE-2019-25090](https://insights.sbomify.com/CVE-2019-25090/): FreePBX arimanager Views cross site scripting (low 3.5)
- [CVE-2019-2509](https://insights.sbomify.com/CVE-2019-2509/): Denial of service in VM VirtualBox (medium 6.5)
- [CVE-2019-25089](https://insights.sbomify.com/CVE-2019-25089/): Morgawr Muon handler.clj random values (low 3.1)
- [CVE-2019-25088](https://insights.sbomify.com/CVE-2019-25088/): ytti Oxidized Web conf_search.haml cross site scripting (low 3.5)
- [CVE-2019-25087](https://insights.sbomify.com/CVE-2019-25087/): RamseyK httpserver URI ResourceHost.cpp getResource path traversal (medium 5.3)
- [CVE-2019-25086](https://insights.sbomify.com/CVE-2019-25086/): IET-OU Open Media Player timedtext.php webvtt cross site scripting (low 3.5)
- [CVE-2019-25085](https://insights.sbomify.com/CVE-2019-25085/): GNOME gvdb gvdb-builder.c gvdb_table_write_contents_async use after free (medium 6.3)
- [CVE-2019-25084](https://insights.sbomify.com/CVE-2019-25084/): Hide Files on GitHub options.js addEventListener cross site scripting (low 3.5)
- [CVE-2019-2508](https://insights.sbomify.com/CVE-2019-2508/): Denial of service in VM VirtualBox (medium 6.5)
- [CVE-2019-25078](https://insights.sbomify.com/CVE-2019-25078/): pacparser pacparser.c pacparser_find_proxy buffer overflow (medium 5.3)
- [CVE-2019-25076](https://insights.sbomify.com/CVE-2019-25076/): Denial of service in openvswitch:openvswitch (medium 5.8)
- [CVE-2019-25075](https://insights.sbomify.com/CVE-2019-25075/): Path Traversal in Gravitee API Management (medium 6.1)
- [CVE-2019-25073](https://insights.sbomify.com/CVE-2019-25073/): Path traversal in github.com/goadesign/goa (high 7.5)
- [CVE-2019-25072](https://insights.sbomify.com/CVE-2019-25072/): Uncontrolled resource consumption in github.com/tendermint/tendermint (high 7.5)
- [CVE-2019-25071](https://insights.sbomify.com/CVE-2019-25071/): Apple iOS Siri Self privileges management (medium 6.3)
- [CVE-2019-25070](https://insights.sbomify.com/CVE-2019-25070/): WolfCMS User Add cross site scripting (low 3.5)
- [CVE-2019-2507](https://insights.sbomify.com/CVE-2019-2507/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2019-25069](https://insights.sbomify.com/CVE-2019-25069/): Axios Italia Axios RE Error Message ASP.NET information disclosure (medium 5.3)
- [CVE-2019-25068](https://insights.sbomify.com/CVE-2019-25068/): Axios Italia Axios RE Connection REDefault.aspx privileges management (medium 6.3)
- [CVE-2019-25067](https://insights.sbomify.com/CVE-2019-25067/): Podman/Varlink API Privilege Escalation (medium 6.3)
- [CVE-2019-25066](https://insights.sbomify.com/CVE-2019-25066/): ajenti API privileges management (medium 6.3)
- [CVE-2019-25065](https://insights.sbomify.com/CVE-2019-25065/): OpenNetAdmin os command injection (medium 6.3)
- [CVE-2019-25064](https://insights.sbomify.com/CVE-2019-25064/): CoreHR Core Portal cross-site request forgery (medium 4.3)
- [CVE-2019-25063](https://insights.sbomify.com/CVE-2019-25063/): Sricam IP CCTV Camera Device Viewer memory corruption (medium 5.3)
- [CVE-2019-25062](https://insights.sbomify.com/CVE-2019-25062/): Sricam IP CCTV Camera Device Viewer stack-based overflow (medium 5.3)
- [CVE-2019-25061](https://insights.sbomify.com/CVE-2019-25061/): Insecure PRNG use in random_password_generator (high 7.5)
- [CVE-2019-25060](https://insights.sbomify.com/CVE-2019-25060/): WP-GraphQL < 0.3.5 - Improper Access Control (medium 5.3)
- [CVE-2019-2506](https://insights.sbomify.com/CVE-2019-2506/): Information disclosure in VM VirtualBox (low 3.8)
- [CVE-2019-25059](https://insights.sbomify.com/CVE-2019-25059/): Other in artifex:ghostscript (high 7.8)
- [CVE-2019-25058](https://insights.sbomify.com/CVE-2019-25058/): Missing authorization in debian:debian linux (high 7.8)
- [CVE-2019-25057](https://insights.sbomify.com/CVE-2019-25057/): Deserialization in r3:corda (high 7.5)
- [CVE-2019-25056](https://insights.sbomify.com/CVE-2019-25056/): Information disclosure in bromite:bromite (medium 5.3)
- [CVE-2019-25055](https://insights.sbomify.com/CVE-2019-25055/): Duplicate Advisory: Uncaught Exception in libpulse-binding (high 7.5)
- [CVE-2019-25054](https://insights.sbomify.com/CVE-2019-25054/): Missing Initialization of Resource in pnet (high 7.5)
- [CVE-2019-25053](https://insights.sbomify.com/CVE-2019-25053/): Path traversal in sage:sage frp 1000 (high 7.5)
- [CVE-2019-25052](https://insights.sbomify.com/CVE-2019-25052/): Weak cryptography in trustedfirmware:op-tee (critical 9.1)
- [CVE-2019-25051](https://insights.sbomify.com/CVE-2019-25051/): Memory corruption in debian:debian linux (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/61/