# Vulnerabilities published in 2019


- [CVE-2019-19781](https://insights.sbomify.com/CVE-2019-19781/): Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution (critical 9.8, exploited in the wild)
- [CVE-2019-1978](https://insights.sbomify.com/CVE-2019-1978/): Cisco Firepower Threat Defense Software Stream Reassembly Bypass Vulnerability (medium 5.8)
- [CVE-2019-19778](https://insights.sbomify.com/CVE-2019-19778/): Memory corruption in saitoha:libsixel (high 8.8)
- [CVE-2019-19777](https://insights.sbomify.com/CVE-2019-19777/): Memory corruption in nothings:stb image.h (high 8.8)
- [CVE-2019-19775](https://insights.sbomify.com/CVE-2019-19775/): Open redirect in zulip:zulip server (medium 6.1)
- [CVE-2019-19774](https://insights.sbomify.com/CVE-2019-19774/): Security feature bypass in zohocorp:manageengine eventlog analyzer (high 8.8)
- [CVE-2019-19773](https://insights.sbomify.com/CVE-2019-19773/): Cross-site scripting in lexmark:6500e firmware (medium 5.4)
- [CVE-2019-19772](https://insights.sbomify.com/CVE-2019-19772/): Cross-site scripting in lexmark:6500e firmware (medium 5.4)
- [CVE-2019-19771](https://insights.sbomify.com/CVE-2019-19771/): lodahs is malware (high 8.8)
- [CVE-2019-19770](https://insights.sbomify.com/CVE-2019-19770/): Use after free in linux:linux kernel (high 8.2)
- [CVE-2019-1977](https://insights.sbomify.com/CVE-2019-1977/): Cisco Nexus 9000 Series Fabric Switches ACI Mode Border Leaf Endpoint Learning Vulnerability (medium 6.8)
- [CVE-2019-19769](https://insights.sbomify.com/CVE-2019-19769/): Use after free in fedoraproject:fedora (medium 6.7)
- [CVE-2019-19768](https://insights.sbomify.com/CVE-2019-19768/): Use after free in linux:linux kernel (high 7.5)
- [CVE-2019-19767](https://insights.sbomify.com/CVE-2019-19767/): Use after free in linux:linux kernel (medium 5.5)
- [CVE-2019-19766](https://insights.sbomify.com/CVE-2019-19766/): Weak cryptography in bitwarden:server (high 7.5)
- [CVE-2019-1976](https://insights.sbomify.com/CVE-2019-1976/): Cisco Industrial Network Director Configuration Data Information Disclosure Vulnerability (high 7.5)
- [CVE-2019-19758](https://insights.sbomify.com/CVE-2019-19758/): Open redirect in EZ Media & Backup Center ix2 (medium 6.1)
- [CVE-2019-19757](https://insights.sbomify.com/CVE-2019-19757/): Cross-site scripting in XClarity Administrator (LXCA) (medium 5.4)
- [CVE-2019-19756](https://insights.sbomify.com/CVE-2019-19756/): Information disclosure in XClarity Administrator (LXCA) (high 7.9)
- [CVE-2019-19755](https://insights.sbomify.com/CVE-2019-19755/): ethOS through 1.3.3 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identificat (critical 9.1)
- [CVE-2019-19754](https://insights.sbomify.com/CVE-2019-19754/): HiveOS through 0.6-102@191212 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes i (medium 5.7)
- [CVE-2019-19753](https://insights.sbomify.com/CVE-2019-19753/): SimpleMiningOS through v1259 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes id (critical 9.1)
- [CVE-2019-19752](https://insights.sbomify.com/CVE-2019-19752/): nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification (critical 9.8)
- [CVE-2019-19751](https://insights.sbomify.com/CVE-2019-19751/): easyMINE before 2019-12-05 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes iden (medium 5.6)
- [CVE-2019-19750](https://insights.sbomify.com/CVE-2019-19750/): Hardcoded credentials in minerstat:msos (critical 9.8)
- [CVE-2019-1975](https://insights.sbomify.com/CVE-2019-1975/): Cisco HyperFlex Software Cross-Frame Scripting Vulnerability (medium 6.5)
- [CVE-2019-19748](https://insights.sbomify.com/CVE-2019-19748/): Cross-site scripting in brizoit:work time calendar (medium 6.1)
- [CVE-2019-19747](https://insights.sbomify.com/CVE-2019-19747/): Auth bypass in neuvector:neuvector (critical 9.8)
- [CVE-2019-19746](https://insights.sbomify.com/CVE-2019-19746/): Integer overflow in fedoraproject:fedora (medium 5.5)
- [CVE-2019-19745](https://insights.sbomify.com/CVE-2019-19745/): Unrestricted file uploads in Contao (high 8.8)
- [CVE-2019-19743](https://insights.sbomify.com/CVE-2019-19743/): Privilege escalation in dlink:dir-615 t1 firmware (medium 6.5)
- [CVE-2019-19742](https://insights.sbomify.com/CVE-2019-19742/): Cross-site scripting in dlink:dir-615 firmware (medium 4.8)
- [CVE-2019-19741](https://insights.sbomify.com/CVE-2019-19741/): Privilege escalation in ea:origin (high 7.8)
- [CVE-2019-19740](https://insights.sbomify.com/CVE-2019-19740/): SQL injection in octeth:oempro (critical 9.8)
- [CVE-2019-1974](https://insights.sbomify.com/CVE-2019-1974/): Auth bypass in Cisco Unified Computing System Director (critical 9.8)
- [CVE-2019-19739](https://insights.sbomify.com/CVE-2019-19739/): Information disclosure in mfscripts:yetishare (high 7.5)
- [CVE-2019-19738](https://insights.sbomify.com/CVE-2019-19738/): Cross-site scripting in mfscripts:yetishare (medium 6.1)
- [CVE-2019-19737](https://insights.sbomify.com/CVE-2019-19737/): Cross-site request forgery in mfscripts:yetishare (high 8.8)
- [CVE-2019-19736](https://insights.sbomify.com/CVE-2019-19736/): Misconfiguration in mfscripts:yetishare (medium 6.1)
- [CVE-2019-19735](https://insights.sbomify.com/CVE-2019-19735/): Weak cryptography in mfscripts:yetishare (critical 9.1)
- [CVE-2019-19734](https://insights.sbomify.com/CVE-2019-19734/): SQL injection in mfscripts:yetishare (high 8.8)
- [CVE-2019-19733](https://insights.sbomify.com/CVE-2019-19733/): Cross-site scripting in mfscripts:yetishare (medium 6.1)
- [CVE-2019-19732](https://insights.sbomify.com/CVE-2019-19732/): SQL injection in mfscripts:yetishare (high 7.2)
- [CVE-2019-19731](https://insights.sbomify.com/CVE-2019-19731/): Path traversal in roxyfileman:roxy fileman (high 7.5)
- [CVE-2019-1973](https://insights.sbomify.com/CVE-2019-1973/): Cisco Enterprise NFV Infrastructure Software Cross-site Scripting Vulnerability (medium 4.8)
- [CVE-2019-19729](https://insights.sbomify.com/CVE-2019-19729/): bson-objectid contains Improper input validation (high 7.5)
- [CVE-2019-19728](https://insights.sbomify.com/CVE-2019-19728/): Privilege escalation in debian:debian linux (high 7.5)
- [CVE-2019-19727](https://insights.sbomify.com/CVE-2019-19727/): Misconfiguration in opensuse:leap (medium 5.5)
- [CVE-2019-19726](https://insights.sbomify.com/CVE-2019-19726/): Privilege escalation in openbsd:openbsd (high 7.8)
- [CVE-2019-19725](https://insights.sbomify.com/CVE-2019-19725/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2019-19724](https://insights.sbomify.com/CVE-2019-19724/): Singularity insecure permissions (high 7.5)
- [CVE-2019-19722](https://insights.sbomify.com/CVE-2019-19722/): Null dereference in dovecot:dovecot (medium 5.3)
- [CVE-2019-19721](https://insights.sbomify.com/CVE-2019-19721/): Memory corruption in videolan:vlc media player (high 7.8)
- [CVE-2019-19720](https://insights.sbomify.com/CVE-2019-19720/): Memory corruption in yabasic:yabasic (high 8.8)
- [CVE-2019-1972](https://insights.sbomify.com/CVE-2019-1972/): Cisco Enterprise NFV Infrastructure Software Privilege Escalation Vulnerability (medium 6.7)
- [CVE-2019-19719](https://insights.sbomify.com/CVE-2019-19719/): Cross-site scripting in tableau:tableau server (medium 6.1)
- [CVE-2019-19714](https://insights.sbomify.com/CVE-2019-19714/): Insert tag injection in the Contao login module (medium 5.3)
- [CVE-2019-19712](https://insights.sbomify.com/CVE-2019-19712/): Information disclosure in the Contao backend (medium 5.3)
- [CVE-2019-1971](https://insights.sbomify.com/CVE-2019-1971/): Cisco Enterprise NFV Infrastructure Software Command Injection Vulnerability (high 8.1)
- [CVE-2019-19709](https://insights.sbomify.com/CVE-2019-19709/): Possible to circumvent title-blacklist (medium 6.1)
- [CVE-2019-19708](https://insights.sbomify.com/CVE-2019-19708/): Cross-site scripting in mediawiki:visual editor (medium 6.1)
- [CVE-2019-19707](https://insights.sbomify.com/CVE-2019-19707/): Denial of service in moxa:eds-g508e firmware (high 7.5)
- [CVE-2019-19705](https://insights.sbomify.com/CVE-2019-19705/): Other in lenovo:aio300-23isu firmware (high 7.8)
- [CVE-2019-19704](https://insights.sbomify.com/CVE-2019-19704/): Information disclosure in jetbrains:upsource (high 7.5)
- [CVE-2019-19703](https://insights.sbomify.com/CVE-2019-19703/): URL Redirection to Untrusted Site (Open Redirect) in Ktor (medium 6.1)
- [CVE-2019-19702](https://insights.sbomify.com/CVE-2019-19702/): Modoboa is vulnerable to an XML External Entity Injection (XXE) (high 7.5)
- [CVE-2019-1970](https://insights.sbomify.com/CVE-2019-1970/): Cisco Firepower Threat Defense Software File Policy Bypass Vulnerability (medium 5.8)
- [CVE-2019-19699](https://insights.sbomify.com/CVE-2019-19699/): Privilege escalation in centreon:centreon (high 7.2)
- [CVE-2019-19698](https://insights.sbomify.com/CVE-2019-19698/): Null dereference in libwav project:libwav (medium 6.5)
- [CVE-2019-19697](https://insights.sbomify.com/CVE-2019-19697/): Privilege escalation in Trend Micro Security (Consumer) (medium 6.7)
- [CVE-2019-19696](https://insights.sbomify.com/CVE-2019-19696/): Hardcoded credentials in Trend Micro Password Manager (medium 5.5)
- [CVE-2019-19695](https://insights.sbomify.com/CVE-2019-19695/): Privilege escalation in Trend Micro Antivirus for Mac (high 7.5)
- [CVE-2019-19694](https://insights.sbomify.com/CVE-2019-19694/): Denial of service in Trend Micro Security (Consumer) (medium 4.7)
- [CVE-2019-19693](https://insights.sbomify.com/CVE-2019-19693/): Information disclosure in Trend Micro Security (Consumer) (high 7.1)
- [CVE-2019-19692](https://insights.sbomify.com/CVE-2019-19692/): Cross-site scripting in Trend Micro Apex Central (medium 6.1)
- [CVE-2019-19691](https://insights.sbomify.com/CVE-2019-19691/): Information disclosure in Trend Micro Apex One and OfficeScan (medium 4.9)
- [CVE-2019-19690](https://insights.sbomify.com/CVE-2019-19690/): Security feature bypass in Trend Micro Mobile Security for Android (Consumer) (critical 9.8)
- [CVE-2019-1969](https://insights.sbomify.com/CVE-2019-1969/): Cisco NX-OS Software SNMP Access Control List Configuration Name Bypass Vulnerability (medium 5.8)
- [CVE-2019-19689](https://insights.sbomify.com/CVE-2019-19689/): Other in Trend Micro HouseCall for Home Networks (high 7.8)
- [CVE-2019-19688](https://insights.sbomify.com/CVE-2019-19688/): Privilege escalation in Trend Micro HouseCall for Home Networks (high 7.8)
- [CVE-2019-19687](https://insights.sbomify.com/CVE-2019-19687/): OpenStack Keystone Credential Leakage (high 8.8)
- [CVE-2019-19685](https://insights.sbomify.com/CVE-2019-19685/): Cross-site request forgery in nopcommerce:nopcommerce (high 8.8)
- [CVE-2019-19684](https://insights.sbomify.com/CVE-2019-19684/): File upload in nopcommerce:nopcommerce (high 8.8)
- [CVE-2019-19683](https://insights.sbomify.com/CVE-2019-19683/): Path traversal in nopcommerce:nopcommerce (critical 9.1)
- [CVE-2019-19682](https://insights.sbomify.com/CVE-2019-19682/): Cross-site scripting in nopcommerce:nopcommerce (medium 4.8)
- [CVE-2019-19681](https://insights.sbomify.com/CVE-2019-19681/): Privilege escalation in artica:pandora fms (high 8.8)
- [CVE-2019-19680](https://insights.sbomify.com/CVE-2019-19680/): Security feature bypass in proofpoint:enterprise protection (high 8.8)
- [CVE-2019-1968](https://insights.sbomify.com/CVE-2019-1968/): Cisco NX-OS Software NX-API Denial of Service Vulnerability (medium 5.3)
- [CVE-2019-19679](https://insights.sbomify.com/CVE-2019-19679/): Cross-site scripting in xpand-it:xray test mangaement (medium 5.4)
- [CVE-2019-19678](https://insights.sbomify.com/CVE-2019-19678/): Cross-site scripting in xpand-it:xray test mangaement (medium 5.4)
- [CVE-2019-19677](https://insights.sbomify.com/CVE-2019-19677/): Information disclosure in arxes-tolina:arxes-tolina (medium 4.3)
- [CVE-2019-19676](https://insights.sbomify.com/CVE-2019-19676/): Code injection in arxes-tolina:arxes-tolina (critical 9.6)
- [CVE-2019-19675](https://insights.sbomify.com/CVE-2019-19675/): Security feature bypass in ivanti:workspace control (high 7.8)
- [CVE-2019-19670](https://insights.sbomify.com/CVE-2019-19670/): Cross-site scripting in maxum:rumpus ftp (medium 6.1)
- [CVE-2019-1967](https://insights.sbomify.com/CVE-2019-1967/): Cisco NX-OS Software Network Time Protocol Denial of Service Vulnerability (high 8.6)
- [CVE-2019-19669](https://insights.sbomify.com/CVE-2019-19669/): Cross-site request forgery in maxum:rumpus ftp (medium 6.5)
- [CVE-2019-19668](https://insights.sbomify.com/CVE-2019-19668/): Cross-site request forgery in maxum:rumpus ftp (medium 4.3)
- [CVE-2019-19667](https://insights.sbomify.com/CVE-2019-19667/): Cross-site request forgery in maxum:rumpus ftp (medium 5.4)
- [CVE-2019-19666](https://insights.sbomify.com/CVE-2019-19666/): Cross-site request forgery in maxum:rumpus ftp (medium 4.3)
- [CVE-2019-19665](https://insights.sbomify.com/CVE-2019-19665/): Cross-site request forgery in maxum:rumpus (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/76/