# Vulnerabilities published in 2019


- [CVE-2019-19041](https://insights.sbomify.com/CVE-2019-19041/): Command injection in xorur:lpar2rrd (high 7.2)
- [CVE-2019-19040](https://insights.sbomify.com/CVE-2019-19040/): Reflected Cross site scripting (XSS) in kairosdb (medium 6.1)
- [CVE-2019-1904](https://insights.sbomify.com/CVE-2019-1904/): Cisco IOS XE Software Web UI Cross-Site Request Forgery Vulnerability (high 8.8)
- [CVE-2019-19039](https://insights.sbomify.com/CVE-2019-19039/): Information disclosure in canonical:ubuntu linux (medium 5.5)
- [CVE-2019-19037](https://insights.sbomify.com/CVE-2019-19037/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2019-19036](https://insights.sbomify.com/CVE-2019-19036/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2019-19035](https://insights.sbomify.com/CVE-2019-19035/): Memory corruption in jhead project:jhead (medium 5.5)
- [CVE-2019-19034](https://insights.sbomify.com/CVE-2019-19034/): Command injection in zohocorp:manageengine assetexplorer (high 7.2)
- [CVE-2019-19033](https://insights.sbomify.com/CVE-2019-19033/): Hardcoded credentials in jalios:jcms (critical 9.8)
- [CVE-2019-19032](https://insights.sbomify.com/CVE-2019-19032/): XML external entity in xmlblueprint:xmlblueprint (high 8.1)
- [CVE-2019-19031](https://insights.sbomify.com/CVE-2019-19031/): XML external entity in edit-xml:easy xml editor (high 8.1)
- [CVE-2019-19030](https://insights.sbomify.com/CVE-2019-19030/): Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030) (medium 5.3)
- [CVE-2019-1903](https://insights.sbomify.com/CVE-2019-1903/): Cisco Security Manager XML Entity Expansion Vulnerability (medium 6.5)
- [CVE-2019-19029](https://insights.sbomify.com/CVE-2019-19029/): SQL Injection in Cloud Native Computing Foundation Harbor (high 7.2)
- [CVE-2019-19026](https://insights.sbomify.com/CVE-2019-19026/): SQL Injection in Cloud Native Computing Foundation Harbor (medium 4.9)
- [CVE-2019-19025](https://insights.sbomify.com/CVE-2019-19025/): Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor (high 8.8)
- [CVE-2019-19023](https://insights.sbomify.com/CVE-2019-19023/): Privilege Escalation in Cloud Native Computing Foundation Harbor (high 8.8)
- [CVE-2019-19022](https://insights.sbomify.com/CVE-2019-19022/): Information disclosure in iterm2:iterm2 (high 7.5)
- [CVE-2019-19021](https://insights.sbomify.com/CVE-2019-19021/): Hardcoded credentials in titanhq:webtitan (critical 9.8)
- [CVE-2019-19020](https://insights.sbomify.com/CVE-2019-19020/): File upload in titanhq:webtitan (high 7.2)
- [CVE-2019-19019](https://insights.sbomify.com/CVE-2019-19019/): Supply chain in titanhq:webtitan (high 7.5)
- [CVE-2019-19018](https://insights.sbomify.com/CVE-2019-19018/): Information disclosure in titanhq:webtitan (low 2.7)
- [CVE-2019-19017](https://insights.sbomify.com/CVE-2019-19017/): Hardcoded credentials in titanhq:webtitan (high 8.1)
- [CVE-2019-19016](https://insights.sbomify.com/CVE-2019-19016/): SQL injection in titanhq:webtitan (high 7.5)
- [CVE-2019-19015](https://insights.sbomify.com/CVE-2019-19015/): Missing authorization in titanhq:webtitan (critical 9.8)
- [CVE-2019-19014](https://insights.sbomify.com/CVE-2019-19014/): Privilege escalation in titanhq:webtitan (high 7.8)
- [CVE-2019-19013](https://insights.sbomify.com/CVE-2019-19013/): Pagekit File Upload vulnerability (high 8.8)
- [CVE-2019-19012](https://insights.sbomify.com/CVE-2019-19012/): Integer overflow in debian:debian linux (critical 9.8)
- [CVE-2019-19011](https://insights.sbomify.com/CVE-2019-19011/): Null dereference in miniupnp project:ngiflib (high 7.5)
- [CVE-2019-19010](https://insights.sbomify.com/CVE-2019-19010/): Eval injection in Supybot/Limnoria (critical 9.8)
- [CVE-2019-1901](https://insights.sbomify.com/CVE-2019-1901/): Cisco Nexus 9000 Series ACI Mode Switch Software Link Layer Discovery Protocol Buffer Overflow Vulnerability (high 8.8)
- [CVE-2019-19007](https://insights.sbomify.com/CVE-2019-19007/): Information disclosure in intelbras:iwr 3000n firmware (high 7.2)
- [CVE-2019-19006](https://insights.sbomify.com/CVE-2019-19006/): Sangoma FreePBX Improper Authentication (critical 9.8, exploited in the wild)
- [CVE-2019-19005](https://insights.sbomify.com/CVE-2019-19005/): Memory corruption in autotrace project:autotrace (high 7.8)
- [CVE-2019-19004](https://insights.sbomify.com/CVE-2019-19004/): Integer overflow in autotrace project:autotrace (low 3.3)
- [CVE-2019-19003](https://insights.sbomify.com/CVE-2019-19003/): ABB eSOMS: HTTPOnly flag not set (medium 5.3)
- [CVE-2019-19002](https://insights.sbomify.com/CVE-2019-19002/): ABB eSOMS X-XSS-Protection not enabled (medium 6.3)
- [CVE-2019-19001](https://insights.sbomify.com/CVE-2019-19001/): eSOMS X-FrameOption (medium 6.5)
- [CVE-2019-19000](https://insights.sbomify.com/CVE-2019-19000/): eSOMS Cachecontrol (Pragma) HTTP Header (medium 6.5)
- [CVE-2019-1900](https://insights.sbomify.com/CVE-2019-1900/): Cisco Integrated Management Controller Unauthenticated Denial of Service Vulnerability (high 7.5)
- [CVE-2019-18998](https://insights.sbomify.com/CVE-2019-18998/): Asset Suite Direct Object Reference Access (high 7.1)
- [CVE-2019-18997](https://insights.sbomify.com/CVE-2019-18997/): PB610 HMISimulator provides interface with access to arbitrary files (medium 4.3)
- [CVE-2019-18996](https://insights.sbomify.com/CVE-2019-18996/): ABB PB610 HMIStudio accepts malicious DLL file in an application (high 7.1)
- [CVE-2019-18995](https://insights.sbomify.com/CVE-2019-18995/): ABB PB610 HMISimulator does not check content-length of the HTTP request (medium 4.3)
- [CVE-2019-18994](https://insights.sbomify.com/CVE-2019-18994/): ABB PB610 HMIStudio crashes after launching an empty *.JPR application file (low 3.9)
- [CVE-2019-18993](https://insights.sbomify.com/CVE-2019-18993/): Cross-site scripting in openwrt:openwrt (medium 5.4)
- [CVE-2019-18992](https://insights.sbomify.com/CVE-2019-18992/): Cross-site scripting in openwrt:openwrt (medium 5.4)
- [CVE-2019-18991](https://insights.sbomify.com/CVE-2019-18991/): Auth bypass in qualcomm:atheros ar9132 firmware (medium 6.1)
- [CVE-2019-18990](https://insights.sbomify.com/CVE-2019-18990/): Auth bypass in realtek:rtl8192er firmware (medium 6.1)
- [CVE-2019-1899](https://insights.sbomify.com/CVE-2019-1899/): Cisco RV110W, RV130W, and RV215W Routers Information Disclosure Vulnerability (medium 5.3)
- [CVE-2019-18989](https://insights.sbomify.com/CVE-2019-18989/): Auth bypass in mediatek:mt7620n firmware (medium 6.1)
- [CVE-2019-18988](https://insights.sbomify.com/CVE-2019-18988/): TeamViewer Desktop Bypass Remote Login (high 7.0, exploited in the wild)
- [CVE-2019-18987](https://insights.sbomify.com/CVE-2019-18987/): Information disclosure in mediawiki:abusefilter (medium 5.3)
- [CVE-2019-18986](https://insights.sbomify.com/CVE-2019-18986/): Pimcore Discloses Usernames In Use (high 7.5)
- [CVE-2019-18985](https://insights.sbomify.com/CVE-2019-18985/): Pimcore 2FA Vulnerable to Brute Forcing (critical 9.8)
- [CVE-2019-18982](https://insights.sbomify.com/CVE-2019-18982/): Pimcore Cross-site Scripting (XSS) vulnerability (medium 6.1)
- [CVE-2019-18981](https://insights.sbomify.com/CVE-2019-18981/): Pimcore Access Control Issues (critical 9.8)
- [CVE-2019-18980](https://insights.sbomify.com/CVE-2019-18980/): Missing authorization in philips:taolight smart wi-fi wiz connected led bulb 9290022656 firmware (high 7.5)
- [CVE-2019-1898](https://insights.sbomify.com/CVE-2019-1898/): Cisco RV110W, RV130W, and RV215W Routers Unauthenticated syslog File Access Vulnerability (medium 5.3)
- [CVE-2019-18979](https://insights.sbomify.com/CVE-2019-18979/): Privilege escalation in claranova:adaware antivirus (high 7.8)
- [CVE-2019-18978](https://insights.sbomify.com/CVE-2019-18978/): The rack-cors rubygem may allow directory traveral (medium 5.3)
- [CVE-2019-18976](https://insights.sbomify.com/CVE-2019-18976/): Null dereference in debian:debian linux (high 7.5)
- [CVE-2019-1897](https://insights.sbomify.com/CVE-2019-1897/): Cisco RV110W, RV130W, and RV215W Routers Denial of Service Vulnerability (medium 5.3)
- [CVE-2019-18960](https://insights.sbomify.com/CVE-2019-18960/): Memory corruption in amazon:firecracker (critical 9.8)
- [CVE-2019-1896](https://insights.sbomify.com/CVE-2019-1896/): Cisco Integrated Management Controller CSR Generation Command Injection Vulnerability (high 7.2)
- [CVE-2019-18958](https://insights.sbomify.com/CVE-2019-18958/): Information disclosure in gonitro:nitro pro (high 7.8)
- [CVE-2019-18957](https://insights.sbomify.com/CVE-2019-18957/): Cross-site scripting in microstrategy:microstrategy library (medium 6.1)
- [CVE-2019-18956](https://insights.sbomify.com/CVE-2019-18956/): Deserialization in divisait:dv2eemvc (critical 9.8)
- [CVE-2019-18955](https://insights.sbomify.com/CVE-2019-18955/): Cross-site scripting in lansweeper:lansweeper (medium 6.1)
- [CVE-2019-18954](https://insights.sbomify.com/CVE-2019-18954/): Pomelo allows external control of critical state data (medium 5.3)
- [CVE-2019-18952](https://insights.sbomify.com/CVE-2019-18952/): File upload in sibsoft:xfilesharing (critical 9.8)
- [CVE-2019-18951](https://insights.sbomify.com/CVE-2019-18951/): Path traversal in sibsoft:xfilesharing (high 7.5)
- [CVE-2019-1895](https://insights.sbomify.com/CVE-2019-1895/): Cisco Enterprise NFV Infrastructure Software VNC Authentication Bypass Vulnerability (critical 9.8)
- [CVE-2019-18949](https://insights.sbomify.com/CVE-2019-18949/): Security feature bypass in snowhaze:snowhaze (high 7.5)
- [CVE-2019-18948](https://insights.sbomify.com/CVE-2019-18948/): Denial of service in arista:eos (high 7.5)
- [CVE-2019-18947](https://insights.sbomify.com/CVE-2019-18947/): information disclosure (low 3.5)
- [CVE-2019-18946](https://insights.sbomify.com/CVE-2019-18946/): Session fixation (medium 4.8)
- [CVE-2019-18945](https://insights.sbomify.com/CVE-2019-18945/): privilege escalation (high 7.3)
- [CVE-2019-18944](https://insights.sbomify.com/CVE-2019-18944/): Cross-site scripting in Solutions Business Manager (medium 4.9)
- [CVE-2019-18943](https://insights.sbomify.com/CVE-2019-18943/): XML External Entity processing (medium 6.1)
- [CVE-2019-18942](https://insights.sbomify.com/CVE-2019-18942/): Stored cross site scripting (medium 5.5)
- [CVE-2019-1894](https://insights.sbomify.com/CVE-2019-1894/): Cisco Enterprise NFV Infrastructure Software Arbitrary File Read and Write Vulnerability (high 7.2)
- [CVE-2019-18939](https://insights.sbomify.com/CVE-2019-18939/): Code injection in eq-3:homematic ccu2 firmware (critical 9.8)
- [CVE-2019-18938](https://insights.sbomify.com/CVE-2019-18938/): Missing authorization in eq-3:homematic ccu2 firmware (critical 9.8)
- [CVE-2019-18937](https://insights.sbomify.com/CVE-2019-18937/): Code injection in eq-3:homematic ccu2 firmware (critical 9.8)
- [CVE-2019-18936](https://insights.sbomify.com/CVE-2019-18936/): Denial of service in bloq:univalue (high 7.5)
- [CVE-2019-18935](https://insights.sbomify.com/CVE-2019-18935/): Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data (critical 9.8, exploited in the wild)
- [CVE-2019-18934](https://insights.sbomify.com/CVE-2019-18934/): Command injection in fedoraproject:fedora (high 7.3)
- [CVE-2019-18933](https://insights.sbomify.com/CVE-2019-18933/): Business logic in zulip:zulip server (critical 9.8)
- [CVE-2019-18932](https://insights.sbomify.com/CVE-2019-18932/): Race condition in opensuse:backports sle (high 7.0)
- [CVE-2019-18931](https://insights.sbomify.com/CVE-2019-18931/): Memory corruption in western digital:my cloud ex2 ultra firmware (high 8.8)
- [CVE-2019-18930](https://insights.sbomify.com/CVE-2019-18930/): Memory corruption in western digital:my cloud ex2 ultra firmware (high 8.8)
- [CVE-2019-1893](https://insights.sbomify.com/CVE-2019-1893/): Cisco Enterprise NFV Infrastructure Software Command Injection Vulnerability (high 7.8)
- [CVE-2019-18929](https://insights.sbomify.com/CVE-2019-18929/): Memory corruption in western digital:my cloud ex2 ultra firmware (high 8.8)
- [CVE-2019-18928](https://insights.sbomify.com/CVE-2019-18928/): Auth bypass in cyrus:imap (critical 9.8)
- [CVE-2019-18926](https://insights.sbomify.com/CVE-2019-18926/): Cross-site scripting in systematicinc:iris standards management (medium 6.1)
- [CVE-2019-18925](https://insights.sbomify.com/CVE-2019-18925/): Missing authorization in systematic:iris webforms (critical 9.8)
- [CVE-2019-18924](https://insights.sbomify.com/CVE-2019-18924/): Path traversal in systematic:iris webforms (medium 5.3)
- [CVE-2019-18923](https://insights.sbomify.com/CVE-2019-18923/): Cross-site scripting in go-camo project:go-camo (medium 6.1)
- [CVE-2019-18922](https://insights.sbomify.com/CVE-2019-18922/): Path traversal in alliedtelesis:at-gs950\/8 firmware (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/82/