# Vulnerabilities published in 2019


- [CVE-2019-1892](https://insights.sbomify.com/CVE-2019-1892/): Cisco Small Business Series Switches Memory Corruption Vulnerability (high 7.5)
- [CVE-2019-18917](https://insights.sbomify.com/CVE-2019-18917/): Security feature bypass in HP ENVY 5000 All-in-One Printer series (M2U85A - M2U85B, M2U91A - M2U94B, Z4A54A - Z4A74A); HP DeskJet Ink Advantage 5000 All-in-One Printer series (M2U86A - M2U89B) (medium 6.5)
- [CVE-2019-18916](https://insights.sbomify.com/CVE-2019-18916/): Privilege escalation in HP Color LaserJet Pro MFP M277 printers (high 7.8)
- [CVE-2019-18915](https://insights.sbomify.com/CVE-2019-18915/): Privilege escalation in HP System Event Utility (high 7.8)
- [CVE-2019-18914](https://insights.sbomify.com/CVE-2019-18914/): Cross-site scripting in HP Color LaserJet Managed Printers, HP Color LaserJet Enterprise Printers (medium 6.1)
- [CVE-2019-18913](https://insights.sbomify.com/CVE-2019-18913/): Security feature bypass in HP Intel-based Business PCs that support Microsoft Windows 10 Kernel DMA protection. (medium 6.8)
- [CVE-2019-18912](https://insights.sbomify.com/CVE-2019-18912/): Other in HP LaserJet Enterprise Printers (high 7.8)
- [CVE-2019-18910](https://insights.sbomify.com/CVE-2019-18910/): Command injection in ThinPro Linux (medium 6.8)
- [CVE-2019-1891](https://insights.sbomify.com/CVE-2019-1891/): Cisco Small Business Series Switches HTTP Denial of Service Vulnerability (high 7.5)
- [CVE-2019-18909](https://insights.sbomify.com/CVE-2019-18909/): Command injection in ThinPro Linux (high 8.0)
- [CVE-2019-18906](https://insights.sbomify.com/CVE-2019-18906/): cryptctl: client side password hashing is equivalent to clear text password storage (critical 9.8)
- [CVE-2019-18905](https://insights.sbomify.com/CVE-2019-18905/): Deprecated functionality in autoyast2 automatically imports gpg keys without checking them (medium 4.8)
- [CVE-2019-18904](https://insights.sbomify.com/CVE-2019-18904/): Migrations requests can cause DoS on rmt (medium 6.5)
- [CVE-2019-18903](https://insights.sbomify.com/CVE-2019-18903/): wicked: Use-after-free when receiving invalid DHCP6 IA_PD option (high 7.5)
- [CVE-2019-18902](https://insights.sbomify.com/CVE-2019-18902/): wicked: Use-after-free when receiving invalid DHCP6 client options (high 7.5)
- [CVE-2019-18901](https://insights.sbomify.com/CVE-2019-18901/): mysql-systemd-helper allows setting 640 permissions of arbitrary files (medium 5.1)
- [CVE-2019-18900](https://insights.sbomify.com/CVE-2019-18900/): libzypp stores cookies world readable (medium 4.0)
- [CVE-2019-1890](https://insights.sbomify.com/CVE-2019-1890/): Cisco Nexus 9000 Series Fabric Switches ACI Mode Fabric Infrastructure VLAN Unauthorized Access Vulnerability (high 7.4)
- [CVE-2019-18899](https://insights.sbomify.com/CVE-2019-18899/): apt-cacher-ng insecure use of /run/apt-cacher-ng (medium 6.2)
- [CVE-2019-18898](https://insights.sbomify.com/CVE-2019-18898/): trousers: Local privilege escalation from tss to root (high 7.7)
- [CVE-2019-18897](https://insights.sbomify.com/CVE-2019-18897/): Local privilege escalation from user salt to root (high 8.4)
- [CVE-2019-18895](https://insights.sbomify.com/CVE-2019-18895/): Misconfiguration in scanguard:scanguard antivirus (high 7.8)
- [CVE-2019-18894](https://insights.sbomify.com/CVE-2019-18894/): Command injection in avast:premium security (high 7.8)
- [CVE-2019-18893](https://insights.sbomify.com/CVE-2019-18893/): Cross-site scripting in avast:secure browser (medium 6.1)
- [CVE-2019-18890](https://insights.sbomify.com/CVE-2019-18890/): SQL injection in debian:debian linux (medium 6.5)
- [CVE-2019-1889](https://insights.sbomify.com/CVE-2019-1889/): Cisco Application Policy Infrastructure Controller REST API Privilege Escalation Vulnerability (high 7.2)
- [CVE-2019-18889](https://insights.sbomify.com/CVE-2019-18889/): Symfony Unsafe Cache Serialization Could Enable RCE (critical 9.8)
- [CVE-2019-18888](https://insights.sbomify.com/CVE-2019-18888/): Argument injection in a MimeTypeGuesser in Symfony (high 7.5)
- [CVE-2019-18887](https://insights.sbomify.com/CVE-2019-18887/): Symfony Http-Kernel has non-constant time comparison in UriSigner (high 8.1)
- [CVE-2019-18886](https://insights.sbomify.com/CVE-2019-18886/): User enumeration leak using switch user functionality in Symfony (medium 5.3)
- [CVE-2019-18885](https://insights.sbomify.com/CVE-2019-18885/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2019-18884](https://insights.sbomify.com/CVE-2019-18884/): Cross-site request forgery in fairsketch:rise - ultimate project manager (high 8.8)
- [CVE-2019-18883](https://insights.sbomify.com/CVE-2019-18883/): Cross-site scripting in lavalite:lavalite (medium 6.1)
- [CVE-2019-18882](https://insights.sbomify.com/CVE-2019-18882/): Cross-site scripting in wso2:identity server (medium 6.1)
- [CVE-2019-18881](https://insights.sbomify.com/CVE-2019-18881/): Cross-site scripting in wso2:identity server (medium 6.1)
- [CVE-2019-1888](https://insights.sbomify.com/CVE-2019-1888/): Cisco Unified Contact Center Express Privilege Escalation Vulnerability (high 7.2)
- [CVE-2019-18874](https://insights.sbomify.com/CVE-2019-18874/): Double Free in psutil (high 7.5)
- [CVE-2019-18873](https://insights.sbomify.com/CVE-2019-18873/): Cross-site scripting in fudforum:fudforum (critical 9.0)
- [CVE-2019-18872](https://insights.sbomify.com/CVE-2019-18872/): Weak cryptography in blaauwproducts:remote kiln control (high 7.5)
- [CVE-2019-18871](https://insights.sbomify.com/CVE-2019-18871/): Path traversal in blaauwproducts:remote kiln control (high 8.8)
- [CVE-2019-18870](https://insights.sbomify.com/CVE-2019-18870/): Path traversal in blaauwproducts:remote kiln control (medium 6.5)
- [CVE-2019-1887](https://insights.sbomify.com/CVE-2019-1887/): Cisco Unified Communications Manager Session Initiation Protocol Denial of Service Vulnerability (high 8.6)
- [CVE-2019-18869](https://insights.sbomify.com/CVE-2019-18869/): Code injection in blaauwproducts:remote kiln control (critical 9.8)
- [CVE-2019-18868](https://insights.sbomify.com/CVE-2019-18868/): Information disclosure in blaauwproducts:remote kiln control (critical 9.8)
- [CVE-2019-18867](https://insights.sbomify.com/CVE-2019-18867/): Information disclosure in blaauwproducts:remote kiln control (high 7.5)
- [CVE-2019-18866](https://insights.sbomify.com/CVE-2019-18866/): SQL injection in blaauwproducts:remote kiln control (high 7.5)
- [CVE-2019-18865](https://insights.sbomify.com/CVE-2019-18865/): Information disclosure in blaauwproducts:remote kiln control (medium 5.3)
- [CVE-2019-18864](https://insights.sbomify.com/CVE-2019-18864/): Information disclosure in blaauwproducts:remote kiln control (high 7.5)
- [CVE-2019-18863](https://insights.sbomify.com/CVE-2019-18863/): Weak cryptography in mitel:6863i firmware (medium 5.9)
- [CVE-2019-18862](https://insights.sbomify.com/CVE-2019-18862/): Privilege escalation in gnu:mailutils (high 7.8)
- [CVE-2019-18860](https://insights.sbomify.com/CVE-2019-18860/): Other in canonical:ubuntu linux (medium 6.1)
- [CVE-2019-1886](https://insights.sbomify.com/CVE-2019-1886/): Cisco Web Security Appliance HTTPS Certificate Denial of Service Vulnerability (high 8.6)
- [CVE-2019-18859](https://insights.sbomify.com/CVE-2019-18859/): Cross-site scripting in digi:anywhereusb\/14 firmware (medium 6.1)
- [CVE-2019-18858](https://insights.sbomify.com/CVE-2019-18858/): Memory corruption in codesys:control for beaglebone (critical 9.8)
- [CVE-2019-18857](https://insights.sbomify.com/CVE-2019-18857/): XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes (high 7.5)
- [CVE-2019-18856](https://insights.sbomify.com/CVE-2019-18856/): Denial of service in drupal:svg sanitizer (high 7.5)
- [CVE-2019-18855](https://insights.sbomify.com/CVE-2019-18855/): Denial of service in 10up:safe svg (high 7.5)
- [CVE-2019-18854](https://insights.sbomify.com/CVE-2019-18854/): Denial of service in 10up:safe svg (high 7.5)
- [CVE-2019-18853](https://insights.sbomify.com/CVE-2019-18853/): Denial of service in imagemagick:imagemagick (medium 6.5)
- [CVE-2019-18852](https://insights.sbomify.com/CVE-2019-18852/): Hardcoded credentials in dlink:dir-600 b1 firmware (critical 9.8)
- [CVE-2019-18850](https://insights.sbomify.com/CVE-2019-18850/): Information disclosure in trustedsec:trevorc2 (high 7.5)
- [CVE-2019-1885](https://insights.sbomify.com/CVE-2019-1885/): Cisco Integrated Management Controller Command Injection Vulnerability (high 7.2)
- [CVE-2019-18849](https://insights.sbomify.com/CVE-2019-18849/): Memory corruption in canonical:ubuntu linux (medium 5.5)
- [CVE-2019-18848](https://insights.sbomify.com/CVE-2019-18848/): JSON-jwt Gem lacked element count during splitting of JWE string (high 7.5)
- [CVE-2019-18847](https://insights.sbomify.com/CVE-2019-18847/): Security feature bypass in akamai:enterprise application access (critical 9.8)
- [CVE-2019-18846](https://insights.sbomify.com/CVE-2019-18846/): OX App Suite through 7.10.2 allows SSRF. (medium 5.0)
- [CVE-2019-18845](https://insights.sbomify.com/CVE-2019-18845/): Privilege escalation in patriotmemory:viper rgb firmware (high 7.1)
- [CVE-2019-18844](https://insights.sbomify.com/CVE-2019-18844/): Denial of service in linux:acrn (high 7.5)
- [CVE-2019-18842](https://insights.sbomify.com/CVE-2019-18842/): Cross-site scripting in usriot:usr-wifi232-g2 firmware (medium 6.1)
- [CVE-2019-18841](https://insights.sbomify.com/CVE-2019-18841/): Prototype Pollution in chartkick (high 7.3)
- [CVE-2019-18840](https://insights.sbomify.com/CVE-2019-18840/): Memory corruption in wolfssl:wolfssl (high 7.5)
- [CVE-2019-1884](https://insights.sbomify.com/CVE-2019-1884/): Cisco Web Security Appliance Web Proxy Denial of Service Vulnerability (high 7.7)
- [CVE-2019-18839](https://insights.sbomify.com/CVE-2019-18839/): Cross-site scripting in fudforum:fudforum (critical 9.0)
- [CVE-2019-18838](https://insights.sbomify.com/CVE-2019-18838/): Null dereference in envoyproxy:envoy (high 7.5)
- [CVE-2019-18837](https://insights.sbomify.com/CVE-2019-18837/): Path traversal in crun (high 8.6)
- [CVE-2019-18836](https://insights.sbomify.com/CVE-2019-18836/): Denial of service in envoyproxy:envoy (high 7.5)
- [CVE-2019-18835](https://insights.sbomify.com/CVE-2019-18835/): Improper Verification of Cryptographic Signature in matrix-synapse (critical 9.8)
- [CVE-2019-18834](https://insights.sbomify.com/CVE-2019-18834/): Cross-site scripting in woocommerce:subscriptions (medium 6.1)
- [CVE-2019-18833](https://insights.sbomify.com/CVE-2019-18833/): Weak cryptography in barco:clickshare button r9861500d01 firmware (medium 5.9)
- [CVE-2019-18832](https://insights.sbomify.com/CVE-2019-18832/): Weak cryptography in barco:clickshare button r9861500d01 firmware (high 8.1)
- [CVE-2019-18831](https://insights.sbomify.com/CVE-2019-18831/): Hardcoded credentials in barco:clickshare cs-100 firmware (medium 5.3)
- [CVE-2019-18830](https://insights.sbomify.com/CVE-2019-18830/): Command injection in barco:clickshare cs-100 firmware (critical 9.8)
- [CVE-2019-1883](https://insights.sbomify.com/CVE-2019-1883/): Cisco Integrated Management Controller CLI Command Injection Vulnerability (high 7.0)
- [CVE-2019-18829](https://insights.sbomify.com/CVE-2019-18829/): Security feature bypass in barco:clickshare button r9861500d01 firmware (high 7.8)
- [CVE-2019-18828](https://insights.sbomify.com/CVE-2019-18828/): Hardcoded credentials in barco:clickshare cs-100 firmware (medium 6.8)
- [CVE-2019-18827](https://insights.sbomify.com/CVE-2019-18827/): Security feature bypass in barco:clickshare cs-100 firmware (medium 5.9)
- [CVE-2019-18826](https://insights.sbomify.com/CVE-2019-18826/): Security feature bypass in barco:clickshare cs-100 firmware (critical 9.8)
- [CVE-2019-18825](https://insights.sbomify.com/CVE-2019-18825/): Weak cryptography in barco:clickshare cs-100 huddle firmware (high 7.5)
- [CVE-2019-18824](https://insights.sbomify.com/CVE-2019-18824/): Security feature bypass in barco:clickshare button r9861500d01 firmware (medium 6.6)
- [CVE-2019-18823](https://insights.sbomify.com/CVE-2019-18823/): Auth bypass in debian:debian linux (critical 9.8)
- [CVE-2019-18822](https://insights.sbomify.com/CVE-2019-18822/): Privilege escalation in eleveo:call recording (high 8.8)
- [CVE-2019-18821](https://insights.sbomify.com/CVE-2019-18821/): Memory corruption in eximioussoft:logo designer (medium 5.5)
- [CVE-2019-18820](https://insights.sbomify.com/CVE-2019-18820/): Memory corruption in eximioussoft:logo designer (medium 5.5)
- [CVE-2019-1882](https://insights.sbomify.com/CVE-2019-1882/): Cisco Industrial Network Director Stored Cross-Site Scripting Vulnerability (medium 5.4)
- [CVE-2019-18819](https://insights.sbomify.com/CVE-2019-18819/): Memory corruption in eximioussoft:logo designer (medium 5.5)
- [CVE-2019-18818](https://insights.sbomify.com/CVE-2019-18818/): Strapi allows unauthenticated attacker to reset admin password without valid reset token (critical 9.8)
- [CVE-2019-18817](https://insights.sbomify.com/CVE-2019-18817/): Istio vulnerable to denial of service (high 7.5)
- [CVE-2019-18816](https://insights.sbomify.com/CVE-2019-18816/): Cross-site scripting in popojicms:popojicms (medium 6.1)
- [CVE-2019-18815](https://insights.sbomify.com/CVE-2019-18815/): Open redirect in popojicms:popojicms (medium 6.1)
- [CVE-2019-18814](https://insights.sbomify.com/CVE-2019-18814/): Use after free in linux:linux kernel (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/83/