# Vulnerabilities published in 2019


- [CVE-2019-17639](https://insights.sbomify.com/CVE-2019-17639/): Memory corruption in Eclipse OpenJ9 (medium 5.3)
- [CVE-2019-17638](https://insights.sbomify.com/CVE-2019-17638/): Operation on a Resource after Expiration or Release in Jetty Server (critical 9.4)
- [CVE-2019-17637](https://insights.sbomify.com/CVE-2019-17637/): XML external entity in Eclipse Web Tools Platform (high 7.1)
- [CVE-2019-17636](https://insights.sbomify.com/CVE-2019-17636/): Insufficient Verification of Data Authenticity in Eclipse Theia (high 8.1)
- [CVE-2019-17635](https://insights.sbomify.com/CVE-2019-17635/): Deserialization in Eclipse Memory Analyzer (high 7.8)
- [CVE-2019-17634](https://insights.sbomify.com/CVE-2019-17634/): Cross-site scripting in Eclipse Memory Analyzer (critical 9.0)
- [CVE-2019-17633](https://insights.sbomify.com/CVE-2019-17633/): Cross-site request forgery in Eclipse Che (high 8.8)
- [CVE-2019-17632](https://insights.sbomify.com/CVE-2019-17632/): Unescaped exception messages in error responses in Jetty (medium 6.1)
- [CVE-2019-17631](https://insights.sbomify.com/CVE-2019-17631/): Missing authorization in Eclipse OpenJ9 (critical 9.1)
- [CVE-2019-17630](https://insights.sbomify.com/CVE-2019-17630/): Cross-site scripting in cmsmadesimple:cms made simple (medium 4.8)
- [CVE-2019-1763](https://insights.sbomify.com/CVE-2019-1763/): Cisco IP Phone 8800 Series Authorization Bypass Vulnerability (high 7.5)
- [CVE-2019-17629](https://insights.sbomify.com/CVE-2019-17629/): Cross-site scripting in cmsmadesimple:cms made simple (medium 4.8)
- [CVE-2019-17627](https://insights.sbomify.com/CVE-2019-17627/): Auth bypass in yalehome:yale bluetooth key (medium 6.5)
- [CVE-2019-17626](https://insights.sbomify.com/CVE-2019-17626/): XML Injection in ReportLab (critical 9.8)
- [CVE-2019-17625](https://insights.sbomify.com/CVE-2019-17625/): Rambox RCE Vulnerability (critical 9.0)
- [CVE-2019-17624](https://insights.sbomify.com/CVE-2019-17624/): Memory corruption in x.org:x server (high 7.8)
- [CVE-2019-17621](https://insights.sbomify.com/CVE-2019-17621/): D-Link DIR-859 Router Command Execution (critical 9.8, exploited in the wild)
- [CVE-2019-1762](https://insights.sbomify.com/CVE-2019-1762/): Cisco IOS and IOS XE Software Information Disclosure Vulnerability (medium 4.4)
- [CVE-2019-17613](https://insights.sbomify.com/CVE-2019-17613/): Code injection in qibosoft:qibosoft (critical 9.8)
- [CVE-2019-17612](https://insights.sbomify.com/CVE-2019-17612/): SQL injection in 74cms:74cms (high 7.2)
- [CVE-2019-17611](https://insights.sbomify.com/CVE-2019-17611/): Cross-site scripting in hongcms project:hongcms (medium 6.1)
- [CVE-2019-17610](https://insights.sbomify.com/CVE-2019-17610/): Cross-site scripting in hongcms project:hongcms (medium 6.1)
- [CVE-2019-1761](https://insights.sbomify.com/CVE-2019-1761/): Cisco IOS and IOS XE Software Hot Standby Router Protocol Information Leak Vulnerability (medium 4.3)
- [CVE-2019-17609](https://insights.sbomify.com/CVE-2019-17609/): Cross-site scripting in hongcms project:hongcms (medium 6.1)
- [CVE-2019-17608](https://insights.sbomify.com/CVE-2019-17608/): Cross-site scripting in hongcms project:hongcms (medium 6.1)
- [CVE-2019-17607](https://insights.sbomify.com/CVE-2019-17607/): Cross-site scripting in hongcms project:hongcms (medium 6.1)
- [CVE-2019-17606](https://insights.sbomify.com/CVE-2019-17606/): hexo-admin plugin for Node.js XSS Vulnerability (medium 6.1)
- [CVE-2019-17605](https://insights.sbomify.com/CVE-2019-17605/): Business logic in eyecomms:eyecms (high 8.8)
- [CVE-2019-17604](https://insights.sbomify.com/CVE-2019-17604/): Missing authorization in eyecomms:eyecms (medium 4.3)
- [CVE-2019-17603](https://insights.sbomify.com/CVE-2019-17603/): Memory corruption in asus:aura sync (high 7.8)
- [CVE-2019-17602](https://insights.sbomify.com/CVE-2019-17602/): SQL injection in zohocorp:manageengine opmanager (critical 9.8)
- [CVE-2019-17601](https://insights.sbomify.com/CVE-2019-17601/): Memory corruption in minishare project:minishare (critical 9.8)
- [CVE-2019-17600](https://insights.sbomify.com/CVE-2019-17600/): Information disclosure in intelbras:iwr 1000n firmware (critical 9.8)
- [CVE-2019-1760](https://insights.sbomify.com/CVE-2019-1760/): Cisco IOS XE Software Performance Routing Version 3 Denial of Service Vulnerability (medium 6.8)
- [CVE-2019-17599](https://insights.sbomify.com/CVE-2019-17599/): Cross-site scripting in expresstech:quiz and survey master (medium 6.1)
- [CVE-2019-17598](https://insights.sbomify.com/CVE-2019-17598/): Play Framework Inadequate Encryption Strength vulnerability (high 7.5)
- [CVE-2019-17596](https://insights.sbomify.com/CVE-2019-17596/): Denial of service in arista:cloudvision portal (high 7.5)
- [CVE-2019-17595](https://insights.sbomify.com/CVE-2019-17595/): Memory corruption in invisible-island:ncurses (medium 5.4)
- [CVE-2019-17594](https://insights.sbomify.com/CVE-2019-17594/): Memory corruption in invisible-island:ncurses (medium 5.3)
- [CVE-2019-17593](https://insights.sbomify.com/CVE-2019-17593/): Cross-site request forgery in jizhicms:jizhicms (high 8.8)
- [CVE-2019-17592](https://insights.sbomify.com/CVE-2019-17592/): Regular Expression Denial of Service in csv-parse (high 7.5)
- [CVE-2019-17590](https://insights.sbomify.com/CVE-2019-17590/): Cross-site request forgery in csrf magic project:csrf magic (high 8.8)
- [CVE-2019-1759](https://insights.sbomify.com/CVE-2019-1759/): Cisco IOS XE Software Gigabit Ethernet Management Interface Access Control List Bypass Vulnerability (medium 5.3)
- [CVE-2019-17584](https://insights.sbomify.com/CVE-2019-17584/): Hardcoded credentials in meinbergglobal:syncbox\/ptpv2 firmware (high 7.5)
- [CVE-2019-17583](https://insights.sbomify.com/CVE-2019-17583/): Denial of service in idreamsoft:icms (high 7.5)
- [CVE-2019-17582](https://insights.sbomify.com/CVE-2019-17582/): Use after free in libzip:libzip (critical 9.8)
- [CVE-2019-17581](https://insights.sbomify.com/CVE-2019-17581/): Cross-site scripting in dormsystem project:dormsystem (medium 6.1)
- [CVE-2019-17580](https://insights.sbomify.com/CVE-2019-17580/): SQL injection in dormsystem project:dormsystem (critical 9.8)
- [CVE-2019-1758](https://insights.sbomify.com/CVE-2019-1758/): Cisco IOS Software Catalyst 6500 Series 802.1x Authentication Bypass Vulnerability (medium 4.7)
- [CVE-2019-17579](https://insights.sbomify.com/CVE-2019-17579/): Cross-site scripting in sonarsource:sonarqube (medium 6.1)
- [CVE-2019-17578](https://insights.sbomify.com/CVE-2019-17578/): Dolibarr Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2019-17577](https://insights.sbomify.com/CVE-2019-17577/): Dolibarr Cross-site Scripting via outgoing email setup feature (medium 5.4)
- [CVE-2019-17576](https://insights.sbomify.com/CVE-2019-17576/): Dolibarr Cross-site Scripting via outgoing email setup feature (medium 5.4)
- [CVE-2019-17575](https://insights.sbomify.com/CVE-2019-17575/): File upload in wbce:wbce cms (high 7.2)
- [CVE-2019-17574](https://insights.sbomify.com/CVE-2019-17574/): Missing authorization in code-atlantic:popup maker (critical 9.1)
- [CVE-2019-17573](https://insights.sbomify.com/CVE-2019-17573/): Reflected Cross-Site Scripting in Apache CXF (medium 6.1)
- [CVE-2019-17572](https://insights.sbomify.com/CVE-2019-17572/): Directory traversal in Apache RocketMQ (medium 5.3)
- [CVE-2019-17571](https://insights.sbomify.com/CVE-2019-17571/): Deserialization of Untrusted Data in Log4j (critical 9.8)
- [CVE-2019-17570](https://insights.sbomify.com/CVE-2019-17570/): Insecure Deserialization in Apache XML-RPC (critical 9.8)
- [CVE-2019-1757](https://insights.sbomify.com/CVE-2019-1757/): Cisco IOS and IOS XE Software Smart Call Home Certificate Validation Vulnerability (medium 5.9)
- [CVE-2019-17569](https://insights.sbomify.com/CVE-2019-17569/): Potential HTTP request smuggling in Apache Tomcat (medium 4.8)
- [CVE-2019-17567](https://insights.sbomify.com/CVE-2019-17567/): mod_proxy_wstunnel tunneling of non Upgraded connections (medium 5.3)
- [CVE-2019-17566](https://insights.sbomify.com/CVE-2019-17566/): Server-side request forgery (SSRF) in Apache Batik (high 7.5)
- [CVE-2019-17565](https://insights.sbomify.com/CVE-2019-17565/): Other in Apache Traffic Server (critical 9.8)
- [CVE-2019-17564](https://insights.sbomify.com/CVE-2019-17564/): Deserialization of Untrusted Data in Apache Dubbo (critical 9.8)
- [CVE-2019-17563](https://insights.sbomify.com/CVE-2019-17563/): In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack (high 7.5)
- [CVE-2019-17562](https://insights.sbomify.com/CVE-2019-17562/): Command injection in Apache CloudStack (critical 9.8)
- [CVE-2019-17561](https://insights.sbomify.com/CVE-2019-17561/): Improper Verification of Cryptographic Signature in Apache Netbeans (high 7.5)
- [CVE-2019-17560](https://insights.sbomify.com/CVE-2019-17560/): Improper Certificate Validation in Apache Netbeans (critical 9.1)
- [CVE-2019-1756](https://insights.sbomify.com/CVE-2019-1756/): Cisco IOS XE Software Command Injection Vulnerability (high 7.2)
- [CVE-2019-17559](https://insights.sbomify.com/CVE-2019-17559/): Other in Apache Traffic Server (critical 9.8)
- [CVE-2019-17558](https://insights.sbomify.com/CVE-2019-17558/): Apache Solr VelocityResponseWriter Plug-In Remote Code Execution (high 7.5, exploited in the wild)
- [CVE-2019-17557](https://insights.sbomify.com/CVE-2019-17557/): Cross-site scripting in Apache Syncome EndUser (medium 5.4)
- [CVE-2019-17556](https://insights.sbomify.com/CVE-2019-17556/): Deserialization of Untrusted Data in Apache Olingo (critical 9.8)
- [CVE-2019-17555](https://insights.sbomify.com/CVE-2019-17555/): Improper input validation in Apache Olingo (high 7.5)
- [CVE-2019-17554](https://insights.sbomify.com/CVE-2019-17554/): Improper Restriction of XML External Entity Reference in Apache Olingo (medium 5.5)
- [CVE-2019-17553](https://insights.sbomify.com/CVE-2019-17553/): SQL injection in metinfo:metinfo (critical 9.8)
- [CVE-2019-17552](https://insights.sbomify.com/CVE-2019-17552/): SQL injection in idreamsoft:icms (critical 9.8)
- [CVE-2019-17551](https://insights.sbomify.com/CVE-2019-17551/): Cross-site scripting in apakgroup:wholesale floorplanning finance (medium 6.1)
- [CVE-2019-17550](https://insights.sbomify.com/CVE-2019-17550/): Cross-site scripting in adenion:blog2social (medium 6.1)
- [CVE-2019-1755](https://insights.sbomify.com/CVE-2019-1755/): Cisco IOS XE Software Command Injection Vulnerability (medium 6.5)
- [CVE-2019-17549](https://insights.sbomify.com/CVE-2019-17549/): Denial of service in eset:cyber security (medium 6.5)
- [CVE-2019-17547](https://insights.sbomify.com/CVE-2019-17547/): Use after free in imagemagick:imagemagick (high 8.8)
- [CVE-2019-17546](https://insights.sbomify.com/CVE-2019-17546/): Integer overflow in libtiff:libtiff (high 8.8)
- [CVE-2019-17545](https://insights.sbomify.com/CVE-2019-17545/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2019-17544](https://insights.sbomify.com/CVE-2019-17544/): Memory corruption in canonical:ubuntu linux (critical 9.1)
- [CVE-2019-17543](https://insights.sbomify.com/CVE-2019-17543/): Memory corruption in lz4 project:lz4 (high 8.1)
- [CVE-2019-17542](https://insights.sbomify.com/CVE-2019-17542/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2019-17541](https://insights.sbomify.com/CVE-2019-17541/): Use after free in imagemagick:imagemagick (high 8.8)
- [CVE-2019-17540](https://insights.sbomify.com/CVE-2019-17540/): Memory corruption in debian:debian linux (high 8.8)
- [CVE-2019-1754](https://insights.sbomify.com/CVE-2019-1754/): Cisco IOS XE Software Privilege Escalation Vulnerability (high 8.8)
- [CVE-2019-17539](https://insights.sbomify.com/CVE-2019-17539/): Null dereference in canonical:ubuntu linux (critical 9.8)
- [CVE-2019-17538](https://insights.sbomify.com/CVE-2019-17538/): Path traversal in jnoj:jiangnan online judge (high 7.5)
- [CVE-2019-17537](https://insights.sbomify.com/CVE-2019-17537/): Path traversal in jnoj:jiangnan online judge (high 7.5)
- [CVE-2019-17536](https://insights.sbomify.com/CVE-2019-17536/): File upload in gilacms:gila cms (critical 9.9)
- [CVE-2019-17535](https://insights.sbomify.com/CVE-2019-17535/): Cross-site scripting in gilacms:gila cms (critical 9.3)
- [CVE-2019-17534](https://insights.sbomify.com/CVE-2019-17534/): Use after free in libvips:libvips (high 8.8)
- [CVE-2019-17533](https://insights.sbomify.com/CVE-2019-17533/): Memory corruption in debian:debian linux (high 8.2)
- [CVE-2019-17532](https://insights.sbomify.com/CVE-2019-17532/): Denial of service in belkin:wemo switch 28b firmware (high 7.5)
- [CVE-2019-17531](https://insights.sbomify.com/CVE-2019-17531/): jackson-databind polymorphic typing issue (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/89/