# Vulnerabilities published in 2019


- [CVE-2019-1694](https://insights.sbomify.com/CVE-2019-1694/): Denial of service in Cisco Adaptive Security Appliance (ASA) Software (high 8.6)
- [CVE-2019-16935](https://insights.sbomify.com/CVE-2019-16935/): Cross-site scripting in canonical:ubuntu linux (medium 6.1)
- [CVE-2019-16932](https://insights.sbomify.com/CVE-2019-16932/): Server-side request forgery in themeisle:visualizer (critical 10.0)
- [CVE-2019-16931](https://insights.sbomify.com/CVE-2019-16931/): Cross-site scripting in themeisle:visualizer (medium 6.1)
- [CVE-2019-16930](https://insights.sbomify.com/CVE-2019-16930/): Information disclosure in z.cash:zcash (medium 5.3)
- [CVE-2019-1693](https://insights.sbomify.com/CVE-2019-1693/): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software WebVPN Denial of Service Vulnerability (high 7.7)
- [CVE-2019-16929](https://insights.sbomify.com/CVE-2019-16929/): Improper Authentication in Auth0.AuthenticationApi (high 7.5)
- [CVE-2019-16928](https://insights.sbomify.com/CVE-2019-16928/): Exim Out-of-bounds Write (critical 9.8, exploited in the wild)
- [CVE-2019-16927](https://insights.sbomify.com/CVE-2019-16927/): Memory corruption in glyphandcog:xpdf (medium 5.5)
- [CVE-2019-16926](https://insights.sbomify.com/CVE-2019-16926/): Cross-site scripting in flower project:flower (medium 6.1)
- [CVE-2019-16925](https://insights.sbomify.com/CVE-2019-16925/): Cross-site scripting in flower project:flower (medium 6.1)
- [CVE-2019-16924](https://insights.sbomify.com/CVE-2019-16924/): Information disclosure in nuvending:nulock (high 8.8)
- [CVE-2019-16923](https://insights.sbomify.com/CVE-2019-16923/): kkcms 1.3 has jx.php?url= XSS. (medium 6.1)
- [CVE-2019-16922](https://insights.sbomify.com/CVE-2019-16922/): Information disclosure in salesagility:suitecrm (medium 5.3)
- [CVE-2019-16921](https://insights.sbomify.com/CVE-2019-16921/): Information disclosure in linux:linux kernel (high 7.5)
- [CVE-2019-16920](https://insights.sbomify.com/CVE-2019-16920/): D-Link Multiple Routers Command Injection (critical 9.8, exploited in the wild)
- [CVE-2019-1692](https://insights.sbomify.com/CVE-2019-1692/): Information disclosure in Cisco Application Policy Infrastructure Controller (APIC) (medium 5.3)
- [CVE-2019-16919](https://insights.sbomify.com/CVE-2019-16919/): Missing authorization in linuxfoundation:harbor (high 7.5)
- [CVE-2019-16917](https://insights.sbomify.com/CVE-2019-16917/): SQL injection in wikidsystems:two factor authentication enterprise server (high 8.8)
- [CVE-2019-16915](https://insights.sbomify.com/CVE-2019-16915/): Path traversal in netgate:pfsense (critical 9.8)
- [CVE-2019-16914](https://insights.sbomify.com/CVE-2019-16914/): Cross-site scripting in netgate:pfsense (medium 6.1)
- [CVE-2019-16913](https://insights.sbomify.com/CVE-2019-16913/): Misconfiguration in pcprotect:antivirus (high 7.8)
- [CVE-2019-16910](https://insights.sbomify.com/CVE-2019-16910/): Weak cryptography in arm:mbed crypto (medium 5.3)
- [CVE-2019-1691](https://insights.sbomify.com/CVE-2019-1691/): Cisco Firepower Threat Defense Software SSL or TLS Denial of Service Vulnerability (medium 5.8)
- [CVE-2019-16909](https://insights.sbomify.com/CVE-2019-16909/): Missing authorization in infosysta:in-app \& desktop notifications (medium 4.3)
- [CVE-2019-16908](https://insights.sbomify.com/CVE-2019-16908/): Information disclosure in infosysta:in-app \& desktop notifications (medium 5.3)
- [CVE-2019-16907](https://insights.sbomify.com/CVE-2019-16907/): Missing authorization in infosysta:in-app \& desktop notifications (medium 5.3)
- [CVE-2019-16906](https://insights.sbomify.com/CVE-2019-16906/): Missing authorization in infosysta:in-app \& desktop notifications (high 7.5)
- [CVE-2019-16905](https://insights.sbomify.com/CVE-2019-16905/): Integer overflow in netapp:cloud backup (high 7.8)
- [CVE-2019-16904](https://insights.sbomify.com/CVE-2019-16904/): TeamPass Cross-site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2019-16903](https://insights.sbomify.com/CVE-2019-16903/): Path traversal in plutinosoft:platinum (medium 5.3)
- [CVE-2019-16902](https://insights.sbomify.com/CVE-2019-16902/): Path traversal in reputeinfosystems:arforms (high 7.5)
- [CVE-2019-16901](https://insights.sbomify.com/CVE-2019-16901/): Other in advantech:webaccess\/hmi designer (high 7.5)
- [CVE-2019-16900](https://insights.sbomify.com/CVE-2019-16900/): Memory corruption in advantech:webaccess\/hmi designer (high 7.5)
- [CVE-2019-1690](https://insights.sbomify.com/CVE-2019-1690/): Cisco Application Policy Infrastructure Controller IPv6 Link-Local Address Vulnerability (medium 4.3)
- [CVE-2019-16899](https://insights.sbomify.com/CVE-2019-16899/): Memory corruption in advantech:webaccess\/hmi designer (high 7.5)
- [CVE-2019-16897](https://insights.sbomify.com/CVE-2019-16897/): Privilege escalation in k7computing:k7 antivirus premium (critical 9.8)
- [CVE-2019-16896](https://insights.sbomify.com/CVE-2019-16896/): Privilege escalation in k7computing:k7 ultimate security (high 7.8)
- [CVE-2019-16894](https://insights.sbomify.com/CVE-2019-16894/): SQL injection in inoideas:inoerp (critical 9.8)
- [CVE-2019-16893](https://insights.sbomify.com/CVE-2019-16893/): Missing authorization in tp-link:tp-sg105e firmware (high 7.5)
- [CVE-2019-16892](https://insights.sbomify.com/CVE-2019-16892/): Rubyzip denial of service (medium 5.5)
- [CVE-2019-16891](https://insights.sbomify.com/CVE-2019-16891/): Liferay Portal Allows RCE via Deserialization of a JSON Payload (critical 9.8)
- [CVE-2019-16890](https://insights.sbomify.com/CVE-2019-16890/): Cross-site scripting in halo:halo (medium 5.4)
- [CVE-2019-1689](https://insights.sbomify.com/CVE-2019-1689/): Cisco Webex Teams for iOS Arbitrary File Upload Vulnerability (high 7.3)
- [CVE-2019-16889](https://insights.sbomify.com/CVE-2019-16889/): Denial of service in ui:ep-r6 firmware (high 7.5)
- [CVE-2019-16887](https://insights.sbomify.com/CVE-2019-16887/): Memory corruption in irfanview:irfanview (high 7.8)
- [CVE-2019-16885](https://insights.sbomify.com/CVE-2019-16885/): Deserialization in okay-cms:okaycms (critical 9.8)
- [CVE-2019-16884](https://insights.sbomify.com/CVE-2019-16884/): Incorrect Authorization in runc (high 7.5)
- [CVE-2019-16882](https://insights.sbomify.com/CVE-2019-16882/): Use after free in string-interner (high 7.5)
- [CVE-2019-16881](https://insights.sbomify.com/CVE-2019-16881/): Use after free in portaudio-rs (critical 9.8)
- [CVE-2019-16880](https://insights.sbomify.com/CVE-2019-16880/): Double free in linea (critical 9.8)
- [CVE-2019-1688](https://insights.sbomify.com/CVE-2019-1688/): Cisco Network Assurance Engine CLI Access with Default Password Vulnerability (high 7.7)
- [CVE-2019-16879](https://insights.sbomify.com/CVE-2019-16879/): Auth bypass in mysyngeryss:husky rtu 6049-e70 firmware (critical 9.8)
- [CVE-2019-16878](https://insights.sbomify.com/CVE-2019-16878/): Cross-site scripting in portainer:portainer (medium 5.4)
- [CVE-2019-16877](https://insights.sbomify.com/CVE-2019-16877/): Missing authorization in portainer:portainer (high 8.8)
- [CVE-2019-16876](https://insights.sbomify.com/CVE-2019-16876/): Path traversal in portainer:portainer (high 7.5)
- [CVE-2019-16874](https://insights.sbomify.com/CVE-2019-16874/): Missing authorization in portainer:portainer (medium 6.5)
- [CVE-2019-16873](https://insights.sbomify.com/CVE-2019-16873/): Cross-site scripting in portainer:portainer (medium 5.4)
- [CVE-2019-16872](https://insights.sbomify.com/CVE-2019-16872/): Missing authorization in portainer:portainer (critical 9.9)
- [CVE-2019-16871](https://insights.sbomify.com/CVE-2019-16871/): Auth bypass in beckhoff:twincat (critical 9.8)
- [CVE-2019-1687](https://insights.sbomify.com/CVE-2019-1687/): Denial of service in Cisco Adaptive Security Appliance (ASA) Software (medium 6.8)
- [CVE-2019-16869](https://insights.sbomify.com/CVE-2019-16869/): HTTP Request Smuggling in Netty (high 7.5)
- [CVE-2019-16868](https://insights.sbomify.com/CVE-2019-16868/): Path traversal in emlog:emlog (critical 9.8)
- [CVE-2019-16867](https://insights.sbomify.com/CVE-2019-16867/): Path traversal in hongcms project:hongcms (medium 6.5)
- [CVE-2019-16866](https://insights.sbomify.com/CVE-2019-16866/): Memory corruption in canonical:ubuntu linux (high 7.5)
- [CVE-2019-16865](https://insights.sbomify.com/CVE-2019-16865/): DOS attack in Pillow when processing specially crafted image files (high 7.5)
- [CVE-2019-16864](https://insights.sbomify.com/CVE-2019-16864/): Command injection in enterprisedt:completeftp server (high 8.8)
- [CVE-2019-16863](https://insights.sbomify.com/CVE-2019-16863/): Weak cryptography in st:st33tphf20i2c firmware (medium 5.9)
- [CVE-2019-16862](https://insights.sbomify.com/CVE-2019-16862/): Cross-site scripting in open-emr:openemr (medium 6.1)
- [CVE-2019-16861](https://insights.sbomify.com/CVE-2019-16861/): Privilege escalation in code42:code42 (high 7.3)
- [CVE-2019-16860](https://insights.sbomify.com/CVE-2019-16860/): Privilege escalation in code42:code42 (high 7.3)
- [CVE-2019-1686](https://insights.sbomify.com/CVE-2019-1686/): Cisco ASR 9000 Series Aggregation Services Routers ACL Bypass Vulnerability (medium 5.8)
- [CVE-2019-1685](https://insights.sbomify.com/CVE-2019-1685/): Cisco Unity Connection Reflected Cross-Site Scripting Vulnerability (medium 6.1)
- [CVE-2019-1684](https://insights.sbomify.com/CVE-2019-1684/): Memory corruption in Cisco IP Phone 8800 Series Software (medium 6.5)
- [CVE-2019-1683](https://insights.sbomify.com/CVE-2019-1683/): Cisco SPA112, SPA525, and SPA5x5 Series IP Phones Certificate Validation Vulnerability (medium 6.5)
- [CVE-2019-1682](https://insights.sbomify.com/CVE-2019-1682/): Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability (high 7.8)
- [CVE-2019-1681](https://insights.sbomify.com/CVE-2019-1681/): Cisco Network Convergence System 1000 Series TFTP Directory Traversal Vulnerability (high 7.5)
- [CVE-2019-1680](https://insights.sbomify.com/CVE-2019-1680/): Cisco Webex Business Suite Content Injection Vulnerability (medium 4.3)
- [CVE-2019-16792](https://insights.sbomify.com/CVE-2019-16792/): HTTP Request Smuggling: Content-Length Sent Twice in Waitress (high 7.1)
- [CVE-2019-16791](https://insights.sbomify.com/CVE-2019-16791/): downgrade of effective Strict Transport Security (STS) policy in postfix-mta-sts-resolver (medium 6.9)
- [CVE-2019-16790](https://insights.sbomify.com/CVE-2019-16790/): Remote Code Execution in Tiny File Manager (medium 6.5)
- [CVE-2019-1679](https://insights.sbomify.com/CVE-2019-1679/): Server-side request forgery in Cisco Expressway Series (medium 5.0)
- [CVE-2019-16789](https://insights.sbomify.com/CVE-2019-16789/): HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (high 7.1)
- [CVE-2019-16786](https://insights.sbomify.com/CVE-2019-16786/): HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress (high 7.1)
- [CVE-2019-16785](https://insights.sbomify.com/CVE-2019-16785/): HTTP Request Smuggling: LF vs CRLF handling in Waitress (high 7.1)
- [CVE-2019-16784](https://insights.sbomify.com/CVE-2019-16784/): Local Privilege Escalation present only on the Windows version of PyInstaller (high 7.0)
- [CVE-2019-16782](https://insights.sbomify.com/CVE-2019-16782/): Possible Information Leak / Session Hijack Vulnerability in Rack (medium 6.3)
- [CVE-2019-16781](https://insights.sbomify.com/CVE-2019-16781/): Stored cross-site scripting (XSS) in WordPress block editor (medium 5.8)
- [CVE-2019-16780](https://insights.sbomify.com/CVE-2019-16780/): Stored cross-site scripting (XSS) in WordPress block editor (medium 5.8)
- [CVE-2019-1678](https://insights.sbomify.com/CVE-2019-1678/): Cisco Meeting Server Denial of Service Vulnerability (medium 4.3)
- [CVE-2019-16779](https://insights.sbomify.com/CVE-2019-16779/): In RubyGem excon, interrupted Persistent Connections May Leak Response Data (medium 5.8)
- [CVE-2019-16778](https://insights.sbomify.com/CVE-2019-16778/): Heap buffer overflow in `UnsortedSegmentSum` in TensorFlow (low 2.6)
- [CVE-2019-16777](https://insights.sbomify.com/CVE-2019-16777/): Arbitrary File Overwrite in npm CLI (high 7.7)
- [CVE-2019-16776](https://insights.sbomify.com/CVE-2019-16776/): Unauthorized File Access in npm CLI before before version 6.13.3 (high 7.7)
- [CVE-2019-16775](https://insights.sbomify.com/CVE-2019-16775/): Unauthorized File Access in npm CLI before before version 6.13.3 (high 7.7)
- [CVE-2019-16774](https://insights.sbomify.com/CVE-2019-16774/): Object injection in cookie driver (medium 4.4)
- [CVE-2019-16772](https://insights.sbomify.com/CVE-2019-16772/): regular expressions Cross-Site Scripting (XSS) vulnerability in serialize-to-js (low 3.1)
- [CVE-2019-16771](https://insights.sbomify.com/CVE-2019-16771/): Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria (medium 4.8)
- [CVE-2019-16770](https://insights.sbomify.com/CVE-2019-16770/): Potential DOS attack in Puma (medium 5.3)
- [CVE-2019-1677](https://insights.sbomify.com/CVE-2019-1677/): Cisco Webex Meetings for Android Cross-Site Scripting Vulnerability (medium 5.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/95/