# Vulnerabilities published in 2019


- [CVE-2019-16769](https://insights.sbomify.com/CVE-2019-16769/): Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS) (medium 4.2)
- [CVE-2019-16768](https://insights.sbomify.com/CVE-2019-16768/): Internal exception message exposure for login action in Sylius (low 3.5)
- [CVE-2019-16767](https://insights.sbomify.com/CVE-2019-16767/): In EzMaster before 5.2.11 docker containers were executed with advanced privileges by default (medium 6.6)
- [CVE-2019-16766](https://insights.sbomify.com/CVE-2019-16766/): 2FA bypass in Wagtail through new device path (high 8.7)
- [CVE-2019-16765](https://insights.sbomify.com/CVE-2019-16765/): Code injection in vscode-codeql (high 7.4)
- [CVE-2019-16764](https://insights.sbomify.com/CVE-2019-16764/): PowAssent is susceptible to denial of service attacks (medium 6.5)
- [CVE-2019-16763](https://insights.sbomify.com/CVE-2019-16763/): XSS in Pannellum from 2.5.0 through 2.5.4 (medium 4.8)
- [CVE-2019-16762](https://insights.sbomify.com/CVE-2019-16762/): Validator parsing discrepancy due to string encoding in NPM slpjs (medium 5.7)
- [CVE-2019-16761](https://insights.sbomify.com/CVE-2019-16761/): Validator parsing discrepancy due to string encoding in NPM slp-validate 1.0.0 (medium 5.7)
- [CVE-2019-16760](https://insights.sbomify.com/CVE-2019-16760/): Cargo prior to Rust 1.26.0 may download the wrong dependency (medium 4.6)
- [CVE-2019-1676](https://insights.sbomify.com/CVE-2019-1676/): Cisco Meeting Server SIP Processing Denial of Service Vulnerability (medium 6.8)
- [CVE-2019-16759](https://insights.sbomify.com/CVE-2019-16759/): vBulletin PHP Module Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2019-16758](https://insights.sbomify.com/CVE-2019-16758/): Path traversal in lexmark:services monitor firmware (high 7.5)
- [CVE-2019-16755](https://insights.sbomify.com/CVE-2019-16755/): Deserialization in bmc:myit digital workplace (critical 9.8)
- [CVE-2019-16754](https://insights.sbomify.com/CVE-2019-16754/): Null dereference in riot-os:riot (high 7.5)
- [CVE-2019-16753](https://insights.sbomify.com/CVE-2019-16753/): Weak cryptography in decentralized anonymous payment system project:decentralized anonymous payment system (high 7.5)
- [CVE-2019-16752](https://insights.sbomify.com/CVE-2019-16752/): Server-side request forgery in dash:dash core (medium 4.3)
- [CVE-2019-16751](https://insights.sbomify.com/CVE-2019-16751/): Devise Token Auth vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2019-1675](https://insights.sbomify.com/CVE-2019-1675/): Cisco Aironet Active Sensor Static Credentials Vulnerability (high 7.5)
- [CVE-2019-16748](https://insights.sbomify.com/CVE-2019-16748/): Memory corruption in wolfssl:wolfssl (critical 9.8)
- [CVE-2019-16747](https://insights.sbomify.com/CVE-2019-16747/): Memory corruption in matrixssl:matrixssl (high 7.5)
- [CVE-2019-16746](https://insights.sbomify.com/CVE-2019-16746/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2019-16745](https://insights.sbomify.com/CVE-2019-16745/): SQL injection in ebrigade:ebrigade (high 8.8)
- [CVE-2019-16744](https://insights.sbomify.com/CVE-2019-16744/): SQL injection in ebrigade:ebrigade (high 8.8)
- [CVE-2019-16743](https://insights.sbomify.com/CVE-2019-16743/): SQL injection in ebrigade:ebrigade (high 8.8)
- [CVE-2019-1674](https://insights.sbomify.com/CVE-2019-1674/): Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection Vulnerability (high 7.8)
- [CVE-2019-16738](https://insights.sbomify.com/CVE-2019-16738/): MediaWiki information disclosure (medium 5.3)
- [CVE-2019-16737](https://insights.sbomify.com/CVE-2019-16737/): Command injection in petwant:pf-103 firmware (critical 9.8)
- [CVE-2019-16736](https://insights.sbomify.com/CVE-2019-16736/): Memory corruption in petwant:pf-103 firmware (critical 9.8)
- [CVE-2019-16735](https://insights.sbomify.com/CVE-2019-16735/): Memory corruption in petwant:pf-103 firmware (critical 9.8)
- [CVE-2019-16734](https://insights.sbomify.com/CVE-2019-16734/): Hardcoded credentials in petwant:pf-103 firmware (critical 9.8)
- [CVE-2019-16733](https://insights.sbomify.com/CVE-2019-16733/): Command injection in petwant:pf-103 firmware (critical 9.8)
- [CVE-2019-16732](https://insights.sbomify.com/CVE-2019-16732/): Weak cryptography in petwant:pf-103 firmware (high 8.1)
- [CVE-2019-16731](https://insights.sbomify.com/CVE-2019-16731/): Missing authorization in petwant:pf-103 firmware (high 7.5)
- [CVE-2019-16730](https://insights.sbomify.com/CVE-2019-16730/): Command injection in petwant:pf-103 firmware (critical 9.8)
- [CVE-2019-1673](https://insights.sbomify.com/CVE-2019-1673/): Cisco Identity Services Engine Cross-Site Scripting Vulnerability (medium 5.4)
- [CVE-2019-16729](https://insights.sbomify.com/CVE-2019-16729/): Privilege escalation in canonical:ubuntu linux (high 7.8)
- [CVE-2019-16728](https://insights.sbomify.com/CVE-2019-16728/): Cross-Site Scripting in dompurify (medium 6.1)
- [CVE-2019-16725](https://insights.sbomify.com/CVE-2019-16725/): Joomla! XSS in Default Templates (medium 6.1)
- [CVE-2019-16724](https://insights.sbomify.com/CVE-2019-16724/): Memory corruption in upredsun:file sharing wizard (critical 9.8)
- [CVE-2019-16723](https://insights.sbomify.com/CVE-2019-16723/): Missing authorization in cacti:cacti (medium 4.3)
- [CVE-2019-16722](https://insights.sbomify.com/CVE-2019-16722/): Code injection in zzzcms:zzzphp (critical 9.8)
- [CVE-2019-16721](https://insights.sbomify.com/CVE-2019-16721/): Cross-site request forgery in 5none:nonecms (medium 6.5)
- [CVE-2019-16720](https://insights.sbomify.com/CVE-2019-16720/): File upload in zzzcms:zzzphp (high 7.5)
- [CVE-2019-1672](https://insights.sbomify.com/CVE-2019-1672/): Cisco Web Security Appliance Decryption Policy Bypass Vulnerability (medium 5.8)
- [CVE-2019-16719](https://insights.sbomify.com/CVE-2019-16719/): Cross-site request forgery in wtcms project:wtcms (medium 6.5)
- [CVE-2019-16718](https://insights.sbomify.com/CVE-2019-16718/): Command injection in radare:radare2 (high 7.8)
- [CVE-2019-16717](https://insights.sbomify.com/CVE-2019-16717/): OX App Suite through 7.10.2 has XSS. (medium 6.1)
- [CVE-2019-16716](https://insights.sbomify.com/CVE-2019-16716/): Missing authorization in open-xchange:open-xchange appsuite (medium 6.6)
- [CVE-2019-16714](https://insights.sbomify.com/CVE-2019-16714/): Information disclosure in canonical:ubuntu linux (high 7.5)
- [CVE-2019-16713](https://insights.sbomify.com/CVE-2019-16713/): Denial of service in canonical:ubuntu linux (medium 6.5)
- [CVE-2019-16712](https://insights.sbomify.com/CVE-2019-16712/): Denial of service in imagemagick:imagemagick (medium 6.5)
- [CVE-2019-16711](https://insights.sbomify.com/CVE-2019-16711/): Denial of service in canonical:ubuntu linux (medium 6.5)
- [CVE-2019-16710](https://insights.sbomify.com/CVE-2019-16710/): Denial of service in canonical:ubuntu linux (medium 6.5)
- [CVE-2019-1671](https://insights.sbomify.com/CVE-2019-1671/): Cisco Firepower Management Center Cross-Site Scripting Vulnerability (medium 6.1)
- [CVE-2019-16709](https://insights.sbomify.com/CVE-2019-16709/): Denial of service in canonical:ubuntu linux (medium 6.5)
- [CVE-2019-16708](https://insights.sbomify.com/CVE-2019-16708/): Denial of service in canonical:ubuntu linux (medium 6.5)
- [CVE-2019-16707](https://insights.sbomify.com/CVE-2019-16707/): Memory corruption in fedoraproject:fedora (medium 6.5)
- [CVE-2019-16706](https://insights.sbomify.com/CVE-2019-16706/): Cross-site request forgery in kkcms project:kkcms (high 8.8)
- [CVE-2019-16705](https://insights.sbomify.com/CVE-2019-16705/): Memory corruption in libming:libming (critical 9.1)
- [CVE-2019-16704](https://insights.sbomify.com/CVE-2019-16704/): Cross-site scripting in phpmywind:phpmywind (medium 4.8)
- [CVE-2019-16703](https://insights.sbomify.com/CVE-2019-16703/): Cross-site scripting in phpmywind:phpmywind (medium 6.1)
- [CVE-2019-16702](https://insights.sbomify.com/CVE-2019-16702/): Memory corruption in integard pro project:integard pro (critical 9.8)
- [CVE-2019-16701](https://insights.sbomify.com/CVE-2019-16701/): Command injection in netgate:pfsense (high 8.8)
- [CVE-2019-16700](https://insights.sbomify.com/CVE-2019-16700/): slub_events for Typo3 Arbitrary File Upload (critical 9.8)
- [CVE-2019-1670](https://insights.sbomify.com/CVE-2019-1670/): Cisco Unified Intelligence Center Software Cross-Site Scripting Vulnerability (medium 6.1)
- [CVE-2019-16699](https://insights.sbomify.com/CVE-2019-16699/): sr_freecap for Typo3 RCE Vulnerability (critical 9.8)
- [CVE-2019-16698](https://insights.sbomify.com/CVE-2019-16698/): direct_mail for Typo3 sensitive data exposure (medium 4.3)
- [CVE-2019-16696](https://insights.sbomify.com/CVE-2019-16696/): SQL injection in phpipam:phpipam (critical 9.8)
- [CVE-2019-16695](https://insights.sbomify.com/CVE-2019-16695/): SQL injection in phpipam:phpipam (critical 9.8)
- [CVE-2019-16694](https://insights.sbomify.com/CVE-2019-16694/): SQL injection in phpipam:phpipam (critical 9.8)
- [CVE-2019-16693](https://insights.sbomify.com/CVE-2019-16693/): SQL injection in phpipam:phpipam (critical 9.8)
- [CVE-2019-16692](https://insights.sbomify.com/CVE-2019-16692/): SQL injection in phpipam:phpipam (critical 9.8)
- [CVE-2019-1669](https://insights.sbomify.com/CVE-2019-1669/): Cisco Firepower Threat Defense Software Packet Inspection and Enforcement Bypass Vulnerability (high 8.6)
- [CVE-2019-16688](https://insights.sbomify.com/CVE-2019-16688/): Dolibarr stored Cross-site Scripting in an Email Template section (medium 5.4)
- [CVE-2019-16687](https://insights.sbomify.com/CVE-2019-16687/): Dolibarr Cross-site Scripting in a User Profile in a Signature section (medium 5.4)
- [CVE-2019-16686](https://insights.sbomify.com/CVE-2019-16686/): Dolibarr Cross-site Scripting in a User Note section (medium 5.4)
- [CVE-2019-16685](https://insights.sbomify.com/CVE-2019-16685/): Dolibarr stored Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2019-16684](https://insights.sbomify.com/CVE-2019-16684/): Cross-site scripting in xoops:xoops (medium 4.8)
- [CVE-2019-16683](https://insights.sbomify.com/CVE-2019-16683/): Cross-site scripting in xoops:xoops (medium 4.8)
- [CVE-2019-16682](https://insights.sbomify.com/CVE-2019-16682/): url_redirect for Typo3 SQLi Vulnerability (high 7.3)
- [CVE-2019-16681](https://insights.sbomify.com/CVE-2019-16681/): Other in traveloka:traveloka (medium 4.7)
- [CVE-2019-16680](https://insights.sbomify.com/CVE-2019-16680/): Path traversal in canonical:ubuntu linux (medium 4.3)
- [CVE-2019-1668](https://insights.sbomify.com/CVE-2019-1668/): Cisco SocialMiner Chat Feed Cross-Site Scripting Vulnerability (medium 6.1)
- [CVE-2019-16679](https://insights.sbomify.com/CVE-2019-16679/): Path traversal in gilacms:gila cms (medium 4.9)
- [CVE-2019-16678](https://insights.sbomify.com/CVE-2019-16678/): Cross-site request forgery in yzmcms:yzmcms (medium 6.5)
- [CVE-2019-16677](https://insights.sbomify.com/CVE-2019-16677/): Cross-site request forgery in idreamsoft:icms (medium 6.5)
- [CVE-2019-16676](https://insights.sbomify.com/CVE-2019-16676/): Improper Input Validation in simple_form (critical 9.8)
- [CVE-2019-16675](https://insights.sbomify.com/CVE-2019-16675/): Memory corruption in phoenixcontact:config\+ (high 7.8)
- [CVE-2019-16674](https://insights.sbomify.com/CVE-2019-16674/): Weak cryptography in weidmueller:ie-sw-pl08m-6tx-2sc firmware (critical 9.8)
- [CVE-2019-16673](https://insights.sbomify.com/CVE-2019-16673/): Information disclosure in weidmueller:ie-sw-pl08m-6tx-2sc firmware (high 7.5)
- [CVE-2019-16672](https://insights.sbomify.com/CVE-2019-16672/): Information disclosure in weidmueller:ie-sw-pl08m-6tx-2sc firmware (critical 9.8)
- [CVE-2019-16671](https://insights.sbomify.com/CVE-2019-16671/): Denial of service in weidmueller:ie-sw-pl08m-6tx-2sc firmware (medium 6.5)
- [CVE-2019-16670](https://insights.sbomify.com/CVE-2019-16670/): Auth bypass in weidmueller:ie-sw-pl08m-6tx-2sc firmware (critical 9.8)
- [CVE-2019-1667](https://insights.sbomify.com/CVE-2019-1667/): Cisco HyperFlex Arbitrary Statistics Write Vulnerability (medium 4.0)
- [CVE-2019-16669](https://insights.sbomify.com/CVE-2019-16669/): Pagekit User enumeration (medium 5.3)
- [CVE-2019-16667](https://insights.sbomify.com/CVE-2019-16667/): Cross-site request forgery in netgate:pfsense (high 8.8)
- [CVE-2019-16665](https://insights.sbomify.com/CVE-2019-16665/): Cross-site scripting in thinksaas:thinksaas (medium 6.1)
- [CVE-2019-16664](https://insights.sbomify.com/CVE-2019-16664/): Cross-site scripting in thinksaas:thinksaas (medium 4.8)
- [CVE-2019-16663](https://insights.sbomify.com/CVE-2019-16663/): Command injection in rconfig:rconfig (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/96/