# Vulnerabilities published in 2019


- [CVE-2019-16662](https://insights.sbomify.com/CVE-2019-16662/): Command injection in rconfig:rconfig (critical 9.8)
- [CVE-2019-16661](https://insights.sbomify.com/CVE-2019-16661/): Cross-site scripting in digimute:ogma cms (medium 5.4)
- [CVE-2019-16660](https://insights.sbomify.com/CVE-2019-16660/): Cross-site request forgery in joyplus project:joyplus (high 8.8)
- [CVE-2019-1666](https://insights.sbomify.com/CVE-2019-1666/): Cisco HyperFlex Unauthenticated Statistics Retrieval Vulnerability (medium 5.3)
- [CVE-2019-16659](https://insights.sbomify.com/CVE-2019-16659/): Cross-site request forgery in tuzicms:tuzicms (high 8.8)
- [CVE-2019-16658](https://insights.sbomify.com/CVE-2019-16658/): Cross-site request forgery in tuzicms:tuzicms (high 8.8)
- [CVE-2019-16657](https://insights.sbomify.com/CVE-2019-16657/): Cross-site scripting in tuzicms:tuzicms (medium 6.1)
- [CVE-2019-16656](https://insights.sbomify.com/CVE-2019-16656/): Code injection in joyplus project:joyplus (critical 9.8)
- [CVE-2019-16655](https://insights.sbomify.com/CVE-2019-16655/): Misconfiguration in joyplus project:joyplus (high 7.5)
- [CVE-2019-16653](https://insights.sbomify.com/CVE-2019-16653/): Privilege escalation in geniusbytes:genius server (high 8.8)
- [CVE-2019-16652](https://insights.sbomify.com/CVE-2019-16652/): Command injection in geniusbytes:genius server (high 7.2)
- [CVE-2019-16651](https://insights.sbomify.com/CVE-2019-16651/): Information disclosure in virginmedia:super hub 3 firmware (medium 5.3)
- [CVE-2019-16650](https://insights.sbomify.com/CVE-2019-16650/): Auth bypass in supermicro:a1sa2-2750f firmware (critical 10.0)
- [CVE-2019-1665](https://insights.sbomify.com/CVE-2019-1665/): Cisco Hyperflex Stored Cross-Site Scripting Vulnerability (medium 4.7)
- [CVE-2019-16649](https://insights.sbomify.com/CVE-2019-16649/): Weak cryptography in supermicro:a1sa2-2750f firmware (critical 10.0)
- [CVE-2019-16647](https://insights.sbomify.com/CVE-2019-16647/): Privilege escalation in maxthon:maxthon browser (high 7.2)
- [CVE-2019-16645](https://insights.sbomify.com/CVE-2019-16645/): Other in embedthis:goahead (high 8.6)
- [CVE-2019-16644](https://insights.sbomify.com/CVE-2019-16644/): SQL injection in tuzicms:tuzicms (critical 9.8)
- [CVE-2019-16643](https://insights.sbomify.com/CVE-2019-16643/): Cross-site scripting in zrlog:zrlog (medium 5.4)
- [CVE-2019-16642](https://insights.sbomify.com/CVE-2019-16642/): SQL injection in yejiao:tuzicms (critical 9.8)
- [CVE-2019-16641](https://insights.sbomify.com/CVE-2019-16641/): Memory corruption in ruijie:eg-2000se firmware (high 8.4)
- [CVE-2019-16640](https://insights.sbomify.com/CVE-2019-16640/): File upload in ruijie:eg-2000se firmware (high 7.5)
- [CVE-2019-1664](https://insights.sbomify.com/CVE-2019-1664/): Cisco HyperFlex Software Unauthenticated Root Access Vulnerability (high 8.1)
- [CVE-2019-16639](https://insights.sbomify.com/CVE-2019-16639/): Missing authorization in ruijie:eg-2000se firmware (critical 9.8)
- [CVE-2019-16638](https://insights.sbomify.com/CVE-2019-16638/): Weak cryptography in ruijie:eg-2000se firmware (high 7.5)
- [CVE-2019-1663](https://insights.sbomify.com/CVE-2019-1663/): Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability (critical 9.8)
- [CVE-2019-1662](https://insights.sbomify.com/CVE-2019-1662/): Cisco Prime Collaboration Assurance Software Unauthenticated Access Vulnerability (high 8.2)
- [CVE-2019-1661](https://insights.sbomify.com/CVE-2019-1661/): Cisco TelePresence Management Suite Cross-Site Scripting Vulnerability (medium 6.1)
- [CVE-2019-1660](https://insights.sbomify.com/CVE-2019-1660/): Cisco TelePresence Management Suite Simple Object Access Protocol Vulnerability (medium 5.3)
- [CVE-2019-1659](https://insights.sbomify.com/CVE-2019-1659/): Cisco Prime Infrastructure Certificate Validation Vulnerability (high 7.4)
- [CVE-2019-1658](https://insights.sbomify.com/CVE-2019-1658/): Cisco Unified Intelligence Center Cross-Site Request Forgery Vulnerability (medium 4.7)
- [CVE-2019-16576](https://insights.sbomify.com/CVE-2019-16576/): Improper Authorization in Jenkins Alauda Kubernetes Suport Plugin (medium 6.5)
- [CVE-2019-16575](https://insights.sbomify.com/CVE-2019-16575/): Cross-Site Request Forgery in Jenkins Alauda Kubernetes Suport Plugin (high 8.8)
- [CVE-2019-16574](https://insights.sbomify.com/CVE-2019-16574/): Jenkins Alauda DevOps Pipeline Plugin allows attackers with Overall/Read permission to capture credentials stored in Jenkins (medium 6.5)
- [CVE-2019-16573](https://insights.sbomify.com/CVE-2019-16573/): Jenkins Alauda DevOps Pipeline Plugin vulnerable to cross-site request forgery (high 8.8)
- [CVE-2019-16572](https://insights.sbomify.com/CVE-2019-16572/): Jenkins Weibo Plugin stores credentials unencrypted in its global configuration file (medium 5.5)
- [CVE-2019-16571](https://insights.sbomify.com/CVE-2019-16571/): Jenkins RapidDeploy Plugin missing permission check (medium 4.3)
- [CVE-2019-16570](https://insights.sbomify.com/CVE-2019-16570/): Jenkins RapidDeploy Plugin Cross-Site Request Forgery plugin (high 8.8)
- [CVE-2019-1657](https://insights.sbomify.com/CVE-2019-1657/): Cisco AMP Threat Grid API Key Information Disclosure Vulnerability (medium 4.3)
- [CVE-2019-16569](https://insights.sbomify.com/CVE-2019-16569/): CSRF vulnerability in Jenkins Mantis Plugin (medium 4.3)
- [CVE-2019-16568](https://insights.sbomify.com/CVE-2019-16568/): Jenkins SCTMExecutor Plugin stores credentials in plain text (medium 5.3)
- [CVE-2019-16567](https://insights.sbomify.com/CVE-2019-16567/): Jenkins Team Concert Plugin missing permission check (medium 4.3)
- [CVE-2019-16566](https://insights.sbomify.com/CVE-2019-16566/): Jenkins Team Concert Plugin missing permission check (medium 6.5)
- [CVE-2019-16565](https://insights.sbomify.com/CVE-2019-16565/): Jenkins Team Concert Plugin cross-site request forgery vulnerability (high 8.8)
- [CVE-2019-16564](https://insights.sbomify.com/CVE-2019-16564/): Jenkins Pipeline Aggregator View Plugin stored XSS vulnerability (medium 5.4)
- [CVE-2019-16563](https://insights.sbomify.com/CVE-2019-16563/): Cross site scripting in Jenkins Mission Control Plugin (medium 5.4)
- [CVE-2019-16562](https://insights.sbomify.com/CVE-2019-16562/): Jenkins buildgraph-view Plugin vulnerable to stored Cross-site Scripting (medium 5.4)
- [CVE-2019-16561](https://insights.sbomify.com/CVE-2019-16561/): SSL/TLS certificate validation globally and unconditionally disabled by Jenkins WebSphere Deployer Plugin (high 7.1)
- [CVE-2019-16560](https://insights.sbomify.com/CVE-2019-16560/): Cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin (high 8.8)
- [CVE-2019-1656](https://insights.sbomify.com/CVE-2019-1656/): Cisco Enterprise NFV Infrastructure Software Linux Shell Access Vulnerability (medium 5.3)
- [CVE-2019-16559](https://insights.sbomify.com/CVE-2019-16559/): Jenkins WebSphere Deployer Plugin missing permission check (medium 5.4)
- [CVE-2019-16558](https://insights.sbomify.com/CVE-2019-16558/): Improper Certificate Validation in Jenkins Spira Importer Plugin (high 8.2)
- [CVE-2019-16557](https://insights.sbomify.com/CVE-2019-16557/): Jenkins Redgate SQL Change Automation Plugin has Insufficiently Protected Credentials (medium 6.5)
- [CVE-2019-16556](https://insights.sbomify.com/CVE-2019-16556/): Jenkins Rundeck Plugin stored credentials in plain text (medium 6.5)
- [CVE-2019-16555](https://insights.sbomify.com/CVE-2019-16555/): Inefficient Regular Expression Complexity in Jenkins Build Failure Analyzer Plugin (medium 6.5)
- [CVE-2019-16554](https://insights.sbomify.com/CVE-2019-16554/): Missing permission check in Jenkins Build Failure Analyzer Plugin (medium 4.3)
- [CVE-2019-16553](https://insights.sbomify.com/CVE-2019-16553/): Cross-Site Request Forgery in Jenkins Build Failure Analyzer Plugin (high 8.8)
- [CVE-2019-16552](https://insights.sbomify.com/CVE-2019-16552/): Missing permission check in Jenkins Gerrit Trigger Plugin (medium 5.4)
- [CVE-2019-16551](https://insights.sbomify.com/CVE-2019-16551/): Cross-Site Request Forgery in Jenkins Gerrit Trigger Plugin (high 8.8)
- [CVE-2019-16550](https://insights.sbomify.com/CVE-2019-16550/): Cross-site request forgery (CSRF) vulnerability in Jenkins Maven Release Plugin (high 8.8)
- [CVE-2019-1655](https://insights.sbomify.com/CVE-2019-1655/): Cisco Webex Meetings Server Cross-Site Scripting Vulnerability (medium 6.1)
- [CVE-2019-16549](https://insights.sbomify.com/CVE-2019-16549/): Jenkins Maven Release Plug-in Plugin XXE vulnerability (high 8.1)
- [CVE-2019-16548](https://insights.sbomify.com/CVE-2019-16548/): Jenkins Google Compute Engine Plugin Cross-Site Request Forgery vulnerability (high 8.8)
- [CVE-2019-16547](https://insights.sbomify.com/CVE-2019-16547/): Jenkins Google Compute Engine Plugin Missing Authorization vulnerability (medium 4.3)
- [CVE-2019-16546](https://insights.sbomify.com/CVE-2019-16546/): Jenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the plugin (medium 5.9)
- [CVE-2019-16545](https://insights.sbomify.com/CVE-2019-16545/): Jenkins QMetry for JIRA Plugin shows plain text password in configuration form (medium 6.5)
- [CVE-2019-16544](https://insights.sbomify.com/CVE-2019-16544/): Jenkins QMetry for JIRA Plugin stored credentials in plain text (high 8.8)
- [CVE-2019-16543](https://insights.sbomify.com/CVE-2019-16543/): Plaintext Storage in Jenkins Spira Importer Plugin (medium 5.5)
- [CVE-2019-16542](https://insights.sbomify.com/CVE-2019-16542/): Jenkins Anchore Container Scanner Plugin vulnerable to Insufficiently Protected Credentials (medium 6.5)
- [CVE-2019-16541](https://insights.sbomify.com/CVE-2019-16541/): Jenkins JIRA Plugin allows users to select and use credentials with System scope (critical 9.9)
- [CVE-2019-16540](https://insights.sbomify.com/CVE-2019-16540/): Jenkins Support Core Plugin allowed users with Overall/Read permission to delete arbitrary files (medium 6.5)
- [CVE-2019-1654](https://insights.sbomify.com/CVE-2019-1654/): Cisco Aironet Series Access Points Development Shell Access Vulnerability (high 7.8)
- [CVE-2019-16539](https://insights.sbomify.com/CVE-2019-16539/): Missing permission check in Jenkins Support Core Plugin (medium 6.5)
- [CVE-2019-16538](https://insights.sbomify.com/CVE-2019-16538/): Incorrect Authorization in Jenkins Script Security Plugin (high 8.8)
- [CVE-2019-16536](https://insights.sbomify.com/CVE-2019-16536/): Stack overflow leading to DoS can be triggered by a malicious authenticated client. (high 8.2)
- [CVE-2019-16535](https://insights.sbomify.com/CVE-2019-16535/): Memory corruption in ClickHouse (critical 9.8)
- [CVE-2019-16534](https://insights.sbomify.com/CVE-2019-16534/): Cross-site scripting in draytek:vigor2925 firmware (medium 6.1)
- [CVE-2019-16533](https://insights.sbomify.com/CVE-2019-16533/): Cross-site scripting in draytek:vigor2925 firmware (medium 6.1)
- [CVE-2019-16532](https://insights.sbomify.com/CVE-2019-16532/): Other in yzmcms:yzmcms (medium 6.1)
- [CVE-2019-16531](https://insights.sbomify.com/CVE-2019-16531/): Cross-site request forgery in layerbb:layerbb (high 8.8)
- [CVE-2019-16530](https://insights.sbomify.com/CVE-2019-16530/): Unrestricted Upload of File with Dangerous Type in Sonatype Nexus Repository Manager (high 7.2)
- [CVE-2019-1653](https://insights.sbomify.com/CVE-2019-1653/): Cisco Small Business RV320 and RV325 Routers Information Disclosure (high 7.5, exploited in the wild)
- [CVE-2019-16529](https://insights.sbomify.com/CVE-2019-16529/): Information disclosure in mediawiki:checkuser (medium 5.3)
- [CVE-2019-16528](https://insights.sbomify.com/CVE-2019-16528/): Information disclosure in mediawiki:abusefilter (high 7.5)
- [CVE-2019-16525](https://insights.sbomify.com/CVE-2019-16525/): Cross-site scripting in checklist:checklist (medium 6.1)
- [CVE-2019-16524](https://insights.sbomify.com/CVE-2019-16524/): Cross-site scripting in status301:easy fancybox (medium 4.8)
- [CVE-2019-16523](https://insights.sbomify.com/CVE-2019-16523/): Cross-site scripting in pixelite:events manager (medium 5.4)
- [CVE-2019-16522](https://insights.sbomify.com/CVE-2019-16522/): Cross-site scripting in eu cookie law project:eu cookie law (medium 4.8)
- [CVE-2019-16521](https://insights.sbomify.com/CVE-2019-16521/): Cross-site scripting in managewp:broken link checker (medium 6.1)
- [CVE-2019-16520](https://insights.sbomify.com/CVE-2019-16520/): Cross-site scripting in semperplugins:all in one seo pack (medium 5.4)
- [CVE-2019-1652](https://insights.sbomify.com/CVE-2019-1652/): Cisco Small Business Routers Improper Input Validation (high 7.2, exploited in the wild)
- [CVE-2019-16519](https://insights.sbomify.com/CVE-2019-16519/): Privilege escalation in eset:cyber security (high 7.8)
- [CVE-2019-16518](https://insights.sbomify.com/CVE-2019-16518/): Other in vandyvape:swell kit mod firmware (medium 4.3)
- [CVE-2019-16517](https://insights.sbomify.com/CVE-2019-16517/): Misconfiguration in connectwise:control (critical 9.8)
- [CVE-2019-16516](https://insights.sbomify.com/CVE-2019-16516/): Information disclosure in connectwise:control (medium 5.3)
- [CVE-2019-16515](https://insights.sbomify.com/CVE-2019-16515/): Misconfiguration in connectwise:control (medium 6.5)
- [CVE-2019-16514](https://insights.sbomify.com/CVE-2019-16514/): File upload in connectwise:control (high 7.2)
- [CVE-2019-16513](https://insights.sbomify.com/CVE-2019-16513/): Cross-site request forgery in connectwise:control (high 8.8)
- [CVE-2019-16512](https://insights.sbomify.com/CVE-2019-16512/): Cross-site scripting in connectwise:control (medium 4.8)
- [CVE-2019-16511](https://insights.sbomify.com/CVE-2019-16511/): Path traversal in firegiant:wix toolset (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/97/