# Vulnerabilities published in 2019


- [CVE-2019-16334](https://insights.sbomify.com/CVE-2019-16334/): Cross-site scripting in bludit:bludit (medium 4.8)
- [CVE-2019-16333](https://insights.sbomify.com/CVE-2019-16333/): Cross-site scripting in get-simple:getsimple cms (medium 5.4)
- [CVE-2019-16332](https://insights.sbomify.com/CVE-2019-16332/): Cross-site scripting in api bearer auth project:api bearer auth (medium 6.1)
- [CVE-2019-16330](https://insights.sbomify.com/CVE-2019-16330/): Cross-site scripting in nchsoftware:express accounts accounting (medium 5.4)
- [CVE-2019-16328](https://insights.sbomify.com/CVE-2019-16328/): Duplicate Advisory: Possible remote code execution via a remote procedure call (high 7.5)
- [CVE-2019-16327](https://insights.sbomify.com/CVE-2019-16327/): Auth bypass in dlink:dir-601 firmware (critical 9.8)
- [CVE-2019-16326](https://insights.sbomify.com/CVE-2019-16326/): Cross-site request forgery in dlink:dir-601 firmware (high 8.8)
- [CVE-2019-16321](https://insights.sbomify.com/CVE-2019-16321/): Cross-site scripting in scadabr:scadabr (medium 6.1)
- [CVE-2019-16320](https://insights.sbomify.com/CVE-2019-16320/): Information disclosure in cobham:sailor 600 vsat ku firmware (medium 5.3)
- [CVE-2019-1632](https://insights.sbomify.com/CVE-2019-1632/): Cisco Integrated Management Controller Cross-Site Request Forgery Vulnerability (medium 4.6)
- [CVE-2019-16319](https://insights.sbomify.com/CVE-2019-16319/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2019-16318](https://insights.sbomify.com/CVE-2019-16318/): Pimcore Unrestricted Upload of File with Dangerous Type (high 8.8)
- [CVE-2019-16317](https://insights.sbomify.com/CVE-2019-16317/): Pimcore RCE via PHAR upload (high 8.8)
- [CVE-2019-16314](https://insights.sbomify.com/CVE-2019-16314/): Code injection in indexhibit:indexhibit (critical 9.8)
- [CVE-2019-16313](https://insights.sbomify.com/CVE-2019-16313/): Information disclosure in ifw8:fr5-e firmware (high 7.5)
- [CVE-2019-16312](https://insights.sbomify.com/CVE-2019-16312/): Cross-site scripting in s-cms:s-cms (medium 6.1)
- [CVE-2019-16311](https://insights.sbomify.com/CVE-2019-16311/): Cross-site request forgery in niushop:niushop (high 8.8)
- [CVE-2019-16310](https://insights.sbomify.com/CVE-2019-16310/): Cross-site scripting in niushop:niushop (medium 5.4)
- [CVE-2019-1631](https://insights.sbomify.com/CVE-2019-1631/): Cisco Integrated Management Controller Information Disclosure Vulnerability (medium 5.3)
- [CVE-2019-16309](https://insights.sbomify.com/CVE-2019-16309/): SQL injection in flamecms project:flamecms (critical 9.8)
- [CVE-2019-16307](https://insights.sbomify.com/CVE-2019-16307/): Cross-site scripting in fujixerox:docushare (medium 6.1)
- [CVE-2019-16305](https://insights.sbomify.com/CVE-2019-16305/): Command injection in mobatek:mobaxterm (high 8.8)
- [CVE-2019-16303](https://insights.sbomify.com/CVE-2019-16303/): JHipster Kotlin using insecure source of randomness `RandomStringUtils` before v1.2.0 (critical 9.8)
- [CVE-2019-16302](https://insights.sbomify.com/CVE-2019-16302/): Other in linuxfoundation:open network operating system (high 7.5)
- [CVE-2019-16301](https://insights.sbomify.com/CVE-2019-16301/): Other in linuxfoundation:open network operating system (high 7.5)
- [CVE-2019-16300](https://insights.sbomify.com/CVE-2019-16300/): Other in linuxfoundation:open network operating system (high 7.5)
- [CVE-2019-1630](https://insights.sbomify.com/CVE-2019-1630/): Cisco Integrated Management Controller Denial of Service Vulnerability (medium 5.5)
- [CVE-2019-16299](https://insights.sbomify.com/CVE-2019-16299/): Other in linuxfoundation:open network operating system (high 7.5)
- [CVE-2019-16298](https://insights.sbomify.com/CVE-2019-16298/): Other in linuxfoundation:open network operating system (high 7.5)
- [CVE-2019-16297](https://insights.sbomify.com/CVE-2019-16297/): Other in linuxfoundation:open network operating system (high 7.5)
- [CVE-2019-16295](https://insights.sbomify.com/CVE-2019-16295/): Cross-site scripting in control-webpanel:webpanel (medium 4.6)
- [CVE-2019-16294](https://insights.sbomify.com/CVE-2019-16294/): Memory corruption in notepad-plus-plus:notepad\+\+ (high 7.8)
- [CVE-2019-16293](https://insights.sbomify.com/CVE-2019-16293/): Command injection in opmantek:open-audit (high 8.8)
- [CVE-2019-1629](https://insights.sbomify.com/CVE-2019-1629/): Cisco Integrated Management Controller Arbitrary File Write Vulnerability (medium 5.3)
- [CVE-2019-16289](https://insights.sbomify.com/CVE-2019-16289/): Cross-site scripting in webcraftic:woody ad snippets (medium 5.4)
- [CVE-2019-16288](https://insights.sbomify.com/CVE-2019-16288/): Memory corruption in tenda:n301 firmware (high 7.5)
- [CVE-2019-16287](https://insights.sbomify.com/CVE-2019-16287/): Security feature bypass in ThinPro Linux (medium 6.8)
- [CVE-2019-16286](https://insights.sbomify.com/CVE-2019-16286/): Security feature bypass in ThinPro Linux (medium 6.8)
- [CVE-2019-16285](https://insights.sbomify.com/CVE-2019-16285/): Information disclosure in ThinPro Linux (medium 4.6)
- [CVE-2019-16284](https://insights.sbomify.com/CVE-2019-16284/): Memory corruption in Multiple - See https://support.hp.com/rs-en/document/c06456250 (high 7.2)
- [CVE-2019-16283](https://insights.sbomify.com/CVE-2019-16283/): Code injection in HP Softpaq installer (high 7.8)
- [CVE-2019-16282](https://insights.sbomify.com/CVE-2019-16282/): Cross-site scripting in nchsoftware:express invoice (medium 5.4)
- [CVE-2019-16281](https://insights.sbomify.com/CVE-2019-16281/): Auth bypass in ptarmigan project:ptarmigan (high 7.5)
- [CVE-2019-1628](https://insights.sbomify.com/CVE-2019-1628/): Cisco Integrated Management Controller Denial of Service Vulnerability (medium 5.5)
- [CVE-2019-16279](https://insights.sbomify.com/CVE-2019-16279/): Memory corruption in nazgul:nostromo nhttpd (high 7.5)
- [CVE-2019-16278](https://insights.sbomify.com/CVE-2019-16278/): Nostromo nhttpd Directory Traversal (critical 9.8, exploited in the wild)
- [CVE-2019-16277](https://insights.sbomify.com/CVE-2019-16277/): Memory corruption in picoc project:picoc (high 7.8)
- [CVE-2019-16276](https://insights.sbomify.com/CVE-2019-16276/): Other in debian:debian linux (high 7.5)
- [CVE-2019-16275](https://insights.sbomify.com/CVE-2019-16275/): Denial of service in canonical:ubuntu linux (medium 6.5)
- [CVE-2019-16274](https://insights.sbomify.com/CVE-2019-16274/): Information disclosure in dten:d5 firmware (high 7.5)
- [CVE-2019-16273](https://insights.sbomify.com/CVE-2019-16273/): Auth bypass in dten:d5 firmware (critical 9.8)
- [CVE-2019-16272](https://insights.sbomify.com/CVE-2019-16272/): Misconfiguration in dten:d5 firmware (critical 9.8)
- [CVE-2019-16271](https://insights.sbomify.com/CVE-2019-16271/): Missing authorization in dten:d5 firmware (medium 5.3)
- [CVE-2019-1627](https://insights.sbomify.com/CVE-2019-1627/): Cisco Integrated Management Controller Information Disclosure Vulnerability (medium 6.5)
- [CVE-2019-16268](https://insights.sbomify.com/CVE-2019-16268/): Cross-site scripting in zohocorp:manageengine remote access plus (medium 4.8)
- [CVE-2019-16265](https://insights.sbomify.com/CVE-2019-16265/): Memory corruption in codesys:codesys (critical 9.8)
- [CVE-2019-16264](https://insights.sbomify.com/CVE-2019-16264/): SQL injection in egpp:sistema integrado de gestion academica (critical 9.8)
- [CVE-2019-16263](https://insights.sbomify.com/CVE-2019-16263/): Security feature bypass in twitter:twitter kit (high 7.4)
- [CVE-2019-16261](https://insights.sbomify.com/CVE-2019-16261/): Auth bypass in tripplite:pdumh15at firmware (critical 9.1)
- [CVE-2019-1626](https://insights.sbomify.com/CVE-2019-1626/): Cisco SD-WAN Solution Privilege Escalation Vulnerability (high 8.8)
- [CVE-2019-16258](https://insights.sbomify.com/CVE-2019-16258/): Auth bypass in hom.ee:brain cube core (medium 6.8)
- [CVE-2019-16257](https://insights.sbomify.com/CVE-2019-16257/): Other in motorola:motorola firmware (critical 9.8)
- [CVE-2019-16256](https://insights.sbomify.com/CVE-2019-16256/): SIMalliance Toolbox Browser Command Injection (critical 9.8, exploited in the wild)
- [CVE-2019-16255](https://insights.sbomify.com/CVE-2019-16255/): Code injection in debian:debian linux (high 8.1)
- [CVE-2019-16254](https://insights.sbomify.com/CVE-2019-16254/): Other in debian:debian linux (medium 5.3)
- [CVE-2019-16253](https://insights.sbomify.com/CVE-2019-16253/): Privilege escalation in samsung:text-to-speech (high 7.8)
- [CVE-2019-16252](https://insights.sbomify.com/CVE-2019-16252/): Security feature bypass in nutfind:nutfind (medium 5.9)
- [CVE-2019-16251](https://insights.sbomify.com/CVE-2019-16251/): Missing authorization in yithemes:yith advanced refund system for woocommerce (medium 4.3)
- [CVE-2019-16250](https://insights.sbomify.com/CVE-2019-16250/): Auth bypass in oceanwp:ocean extra (high 7.5)
- [CVE-2019-1625](https://insights.sbomify.com/CVE-2019-1625/): Cisco SD-WAN Solution Privilege Escalation Vulnerability (high 7.8)
- [CVE-2019-16249](https://insights.sbomify.com/CVE-2019-16249/): Out-of-bounds Read in OpenCV (medium 5.3)
- [CVE-2019-16248](https://insights.sbomify.com/CVE-2019-16248/): Other in telegram:telegram (medium 5.5)
- [CVE-2019-16247](https://insights.sbomify.com/CVE-2019-16247/): Memory corruption in deltaww:dcisoft (high 7.8)
- [CVE-2019-16246](https://insights.sbomify.com/CVE-2019-16246/): Path traversal in intesync:solismed (critical 9.8)
- [CVE-2019-16245](https://insights.sbomify.com/CVE-2019-16245/): Information disclosure in openmicroscopy:omero (medium 5.3)
- [CVE-2019-16244](https://insights.sbomify.com/CVE-2019-16244/): Security feature bypass in openmicroscopy:omero.server (critical 9.8)
- [CVE-2019-16243](https://insights.sbomify.com/CVE-2019-16243/): Missing authorization in alcatelmobile:cingular flip 2 firmware (medium 6.1)
- [CVE-2019-16242](https://insights.sbomify.com/CVE-2019-16242/): Command injection in alcatelmobile:cingular flip 2 firmware (medium 6.8)
- [CVE-2019-16241](https://insights.sbomify.com/CVE-2019-16241/): Auth bypass in alcatelmobile:cingular flip 2 firmware (medium 6.8)
- [CVE-2019-16240](https://insights.sbomify.com/CVE-2019-16240/): Memory corruption in hp:officejet pro 8210 d9l63a firmware (critical 9.1)
- [CVE-2019-1624](https://insights.sbomify.com/CVE-2019-1624/): Cisco SD-WAN Solution Command Injection Vulnerability (high 8.8)
- [CVE-2019-16239](https://insights.sbomify.com/CVE-2019-16239/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2019-16238](https://insights.sbomify.com/CVE-2019-16238/): Cross-site scripting in afterlogic:aurora (medium 6.1)
- [CVE-2019-16237](https://insights.sbomify.com/CVE-2019-16237/): Security feature bypass in canonical:ubuntu linux (high 7.5)
- [CVE-2019-16236](https://insights.sbomify.com/CVE-2019-16236/): Missing authorization in canonical:ubuntu linux (high 7.5)
- [CVE-2019-16235](https://insights.sbomify.com/CVE-2019-16235/): Security feature bypass in canonical:ubuntu linux (high 7.5)
- [CVE-2019-16234](https://insights.sbomify.com/CVE-2019-16234/): Null dereference in canonical:ubuntu linux (medium 4.7)
- [CVE-2019-16233](https://insights.sbomify.com/CVE-2019-16233/): Null dereference in canonical:ubuntu linux (medium 4.1)
- [CVE-2019-16232](https://insights.sbomify.com/CVE-2019-16232/): Null dereference in canonical:ubuntu linux (medium 4.1)
- [CVE-2019-16231](https://insights.sbomify.com/CVE-2019-16231/): Null dereference in canonical:ubuntu linux (medium 4.1)
- [CVE-2019-16230](https://insights.sbomify.com/CVE-2019-16230/): Null dereference in linux:linux kernel (medium 4.7)
- [CVE-2019-1623](https://insights.sbomify.com/CVE-2019-1623/): Cisco Meeting Server CLI Command Injection Vulnerability (medium 6.7)
- [CVE-2019-16229](https://insights.sbomify.com/CVE-2019-16229/): Null dereference in canonical:ubuntu linux (medium 4.1)
- [CVE-2019-16228](https://insights.sbomify.com/CVE-2019-16228/): py-lmdb Divide by Zero interruptions (high 7.5)
- [CVE-2019-16227](https://insights.sbomify.com/CVE-2019-16227/): py-lmdb Invalid write operation (critical 9.8)
- [CVE-2019-16226](https://insights.sbomify.com/CVE-2019-16226/): LMDB invalid write (high 7.5)
- [CVE-2019-16225](https://insights.sbomify.com/CVE-2019-16225/): py-lmdb Invalid write operation (critical 9.8)
- [CVE-2019-16224](https://insights.sbomify.com/CVE-2019-16224/): py-lmdb Invalid write operation (critical 9.8)
- [CVE-2019-16223](https://insights.sbomify.com/CVE-2019-16223/): Cross-site scripting in debian:debian linux (medium 5.4)
- [CVE-2019-16222](https://insights.sbomify.com/CVE-2019-16222/): Cross-site scripting in debian:debian linux (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/99/