# Vulnerabilities published in 2018


- [CVE-2018-15920](https://insights.sbomify.com/CVE-2018-15920/): Use after free in Adobe Acrobat and Reader (high 7.8)
- [CVE-2018-15919](https://insights.sbomify.com/CVE-2018-15919/): Information disclosure in netapp:cloud backup (medium 5.3)
- [CVE-2018-15918](https://insights.sbomify.com/CVE-2018-15918/): SQL injection in jorani project:jorani (medium 5.4)
- [CVE-2018-15917](https://insights.sbomify.com/CVE-2018-15917/): Cross-site scripting in jorani project:jorani (medium 5.4)
- [CVE-2018-15913](https://insights.sbomify.com/CVE-2018-15913/): Cross-site scripting in cloudera:cloudera manager (medium 6.1)
- [CVE-2018-15912](https://insights.sbomify.com/CVE-2018-15912/): Privilege escalation in manjaro:manjaro linux (high 7.8)
- [CVE-2018-15911](https://insights.sbomify.com/CVE-2018-15911/): Memory corruption in artifex:ghostscript (high 7.8)
- [CVE-2018-15910](https://insights.sbomify.com/CVE-2018-15910/): Memory corruption in artifex:ghostscript (high 7.8)
- [CVE-2018-15909](https://insights.sbomify.com/CVE-2018-15909/): Memory corruption in artifex:ghostscript (high 7.8)
- [CVE-2018-15908](https://insights.sbomify.com/CVE-2018-15908/): Security feature bypass in artifex:ghostscript (high 7.8)
- [CVE-2018-15907](https://insights.sbomify.com/CVE-2018-15907/): Denial of service in technicolor:tc8305c firmware (medium 6.5)
- [CVE-2018-15906](https://insights.sbomify.com/CVE-2018-15906/): Code injection in solarwinds:serv-u ftp server (high 7.2)
- [CVE-2018-15904](https://insights.sbomify.com/CVE-2018-15904/): Security feature bypass in a10networks:acos web application firewall (critical 9.8)
- [CVE-2018-15903](https://insights.sbomify.com/CVE-2018-15903/): Cross-site scripting in claromentis:claromentis (medium 5.4)
- [CVE-2018-15901](https://insights.sbomify.com/CVE-2018-15901/): Cross-site request forgery in e107:e107 (high 8.8)
- [CVE-2018-15899](https://insights.sbomify.com/CVE-2018-15899/): Cross-site scripting in 1234n:minicms (medium 6.1)
- [CVE-2018-15898](https://insights.sbomify.com/CVE-2018-15898/): Security feature bypass in subsonic:music streamer (medium 5.9)
- [CVE-2018-15897](https://insights.sbomify.com/CVE-2018-15897/): Cross-site scripting in website seller script project:website seller script (medium 6.5)
- [CVE-2018-15896](https://insights.sbomify.com/CVE-2018-15896/): Cross-site scripting in website seller script project:website seller script (medium 5.4)
- [CVE-2018-15895](https://insights.sbomify.com/CVE-2018-15895/): Server-side request forgery in icmsdev:icms (high 7.5)
- [CVE-2018-15894](https://insights.sbomify.com/CVE-2018-15894/): SQL injection in wuzhi cms project:wuzhi cms (critical 9.8)
- [CVE-2018-15893](https://insights.sbomify.com/CVE-2018-15893/): SQL injection in wuzhi cms project:wuzhi cms (critical 9.8)
- [CVE-2018-15892](https://insights.sbomify.com/CVE-2018-15892/): SQL injection in freepbx:disa (medium 4.3)
- [CVE-2018-15891](https://insights.sbomify.com/CVE-2018-15891/): Cross-site scripting in freepbx:freepbx (medium 4.8)
- [CVE-2018-15890](https://insights.sbomify.com/CVE-2018-15890/): Deserialization of Untrusted Data in EthereumJ (critical 9.8)
- [CVE-2018-15888](https://insights.sbomify.com/CVE-2018-15888/): Privilege escalation in aspcms:aspcms (critical 9.8)
- [CVE-2018-15887](https://insights.sbomify.com/CVE-2018-15887/): Command injection in asus:dsl-n12e c1 firmware (high 8.8)
- [CVE-2018-15886](https://insights.sbomify.com/CVE-2018-15886/): Code injection in monstra:monstra (high 7.2)
- [CVE-2018-15885](https://insights.sbomify.com/CVE-2018-15885/): Security feature bypass in ovation:findme (high 7.5)
- [CVE-2018-15884](https://insights.sbomify.com/CVE-2018-15884/): Cross-site scripting in ricoh:mp c4504ex firmware (high 8.8)
- [CVE-2018-15882](https://insights.sbomify.com/CVE-2018-15882/): File upload in joomla:joomla\! (critical 9.8)
- [CVE-2018-15881](https://insights.sbomify.com/CVE-2018-15881/): Missing authorization in joomla:joomla\! (high 7.5)
- [CVE-2018-15880](https://insights.sbomify.com/CVE-2018-15880/): Cross-site scripting in joomla:joomla\! (medium 5.4)
- [CVE-2018-1588](https://insights.sbomify.com/CVE-2018-1588/): XML external entity in Rational Engineering Lifecycle Manager (high 7.1)
- [CVE-2018-15877](https://insights.sbomify.com/CVE-2018-15877/): Command injection in plainview activity monitor project:plainview activity monitor (high 8.8)
- [CVE-2018-15876](https://insights.sbomify.com/CVE-2018-15876/): Security feature bypass in ajax bootmodal login project:ajax bootmodal login (medium 5.3)
- [CVE-2018-15875](https://insights.sbomify.com/CVE-2018-15875/): Cross-site scripting in dlink:dir-615 firmware (medium 6.1)
- [CVE-2018-15874](https://insights.sbomify.com/CVE-2018-15874/): Cross-site scripting in dlink:dir-615 firmware (medium 6.1)
- [CVE-2018-15873](https://insights.sbomify.com/CVE-2018-15873/): SQL injection in sapplica:sentrifugo (critical 9.8)
- [CVE-2018-15871](https://insights.sbomify.com/CVE-2018-15871/): Memory corruption in libming:libming (medium 6.5)
- [CVE-2018-15870](https://insights.sbomify.com/CVE-2018-15870/): Memory corruption in libming:libming (medium 6.5)
- [CVE-2018-1587](https://insights.sbomify.com/CVE-2018-1587/): Information disclosure in Rational Rhapsody Design Manager (medium 4.3)
- [CVE-2018-15869](https://insights.sbomify.com/CVE-2018-15869/): Supply chain in hashicorp:packer (medium 5.3)
- [CVE-2018-15868](https://insights.sbomify.com/CVE-2018-15868/): SQL injection in chronoscan:chronoscan (critical 9.8)
- [CVE-2018-15865](https://insights.sbomify.com/CVE-2018-15865/): Privilege escalation in pulsesecure:pulse secure desktop client (high 7.8)
- [CVE-2018-15864](https://insights.sbomify.com/CVE-2018-15864/): Null dereference in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-15863](https://insights.sbomify.com/CVE-2018-15863/): Null dereference in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-15862](https://insights.sbomify.com/CVE-2018-15862/): Null dereference in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-15861](https://insights.sbomify.com/CVE-2018-15861/): Null dereference in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-15859](https://insights.sbomify.com/CVE-2018-15859/): Null dereference in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-15858](https://insights.sbomify.com/CVE-2018-15858/): Null dereference in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-15857](https://insights.sbomify.com/CVE-2018-15857/): Memory corruption in canonical:ubuntu linux (high 7.8)
- [CVE-2018-15856](https://insights.sbomify.com/CVE-2018-15856/): Denial of service in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-15855](https://insights.sbomify.com/CVE-2018-15855/): Null dereference in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-15854](https://insights.sbomify.com/CVE-2018-15854/): Null dereference in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-15853](https://insights.sbomify.com/CVE-2018-15853/): Denial of service in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-15852](https://insights.sbomify.com/CVE-2018-15852/): Denial of service in technicolor:tc7200.20 firmware (medium 6.5)
- [CVE-2018-15851](https://insights.sbomify.com/CVE-2018-15851/): Cross-site request forgery in flexocms project:flexo cms (high 8.8)
- [CVE-2018-15850](https://insights.sbomify.com/CVE-2018-15850/): Cross-site request forgery in redaxo:redaxo cms (high 8.8)
- [CVE-2018-1585](https://insights.sbomify.com/CVE-2018-1585/): Cross-site scripting in Rational Rhapsody Design Manager (medium 5.4)
- [CVE-2018-15849](https://insights.sbomify.com/CVE-2018-15849/): Cross-site request forgery in portfoliocms project:portfoliocms (medium 4.3)
- [CVE-2018-15848](https://insights.sbomify.com/CVE-2018-15848/): Cross-site request forgery in portfoliocms project:portfoliocms (high 8.8)
- [CVE-2018-15847](https://insights.sbomify.com/CVE-2018-15847/): Cross-site scripting in puppycms:puppycms (medium 6.1)
- [CVE-2018-15846](https://insights.sbomify.com/CVE-2018-15846/): Cross-site request forgery in fledrcms project:fledrcms (high 8.8)
- [CVE-2018-15845](https://insights.sbomify.com/CVE-2018-15845/): Gleez CMS CSRF Allows Adding of Administrator Accounts (high 8.8)
- [CVE-2018-15844](https://insights.sbomify.com/CVE-2018-15844/): Cross-site request forgery in damicms:damicms (high 8.8)
- [CVE-2018-15843](https://insights.sbomify.com/CVE-2018-15843/): Cross-site scripting in get-simple:getsimple cms (medium 4.8)
- [CVE-2018-15842](https://insights.sbomify.com/CVE-2018-15842/): Cross-site scripting in wolfcms:wolf cms (medium 4.8)
- [CVE-2018-15840](https://insights.sbomify.com/CVE-2018-15840/): Denial of service in tp-link:tl-wr840n firmware (high 7.5)
- [CVE-2018-1584](https://insights.sbomify.com/CVE-2018-1584/): Cross-site scripting in Maximo Asset Management (medium 5.4)
- [CVE-2018-15839](https://insights.sbomify.com/CVE-2018-15839/): Memory corruption in dlink:dir-615 firmware (critical 9.8)
- [CVE-2018-15836](https://insights.sbomify.com/CVE-2018-15836/): Weak cryptography in xelerance:openswan (high 7.5)
- [CVE-2018-15835](https://insights.sbomify.com/CVE-2018-15835/): Misconfiguration in google:android (high 7.5)
- [CVE-2018-15834](https://insights.sbomify.com/CVE-2018-15834/): Memory corruption in radare:radare2 (medium 5.5)
- [CVE-2018-15833](https://insights.sbomify.com/CVE-2018-15833/): Business logic in vanillaforums:vanilla forums (medium 4.3)
- [CVE-2018-15832](https://insights.sbomify.com/CVE-2018-15832/): Command injection in ubisoft:uplay (high 8.8)
- [CVE-2018-1583](https://insights.sbomify.com/CVE-2018-1583/): Security feature bypass in StoredIQ (medium 5.4)
- [CVE-2018-15822](https://insights.sbomify.com/CVE-2018-15822/): Denial of service in canonical:ubuntu linux (high 7.5)
- [CVE-2018-15820](https://insights.sbomify.com/CVE-2018-15820/): Cross-site scripting in easyio:easyio 30p firmware (medium 6.1)
- [CVE-2018-15819](https://insights.sbomify.com/CVE-2018-15819/): Auth bypass in easyio:easyio 30p firmware (high 7.5)
- [CVE-2018-15818](https://insights.sbomify.com/CVE-2018-15818/): Path traversal in reputeinfosystems:repute arforms (high 7.5)
- [CVE-2018-15817](https://insights.sbomify.com/CVE-2018-15817/): Memory corruption in faststone:image viewer (medium 5.5)
- [CVE-2018-15816](https://insights.sbomify.com/CVE-2018-15816/): Memory corruption in faststone:image viewer (medium 5.5)
- [CVE-2018-15815](https://insights.sbomify.com/CVE-2018-15815/): Memory corruption in faststone:image viewer (medium 5.5)
- [CVE-2018-15814](https://insights.sbomify.com/CVE-2018-15814/): Memory corruption in faststone:image viewer (medium 5.5)
- [CVE-2018-15813](https://insights.sbomify.com/CVE-2018-15813/): Memory corruption in faststone:image viewer (medium 5.5)
- [CVE-2018-15812](https://insights.sbomify.com/CVE-2018-15812/): Insufficient Entropy in DotNetNuke (high 7.5)
- [CVE-2018-15811](https://insights.sbomify.com/CVE-2018-15811/): DotNetNuke (DNN) Inadequate Encryption Strength (high 7.5, exploited in the wild)
- [CVE-2018-15810](https://insights.sbomify.com/CVE-2018-15810/): Path traversal in visiology:flipbox (high 7.5)
- [CVE-2018-15809](https://insights.sbomify.com/CVE-2018-15809/): Misconfiguration in accupos:accupos (medium 5.5)
- [CVE-2018-15808](https://insights.sbomify.com/CVE-2018-15808/): Hardcoded credentials in posim:evo (critical 9.8)
- [CVE-2018-15807](https://insights.sbomify.com/CVE-2018-15807/): Weak cryptography in posim:evo (high 7.8)
- [CVE-2018-15805](https://insights.sbomify.com/CVE-2018-15805/): XML external entity in accusoft:prizmdoc (critical 9.1)
- [CVE-2018-15804](https://insights.sbomify.com/CVE-2018-15804/): Privilege escalation in mapr:mapr (high 8.8)
- [CVE-2018-15801](https://insights.sbomify.com/CVE-2018-15801/): Authorization Bypass During JWT Issuer Validation with spring-security (low 3.3)
- [CVE-2018-15800](https://insights.sbomify.com/CVE-2018-15800/): Timing attack allows extraction of signing key in Bits Service (high 8.1)
- [CVE-2018-15798](https://insights.sbomify.com/CVE-2018-15798/): Pivotal Concourse allows malicious redirect urls on login (high 7.6)
- [CVE-2018-15797](https://insights.sbomify.com/CVE-2018-15797/): NFS Volume release errand leaks cf admin credentials in logs (high 8.4)
- [CVE-2018-15796](https://insights.sbomify.com/CVE-2018-15796/): Signing Key Extraction in Bits Service Release (high 8.1)
- [CVE-2018-15795](https://insights.sbomify.com/CVE-2018-15795/): CredHub Service Broker uses guessable client secret (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/102/