# Vulnerabilities published in 2018


- [CVE-2018-15667](https://insights.sbomify.com/CVE-2018-15667/): Auth bypass in airmailapp:airmail (high 7.5)
- [CVE-2018-15665](https://insights.sbomify.com/CVE-2018-15665/): Information disclosure in cloudera:data science workbench (medium 5.3)
- [CVE-2018-15664](https://insights.sbomify.com/CVE-2018-15664/): Path traversal in docker:docker (high 7.5)
- [CVE-2018-15661](https://insights.sbomify.com/CVE-2018-15661/): Auth bypass in olacabs:ola money (high 7.5)
- [CVE-2018-15660](https://insights.sbomify.com/CVE-2018-15660/): Information disclosure in olacabs:olamoney (medium 5.9)
- [CVE-2018-1566](https://insights.sbomify.com/CVE-2018-1566/): Memory corruption in DB2 for Linux, UNIX and Windows (high 8.4)
- [CVE-2018-15659](https://insights.sbomify.com/CVE-2018-15659/): Misconfiguration in 42gears:suremdm (medium 6.5)
- [CVE-2018-15658](https://insights.sbomify.com/CVE-2018-15658/): Information disclosure in 42gears:suremdm (high 7.5)
- [CVE-2018-15657](https://insights.sbomify.com/CVE-2018-15657/): Server-side request forgery in 42gears:suremdm (high 7.3)
- [CVE-2018-15656](https://insights.sbomify.com/CVE-2018-15656/): Information disclosure in 42gears:suremdm (high 7.5)
- [CVE-2018-15655](https://insights.sbomify.com/CVE-2018-15655/): Misconfiguration in 42gears:suremdm (medium 6.5)
- [CVE-2018-1565](https://insights.sbomify.com/CVE-2018-1565/): Memory corruption in DB2 for Linux, UNIX and Windows (high 8.4)
- [CVE-2018-15645](https://insights.sbomify.com/CVE-2018-15645/): Missing authorization in Odoo Community (high 8.1)
- [CVE-2018-15641](https://insights.sbomify.com/CVE-2018-15641/): Cross-site scripting in Odoo Community (medium 6.3)
- [CVE-2018-15640](https://insights.sbomify.com/CVE-2018-15640/): Privilege escalation in Odoo Enterprise (high 8.1)
- [CVE-2018-1564](https://insights.sbomify.com/CVE-2018-1564/): Information disclosure in Sterling B2B Integrator (medium 4.4)
- [CVE-2018-15638](https://insights.sbomify.com/CVE-2018-15638/): Cross-site scripting in Odoo Community (high 7.1)
- [CVE-2018-15635](https://insights.sbomify.com/CVE-2018-15635/): Cross-site scripting in Odoo Community (medium 5.9)
- [CVE-2018-15634](https://insights.sbomify.com/CVE-2018-15634/): Cross-site scripting in Odoo Community (high 7.1)
- [CVE-2018-15633](https://insights.sbomify.com/CVE-2018-15633/): Cross-site scripting in Odoo Community (high 7.1)
- [CVE-2018-15632](https://insights.sbomify.com/CVE-2018-15632/): Auth bypass in Odoo Community (high 8.2)
- [CVE-2018-15631](https://insights.sbomify.com/CVE-2018-15631/): Missing authorization in Odoo Community (medium 6.5)
- [CVE-2018-1563](https://insights.sbomify.com/CVE-2018-1563/): Cross-site scripting in Sterling File Gateway (medium 5.4)
- [CVE-2018-15617](https://insights.sbomify.com/CVE-2018-15617/): Communication Manager Denial of Service (medium 6.5)
- [CVE-2018-15616](https://insights.sbomify.com/CVE-2018-15616/): System Platform Web UI Deserialization (critical 9.0)
- [CVE-2018-15615](https://insights.sbomify.com/CVE-2018-15615/): CMS Supervisor Information Disclosure (high 7.2)
- [CVE-2018-15614](https://insights.sbomify.com/CVE-2018-15614/): IP Office one-X Portal XSS (medium 6.8)
- [CVE-2018-15613](https://insights.sbomify.com/CVE-2018-15613/): Orchestration Designer Runtime Config XSS (high 8.3)
- [CVE-2018-15612](https://insights.sbomify.com/CVE-2018-15612/): Orchestration Designer Runtime Config CSRF (high 8.3)
- [CVE-2018-15611](https://insights.sbomify.com/CVE-2018-15611/): Communication Manager Local Administrator PrivEsc (medium 6.3)
- [CVE-2018-15610](https://insights.sbomify.com/CVE-2018-15610/): Improper access controls in IP Office one-X Portal (high 7.3)
- [CVE-2018-15608](https://insights.sbomify.com/CVE-2018-15608/): Cross-site scripting in manageengine:admanager plus (medium 6.1)
- [CVE-2018-15607](https://insights.sbomify.com/CVE-2018-15607/): Denial of service in imagemagick:imagemagick (medium 6.5)
- [CVE-2018-15606](https://insights.sbomify.com/CVE-2018-15606/): Cross-site scripting in salesagility:suitecrm (medium 6.1)
- [CVE-2018-15605](https://insights.sbomify.com/CVE-2018-15605/): phpMyAdmin Cross-site Scripting (XSS) in the import dialog (medium 6.1)
- [CVE-2018-15603](https://insights.sbomify.com/CVE-2018-15603/): Cross-site scripting in victor cms project:victor cms (medium 6.1)
- [CVE-2018-15602](https://insights.sbomify.com/CVE-2018-15602/): Cross-site scripting in zyxel:vmg3312 b10b firmware (medium 6.1)
- [CVE-2018-15601](https://insights.sbomify.com/CVE-2018-15601/): Elefant CMS Improper Input Validation (critical 9.8)
- [CVE-2018-1560](https://insights.sbomify.com/CVE-2018-1560/): Cross-site scripting in Rational Engineering Lifecycle Manager (medium 5.4)
- [CVE-2018-15599](https://insights.sbomify.com/CVE-2018-15599/): Information disclosure in debian:debian linux (medium 5.3)
- [CVE-2018-15598](https://insights.sbomify.com/CVE-2018-15598/): Traefik Missing Authentication (high 7.5)
- [CVE-2018-15596](https://insights.sbomify.com/CVE-2018-15596/): Cross-site scripting in mybb:mybb (medium 6.1)
- [CVE-2018-15594](https://insights.sbomify.com/CVE-2018-15594/): Information disclosure in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-15593](https://insights.sbomify.com/CVE-2018-15593/): Weak cryptography in ivanti:workspace control (high 7.8)
- [CVE-2018-15592](https://insights.sbomify.com/CVE-2018-15592/): Privilege escalation in ivanti:workspace control (high 7.8)
- [CVE-2018-15591](https://insights.sbomify.com/CVE-2018-15591/): Security feature bypass in ivanti:workspace control (high 7.8)
- [CVE-2018-15590](https://insights.sbomify.com/CVE-2018-15590/): Security feature bypass in ivanti:workspace control (medium 5.5)
- [CVE-2018-15588](https://insights.sbomify.com/CVE-2018-15588/): Security feature bypass in freron:mailmate (high 7.5)
- [CVE-2018-15587](https://insights.sbomify.com/CVE-2018-15587/): Security feature bypass in debian:debian linux (medium 6.5)
- [CVE-2018-15586](https://insights.sbomify.com/CVE-2018-15586/): Security feature bypass in enigmail:enigmail (medium 6.5)
- [CVE-2018-15585](https://insights.sbomify.com/CVE-2018-15585/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2018-15584](https://insights.sbomify.com/CVE-2018-15584/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2018-15583](https://insights.sbomify.com/CVE-2018-15583/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2018-15582](https://insights.sbomify.com/CVE-2018-15582/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2018-15581](https://insights.sbomify.com/CVE-2018-15581/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2018-15580](https://insights.sbomify.com/CVE-2018-15580/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2018-1558](https://insights.sbomify.com/CVE-2018-1558/): Cross-site scripting in Rational Collaborative Lifecycle Management (medium 5.4)
- [CVE-2018-15576](https://insights.sbomify.com/CVE-2018-15576/): Deserialization in hazzardweb:easylogin pro (high 8.1)
- [CVE-2018-15574](https://insights.sbomify.com/CVE-2018-15574/): Cross-site scripting in reprisesoftware:reprise license manager (medium 6.1)
- [CVE-2018-15573](https://insights.sbomify.com/CVE-2018-15573/): File upload in reprisesoftware:reprise license manager (high 8.8)
- [CVE-2018-15572](https://insights.sbomify.com/CVE-2018-15572/): Information disclosure in canonical:ubuntu linux (medium 6.5)
- [CVE-2018-15571](https://insights.sbomify.com/CVE-2018-15571/): Code injection in export users to csv project:export users to csv (high 8.6)
- [CVE-2018-15570](https://insights.sbomify.com/CVE-2018-15570/): Cross-site scripting in bijiadao:waimai super cms (medium 4.8)
- [CVE-2018-1557](https://insights.sbomify.com/CVE-2018-1557/): Cross-site scripting in Rational Quality Manager (medium 5.4)
- [CVE-2018-15569](https://insights.sbomify.com/CVE-2018-15569/): Cross-site request forgery in mylittleforum:my little forum (medium 6.5)
- [CVE-2018-15568](https://insights.sbomify.com/CVE-2018-15568/): Cross-site request forgery in tp5cms project:tp5cms (high 8.8)
- [CVE-2018-15567](https://insights.sbomify.com/CVE-2018-15567/): Cross-site scripting in cmsuno project:cmsuno (medium 6.1)
- [CVE-2018-15566](https://insights.sbomify.com/CVE-2018-15566/): Cross-site scripting in tp5cms project:tp5cms (medium 6.1)
- [CVE-2018-15565](https://insights.sbomify.com/CVE-2018-15565/): Missing authorization in simple-cms project:simple cms (high 8.8)
- [CVE-2018-15564](https://insights.sbomify.com/CVE-2018-15564/): Cross-site request forgery in simple-cms project:simple cms (high 8.8)
- [CVE-2018-15563](https://insights.sbomify.com/CVE-2018-15563/): Subrion CMS Stored Cross-site Scripting (XSS) (medium 6.1)
- [CVE-2018-15562](https://insights.sbomify.com/CVE-2018-15562/): Cross-site scripting in isweb:isweb (medium 6.1)
- [CVE-2018-15560](https://insights.sbomify.com/CVE-2018-15560/): PyCryptodome integer overflow vulnerability (high 7.5)
- [CVE-2018-1556](https://insights.sbomify.com/CVE-2018-1556/): Cross-site scripting in FileNet P8 Platform (medium 5.4)
- [CVE-2018-15559](https://insights.sbomify.com/CVE-2018-15559/): Cross-site scripting in xiuno:xiunobbs (medium 6.1)
- [CVE-2018-15557](https://insights.sbomify.com/CVE-2018-15557/): Privilege escalation in actiontec:web6000q firmware (high 8.8)
- [CVE-2018-15556](https://insights.sbomify.com/CVE-2018-15556/): Auth bypass in actiontec:web6000q firmware (critical 9.8)
- [CVE-2018-15555](https://insights.sbomify.com/CVE-2018-15555/): Hardcoded credentials in actiontec:web6000q firmware (critical 9.8)
- [CVE-2018-15553](https://insights.sbomify.com/CVE-2018-15553/): Command injection in telus:actiontec t2200h firmware (high 8.8)
- [CVE-2018-15552](https://insights.sbomify.com/CVE-2018-15552/): Weak cryptography in theethereumlottery:the ethereum lottery (high 7.5)
- [CVE-2018-1555](https://insights.sbomify.com/CVE-2018-1555/): Cross-site scripting in FileNet P8 Platform (medium 5.4)
- [CVE-2018-15546](https://insights.sbomify.com/CVE-2018-15546/): Cross-site scripting in accusoft:prizmdoc (medium 6.1)
- [CVE-2018-15543](https://insights.sbomify.com/CVE-2018-15543/): Auth bypass in telegram:telegram (medium 6.8)
- [CVE-2018-15542](https://insights.sbomify.com/CVE-2018-15542/): Auth bypass in telegram:telegram (medium 6.4)
- [CVE-2018-15540](https://insights.sbomify.com/CVE-2018-15540/): Path traversal in agentejo:cockpit (critical 9.8)
- [CVE-2018-1554](https://insights.sbomify.com/CVE-2018-1554/): Cross-site scripting in Maximo Asset Management (medium 5.4)
- [CVE-2018-15539](https://insights.sbomify.com/CVE-2018-15539/): Cross-site request forgery in agentejo:cockpit (high 8.8)
- [CVE-2018-15538](https://insights.sbomify.com/CVE-2018-15538/): Cross-site scripting in agentejo:cockpit (medium 6.1)
- [CVE-2018-15537](https://insights.sbomify.com/CVE-2018-15537/): File upload in ocsinventory-ng:ocsinventory ng (high 8.8)
- [CVE-2018-15536](https://insights.sbomify.com/CVE-2018-15536/): Path traversal in tecrail:responsive filemanager (medium 5.5)
- [CVE-2018-15535](https://insights.sbomify.com/CVE-2018-15535/): Path traversal in tecrail:responsive filemanager (high 7.5)
- [CVE-2018-15534](https://insights.sbomify.com/CVE-2018-15534/): Information disclosure in geutebrueck:re porter 16 firmware (critical 9.8)
- [CVE-2018-15533](https://insights.sbomify.com/CVE-2018-15533/): Cross-site scripting in geutebrueck:re porter 16 firmware (medium 6.1)
- [CVE-2018-15532](https://insights.sbomify.com/CVE-2018-15532/): Information disclosure in hp:synaptics touchpad driver (low 3.8)
- [CVE-2018-15531](https://insights.sbomify.com/CVE-2018-15531/): JavaMelody has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java. (critical 9.8)
- [CVE-2018-15530](https://insights.sbomify.com/CVE-2018-15530/): Cross-site scripting in xerox:colorqube 8580 firmware (medium 6.1)
- [CVE-2018-1553](https://insights.sbomify.com/CVE-2018-1553/): Information disclosure in IBM WebSphere Application Server Liberty (medium 5.3)
- [CVE-2018-15529](https://insights.sbomify.com/CVE-2018-15529/): Command injection in mutiny:mutiny (high 8.8)
- [CVE-2018-15528](https://insights.sbomify.com/CVE-2018-15528/): Cross-site scripting in javasystemsolutions:sso plugin (medium 6.1)
- [CVE-2018-15520](https://insights.sbomify.com/CVE-2018-15520/): Memory corruption in lexmark:cx421 firmware (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/104/