# Vulnerabilities published in 2018


- [CVE-2018-15314](https://insights.sbomify.com/CVE-2018-15314/): Cross-site scripting in BIG-IP AFM (medium 6.1)
- [CVE-2018-15313](https://insights.sbomify.com/CVE-2018-15313/): Cross-site scripting in BIG-IP AFM (medium 6.1)
- [CVE-2018-15312](https://insights.sbomify.com/CVE-2018-15312/): Cross-site scripting in BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) (medium 6.1)
- [CVE-2018-15311](https://insights.sbomify.com/CVE-2018-15311/): Denial of service in BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) (medium 5.9)
- [CVE-2018-15310](https://insights.sbomify.com/CVE-2018-15310/): Information disclosure in BIG-IP APM (medium 4.3)
- [CVE-2018-1529](https://insights.sbomify.com/CVE-2018-1529/): Cross-site scripting in ibm:rational doors next generation (medium 5.4)
- [CVE-2018-1528](https://insights.sbomify.com/CVE-2018-1528/): Information disclosure in Maximo Asset Management (medium 4.3)
- [CVE-2018-1525](https://insights.sbomify.com/CVE-2018-1525/): Misconfiguration in i2 Enterprise Insight Analysis (medium 5.9)
- [CVE-2018-1524](https://insights.sbomify.com/CVE-2018-1524/): Hardcoded credentials in Maximo Asset Management (high 8.8)
- [CVE-2018-1523](https://insights.sbomify.com/CVE-2018-1523/): Cross-site scripting in Rational Quality Manager (medium 5.4)
- [CVE-2018-1522](https://insights.sbomify.com/CVE-2018-1522/): Cross-site scripting in Rational Quality Manager (medium 5.4)
- [CVE-2018-1521](https://insights.sbomify.com/CVE-2018-1521/): Cross-site scripting in Rational Team Concert (medium 5.4)
- [CVE-2018-15209](https://insights.sbomify.com/CVE-2018-15209/): Memory corruption in debian:debian linux (high 8.8)
- [CVE-2018-15208](https://insights.sbomify.com/CVE-2018-15208/): Auth bypass in bpcbt:smartvista (high 7.5)
- [CVE-2018-15207](https://insights.sbomify.com/CVE-2018-15207/): Missing authorization in bpcbt:smartvista (high 7.2)
- [CVE-2018-15206](https://insights.sbomify.com/CVE-2018-15206/): Cross-site request forgery in bpcbt:smartvista (high 8.8)
- [CVE-2018-15203](https://insights.sbomify.com/CVE-2018-15203/): Cross-site request forgery in ignitedcms:ignitedcms (medium 6.5)
- [CVE-2018-15202](https://insights.sbomify.com/CVE-2018-15202/): Cross-site request forgery in juunan06:ecommerce (medium 6.3)
- [CVE-2018-15199](https://insights.sbomify.com/CVE-2018-15199/): Cross-site scripting in auracms:auracms (medium 5.4)
- [CVE-2018-15198](https://insights.sbomify.com/CVE-2018-15198/): Cross-site request forgery in onethink:onethink (high 8.8)
- [CVE-2018-15197](https://insights.sbomify.com/CVE-2018-15197/): Cross-site request forgery in onethink:onethink (high 8.8)
- [CVE-2018-15193](https://insights.sbomify.com/CVE-2018-15193/): Cross-site request forgery in gogs:gogs (high 8.8)
- [CVE-2018-15192](https://insights.sbomify.com/CVE-2018-15192/): Gogs and Gitea SSRF Vulnerability (high 8.6)
- [CVE-2018-15191](https://insights.sbomify.com/CVE-2018-15191/): Cross-site scripting in hotel booking script project:hotel booking script (medium 6.5)
- [CVE-2018-15190](https://insights.sbomify.com/CVE-2018-15190/): Cross-site scripting in hotel booking script project:hotel booking script (medium 5.4)
- [CVE-2018-15189](https://insights.sbomify.com/CVE-2018-15189/): Cross-site scripting in advanced real estate script project:advanced real estate script (medium 5.4)
- [CVE-2018-15188](https://insights.sbomify.com/CVE-2018-15188/): Cross-site scripting in advanced real estate script project:advanced real estate script (medium 6.5)
- [CVE-2018-15187](https://insights.sbomify.com/CVE-2018-15187/): Cross-site request forgery in advanced real estate script project:advanced real estate script (high 8.0)
- [CVE-2018-15186](https://insights.sbomify.com/CVE-2018-15186/): Cross-site request forgery in chartered accountant \: auditor website project (high 8.8)
- [CVE-2018-15185](https://insights.sbomify.com/CVE-2018-15185/): Cross-site scripting in naukri clone script project:naukri clone script (medium 6.5)
- [CVE-2018-15184](https://insights.sbomify.com/CVE-2018-15184/): Cross-site scripting in naukri clone script project:naukri clone script (medium 5.4)
- [CVE-2018-15183](https://insights.sbomify.com/CVE-2018-15183/): Cross-site scripting in myperfectresume \/ jobhero \/ resume clone script project:myperfectresume \/ jobhero \/ resume clone script (medium 6.1)
- [CVE-2018-15182](https://insights.sbomify.com/CVE-2018-15182/): Cross-site scripting in car rental script project:car rental script (medium 5.4)
- [CVE-2018-15181](https://insights.sbomify.com/CVE-2018-15181/): Cross-site scripting in jio:4g hotspot m2s firmware (medium 6.5)
- [CVE-2018-15180](https://insights.sbomify.com/CVE-2018-15180/): Open redirect in qasymphony:qtest manager (medium 6.1)
- [CVE-2018-1518](https://insights.sbomify.com/CVE-2018-1518/): Weak cryptography in InfoSphere Information Server (medium 6.2)
- [CVE-2018-15178](https://insights.sbomify.com/CVE-2018-15178/): Open Redirect (medium 6.1)
- [CVE-2018-15177](https://insights.sbomify.com/CVE-2018-15177/): Cross-site request forgery in gxlcms:gxlcms (high 8.8)
- [CVE-2018-15176](https://insights.sbomify.com/CVE-2018-15176/): Memory corruption in xnview:xnview (high 7.8)
- [CVE-2018-15175](https://insights.sbomify.com/CVE-2018-15175/): Memory corruption in xnview:xnview (high 7.8)
- [CVE-2018-15174](https://insights.sbomify.com/CVE-2018-15174/): Memory corruption in xnview:xnview (high 7.8)
- [CVE-2018-15173](https://insights.sbomify.com/CVE-2018-15173/): Denial of service in nmap:nmap (high 7.5)
- [CVE-2018-15172](https://insights.sbomify.com/CVE-2018-15172/): Memory corruption in tp-link:tl-wr840n firmware (high 7.5)
- [CVE-2018-1517](https://insights.sbomify.com/CVE-2018-1517/): Denial of service in SDK, Java Technology Edition (medium 5.9)
- [CVE-2018-15169](https://insights.sbomify.com/CVE-2018-15169/): Cross-site scripting in zohocorp:manageengine applications manager (medium 6.1)
- [CVE-2018-15168](https://insights.sbomify.com/CVE-2018-15168/): SQL injection in zohocorp:manageengine applications manager (critical 9.8)
- [CVE-2018-15161](https://insights.sbomify.com/CVE-2018-15161/): Memory corruption in libesedb project:libesedb (medium 6.5)
- [CVE-2018-15160](https://insights.sbomify.com/CVE-2018-15160/): Memory corruption in libesedb project:libesedb (medium 6.5)
- [CVE-2018-15159](https://insights.sbomify.com/CVE-2018-15159/): Memory corruption in libesedb project:libesedb (medium 6.5)
- [CVE-2018-15158](https://insights.sbomify.com/CVE-2018-15158/): Memory corruption in libesedb project:libesedb (medium 6.5)
- [CVE-2018-15157](https://insights.sbomify.com/CVE-2018-15157/): Memory corruption in libfsclfs project:libfsclfs (medium 6.5)
- [CVE-2018-15156](https://insights.sbomify.com/CVE-2018-15156/): Command injection in open-emr:openemr (high 8.8)
- [CVE-2018-15155](https://insights.sbomify.com/CVE-2018-15155/): Command injection in open-emr:openemr (high 8.8)
- [CVE-2018-15154](https://insights.sbomify.com/CVE-2018-15154/): Command injection in open-emr:openemr (high 8.8)
- [CVE-2018-15153](https://insights.sbomify.com/CVE-2018-15153/): Command injection in open-emr:openemr (high 8.8)
- [CVE-2018-15152](https://insights.sbomify.com/CVE-2018-15152/): Auth bypass in open-emr:openemr (critical 9.1)
- [CVE-2018-15151](https://insights.sbomify.com/CVE-2018-15151/): SQL injection in open-emr:openemr (high 8.8)
- [CVE-2018-15150](https://insights.sbomify.com/CVE-2018-15150/): SQL injection in open-emr:openemr (high 8.8)
- [CVE-2018-1515](https://insights.sbomify.com/CVE-2018-1515/): Memory corruption in DB2 for Linux, UNIX and Windows (high 7.4)
- [CVE-2018-15149](https://insights.sbomify.com/CVE-2018-15149/): SQL injection in open-emr:openemr (high 8.8)
- [CVE-2018-15148](https://insights.sbomify.com/CVE-2018-15148/): SQL injection in open-emr:openemr (high 8.8)
- [CVE-2018-15147](https://insights.sbomify.com/CVE-2018-15147/): SQL injection in open-emr:openemr (high 8.8)
- [CVE-2018-15146](https://insights.sbomify.com/CVE-2018-15146/): SQL injection in open-emr:openemr (high 8.8)
- [CVE-2018-15145](https://insights.sbomify.com/CVE-2018-15145/): SQL injection in open-emr:openemr (critical 9.8)
- [CVE-2018-15144](https://insights.sbomify.com/CVE-2018-15144/): SQL injection in open-emr:openemr (high 8.8)
- [CVE-2018-15143](https://insights.sbomify.com/CVE-2018-15143/): SQL injection in open-emr:openemr (critical 9.8)
- [CVE-2018-15142](https://insights.sbomify.com/CVE-2018-15142/): Path traversal in open-emr:openemr (high 8.8)
- [CVE-2018-15141](https://insights.sbomify.com/CVE-2018-15141/): Path traversal in open-emr:openemr (medium 6.5)
- [CVE-2018-15140](https://insights.sbomify.com/CVE-2018-15140/): Path traversal in open-emr:openemr (medium 6.5)
- [CVE-2018-1514](https://insights.sbomify.com/CVE-2018-1514/): Cross-site request forgery in Robotic Process Automation with Automation Anywhere (medium 4.3)
- [CVE-2018-15139](https://insights.sbomify.com/CVE-2018-15139/): File upload in open-emr:openemr (high 8.8)
- [CVE-2018-15138](https://insights.sbomify.com/CVE-2018-15138/): Path traversal in ericssonlg:ipecs nms (high 7.5)
- [CVE-2018-15137](https://insights.sbomify.com/CVE-2018-15137/): File upload in cela link:clr-m20 firmware (critical 9.8)
- [CVE-2018-15136](https://insights.sbomify.com/CVE-2018-15136/): Security feature bypass in titanhq:spamtitan (medium 5.3)
- [CVE-2018-15133](https://insights.sbomify.com/CVE-2018-15133/): Laravel Deserialization of Untrusted Data (high 8.1, exploited in the wild)
- [CVE-2018-15132](https://insights.sbomify.com/CVE-2018-15132/): Security feature bypass in netapp:storage automation store (high 7.5)
- [CVE-2018-15131](https://insights.sbomify.com/CVE-2018-15131/): Information disclosure in synacor:zimbra collaboration suite (medium 5.3)
- [CVE-2018-15130](https://insights.sbomify.com/CVE-2018-15130/): Cross-site scripting in thinksaas:thinksaas (medium 5.4)
- [CVE-2018-1513](https://insights.sbomify.com/CVE-2018-1513/): Cross-site scripting in Sterling B2B Integrator (medium 5.4)
- [CVE-2018-15129](https://insights.sbomify.com/CVE-2018-15129/): Cross-site scripting in thinksaas:thinksaas (medium 5.4)
- [CVE-2018-15128](https://insights.sbomify.com/CVE-2018-15128/): Memory corruption in polycom:group series (critical 9.8)
- [CVE-2018-15127](https://insights.sbomify.com/CVE-2018-15127/): Memory corruption in LibVNC (critical 9.8)
- [CVE-2018-15126](https://insights.sbomify.com/CVE-2018-15126/): Use after free in LibVNC (critical 9.8)
- [CVE-2018-15125](https://insights.sbomify.com/CVE-2018-15125/): Information disclosure in Zipato Zipabox Smart Home Controller (high 7.5)
- [CVE-2018-15124](https://insights.sbomify.com/CVE-2018-15124/): Weak cryptography in Zipato Zipabox Smart Home Controller (critical 9.8)
- [CVE-2018-15123](https://insights.sbomify.com/CVE-2018-15123/): Misconfiguration in Zipato Zipabox Smart Home Controller (critical 9.8)
- [CVE-2018-15122](https://insights.sbomify.com/CVE-2018-15122/): Code injection in telerik:justassembly (high 7.8)
- [CVE-2018-15121](https://insights.sbomify.com/CVE-2018-15121/): Auth0-ASPNET and Auth0-ASPNET-Owin vulnerable to Cross-Site Request Forgery (high 8.8)
- [CVE-2018-15120](https://insights.sbomify.com/CVE-2018-15120/): Memory corruption in canonical:ubuntu linux (medium 6.5)
- [CVE-2018-1509](https://insights.sbomify.com/CVE-2018-1509/): Security feature bypass in Security Guardium (low 3.7)
- [CVE-2018-1507](https://insights.sbomify.com/CVE-2018-1507/): Cross-site scripting in Rational DOORS Next Generation (medium 5.4)
- [CVE-2018-1505](https://insights.sbomify.com/CVE-2018-1505/): Information disclosure in i2 Enterprise Insight Analysis (medium 4.0)
- [CVE-2018-1504](https://insights.sbomify.com/CVE-2018-1504/): Other in i2 Enterprise Insight Analysis (medium 6.1)
- [CVE-2018-1503](https://insights.sbomify.com/CVE-2018-1503/): Denial of service in WebSphere MQ (medium 4.3)
- [CVE-2018-1502](https://insights.sbomify.com/CVE-2018-1502/): Cross-site scripting in Content Manager (medium 5.4)
- [CVE-2018-1501](https://insights.sbomify.com/CVE-2018-1501/): Missing authorization in Security Guardium (medium 5.3)
- [CVE-2018-15007](https://insights.sbomify.com/CVE-2018-15007/): Command injection in skydevices:sky elite 6.0l\+ firmware (high 7.8)
- [CVE-2018-15006](https://insights.sbomify.com/CVE-2018-15006/): Missing authorization in zteusa:zte zmax champ firmware (medium 5.5)
- [CVE-2018-15005](https://insights.sbomify.com/CVE-2018-15005/): Missing authorization in zteusa:zte zmax champ firmware (high 7.1)
- [CVE-2018-15004](https://insights.sbomify.com/CVE-2018-15004/): Missing authorization in coolpad:canvas firmware (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/107/