# Vulnerabilities published in 2018 - [CVE-2018-15003](https://insights.sbomify.com/CVE-2018-15003/): Missing authorization in coolpad:defiant firmware (high 7.5) - [CVE-2018-15002](https://insights.sbomify.com/CVE-2018-15002/): Missing authorization in vivo:v7 firmware (medium 4.7) - [CVE-2018-15001](https://insights.sbomify.com/CVE-2018-15001/): Information disclosure in vivo:v7 firmware (medium 5.5) - [CVE-2018-15000](https://insights.sbomify.com/CVE-2018-15000/): Information disclosure in vivo:v7 firmware (medium 6.3) - [CVE-2018-14999](https://insights.sbomify.com/CVE-2018-14999/): Missing authorization in leagoo:p1 firmware (critical 9.1) - [CVE-2018-14998](https://insights.sbomify.com/CVE-2018-14998/): Privilege escalation in leagoo:p1 firmware (medium 6.8) - [CVE-2018-14997](https://insights.sbomify.com/CVE-2018-14997/): Missing authorization in leagoo:p1 firmware (medium 5.5) - [CVE-2018-14996](https://insights.sbomify.com/CVE-2018-14996/): Command injection in oppo:f5 firmware (high 7.8) - [CVE-2018-14995](https://insights.sbomify.com/CVE-2018-14995/): Missing authorization in zteusa:zte blade spark firmware (medium 4.7) - [CVE-2018-14994](https://insights.sbomify.com/CVE-2018-14994/): Missing authorization in essential:phone firmware (high 7.5) - [CVE-2018-14993](https://insights.sbomify.com/CVE-2018-14993/): Command injection in asus:zenfone 3 max firmware (high 7.8) - [CVE-2018-14992](https://insights.sbomify.com/CVE-2018-14992/): Missing authorization in asus:zenfone 3 max firmware (medium 5.5) - [CVE-2018-14991](https://insights.sbomify.com/CVE-2018-14991/): Missing authorization in coolpad:defiant firmware (critical 9.8) - [CVE-2018-14990](https://insights.sbomify.com/CVE-2018-14990/): Missing authorization in coolpad:defiant firmware (high 7.5) - [CVE-2018-14989](https://insights.sbomify.com/CVE-2018-14989/): Missing authorization in plum-mobile:compass firmware (high 7.5) - [CVE-2018-14988](https://insights.sbomify.com/CVE-2018-14988/): Missing authorization in mxq project:mxq tv box firmware (high 7.5) - [CVE-2018-14987](https://insights.sbomify.com/CVE-2018-14987/): Missing authorization in mxq project:mxq tv box firmware (high 7.1) - [CVE-2018-14986](https://insights.sbomify.com/CVE-2018-14986/): Information disclosure in leagoo:z5c firmware (high 7.5) - [CVE-2018-14985](https://insights.sbomify.com/CVE-2018-14985/): Missing authorization in leagoo:z5c firmware (high 7.1) - [CVE-2018-14984](https://insights.sbomify.com/CVE-2018-14984/): Missing authorization in leagoo:z5c firmware (high 7.5) - [CVE-2018-14983](https://insights.sbomify.com/CVE-2018-14983/): Missing authorization in sony:xperia l1 firmware (medium 5.5) - [CVE-2018-14982](https://insights.sbomify.com/CVE-2018-14982/): Missing authorization in google:android (critical 9.8) - [CVE-2018-14981](https://insights.sbomify.com/CVE-2018-14981/): Missing authorization in google:android (critical 9.8) - [CVE-2018-14980](https://insights.sbomify.com/CVE-2018-14980/): Missing authorization in asus:zenfone 3 max firmware (high 7.1) - [CVE-2018-1498](https://insights.sbomify.com/CVE-2018-1498/): Information disclosure in Security Guardium (medium 6.2) - [CVE-2018-14979](https://insights.sbomify.com/CVE-2018-14979/): Information disclosure in asus:zenfone 3 max firmware (medium 4.7) - [CVE-2018-14978](https://insights.sbomify.com/CVE-2018-14978/): Cross-site request forgery in q-cms:qcms (high 8.8) - [CVE-2018-14977](https://insights.sbomify.com/CVE-2018-14977/): Cross-site scripting in q-cms:qcms (medium 6.1) - [CVE-2018-14976](https://insights.sbomify.com/CVE-2018-14976/): Cross-site scripting in q-cms:qcms (medium 4.8) - [CVE-2018-14975](https://insights.sbomify.com/CVE-2018-14975/): Cross-site scripting in q-cms:qcms (medium 4.8) - [CVE-2018-14974](https://insights.sbomify.com/CVE-2018-14974/): Cross-site scripting in q-cms:qcms (medium 4.8) - [CVE-2018-14973](https://insights.sbomify.com/CVE-2018-14973/): Cross-site scripting in q-cms:qcms (medium 4.8) - [CVE-2018-14972](https://insights.sbomify.com/CVE-2018-14972/): Cross-site scripting in q-cms:qcms (medium 4.8) - [CVE-2018-14971](https://insights.sbomify.com/CVE-2018-14971/): Cross-site scripting in q-cms:qcms (medium 4.8) - [CVE-2018-14970](https://insights.sbomify.com/CVE-2018-14970/): Cross-site scripting in q-cms:qcms (medium 4.8) - [CVE-2018-14969](https://insights.sbomify.com/CVE-2018-14969/): Cross-site scripting in q-cms:qcms (medium 4.8) - [CVE-2018-14968](https://insights.sbomify.com/CVE-2018-14968/): SQL injection in emlsoft project:emlsoft (critical 9.8) - [CVE-2018-14967](https://insights.sbomify.com/CVE-2018-14967/): SQL injection in emlsoft project:emlsoft (high 8.8) - [CVE-2018-14966](https://insights.sbomify.com/CVE-2018-14966/): Cross-site request forgery in emlsoft project:emlsoft (high 8.8) - [CVE-2018-14965](https://insights.sbomify.com/CVE-2018-14965/): Cross-site request forgery in emlsoft project:emlsoft (high 8.8) - [CVE-2018-14964](https://insights.sbomify.com/CVE-2018-14964/): Cross-site scripting in emlsoft project:emlsoft (medium 5.4) - [CVE-2018-14963](https://insights.sbomify.com/CVE-2018-14963/): Cross-site request forgery in zzcms:zzcms (high 8.8) - [CVE-2018-14962](https://insights.sbomify.com/CVE-2018-14962/): Cross-site scripting in zzcms:zzcms (medium 5.4) - [CVE-2018-14961](https://insights.sbomify.com/CVE-2018-14961/): SQL injection in zzcms:zzcms (critical 9.8) - [CVE-2018-14960](https://insights.sbomify.com/CVE-2018-14960/): Cross-site request forgery in xiao5ucompany project:xiao5ucompany (high 8.8) - [CVE-2018-1496](https://insights.sbomify.com/CVE-2018-1496/): Cross-site scripting in Content Navigator (medium 5.4) - [CVE-2018-14959](https://insights.sbomify.com/CVE-2018-14959/): Cross-site request forgery in weaselcms project:weaselcms (high 8.8) - [CVE-2018-14958](https://insights.sbomify.com/CVE-2018-14958/): Cross-site request forgery in weaselcms project:weaselcms (high 8.8) - [CVE-2018-14957](https://insights.sbomify.com/CVE-2018-14957/): Path traversal in isweb:isweb (critical 9.8) - [CVE-2018-14956](https://insights.sbomify.com/CVE-2018-14956/): SQL injection in isweb:isweb (critical 9.8) - [CVE-2018-14955](https://insights.sbomify.com/CVE-2018-14955/): Cross-site scripting in squirrelmail:squirrelmail (medium 6.1) - [CVE-2018-14954](https://insights.sbomify.com/CVE-2018-14954/): Cross-site scripting in squirrelmail:squirrelmail (medium 6.1) - [CVE-2018-14953](https://insights.sbomify.com/CVE-2018-14953/): Cross-site scripting in squirrelmail:squirrelmail (medium 6.1) - [CVE-2018-14952](https://insights.sbomify.com/CVE-2018-14952/): Cross-site scripting in squirrelmail:squirrelmail (medium 6.1) - [CVE-2018-14951](https://insights.sbomify.com/CVE-2018-14951/): Cross-site scripting in squirrelmail:squirrelmail (medium 6.1) - [CVE-2018-14950](https://insights.sbomify.com/CVE-2018-14950/): Cross-site scripting in squirrelmail:squirrelmail (medium 6.1) - [CVE-2018-1495](https://insights.sbomify.com/CVE-2018-1495/): Privilege escalation in FlashSystem V840 (medium 6.5) - [CVE-2018-14948](https://insights.sbomify.com/CVE-2018-14948/): Memory corruption in sound project:sound (high 7.8) - [CVE-2018-14947](https://insights.sbomify.com/CVE-2018-14947/): Memory corruption in flowpaper:pdf2json (high 8.8) - [CVE-2018-14946](https://insights.sbomify.com/CVE-2018-14946/): Memory corruption in flowpaper:pdf2json (high 8.8) - [CVE-2018-14945](https://insights.sbomify.com/CVE-2018-14945/): Memory corruption in jpeg encoder project:jpeg encoder (high 7.8) - [CVE-2018-14944](https://insights.sbomify.com/CVE-2018-14944/): Memory corruption in jpeg encoder project:jpeg encoder (high 7.8) - [CVE-2018-14943](https://insights.sbomify.com/CVE-2018-14943/): Hardcoded credentials in harmonicinc:nsg 9000 firmware (critical 9.8) - [CVE-2018-14942](https://insights.sbomify.com/CVE-2018-14942/): Path traversal in harmonicinc:nsg 9000 firmware (high 8.8) - [CVE-2018-14941](https://insights.sbomify.com/CVE-2018-14941/): Information disclosure in harmonicinc:nsg 9000 (medium 6.5) - [CVE-2018-14940](https://insights.sbomify.com/CVE-2018-14940/): Denial of service in phpcms:phpcms (high 7.5) - [CVE-2018-1494](https://insights.sbomify.com/CVE-2018-1494/): Cross-site scripting in Rational DOORS Next Generation (medium 5.4) - [CVE-2018-14939](https://insights.sbomify.com/CVE-2018-14939/): Memory corruption in libreoffice:libreoffice (critical 9.8) - [CVE-2018-14938](https://insights.sbomify.com/CVE-2018-14938/): Integer overflow in canonical:ubuntu linux (critical 9.1) - [CVE-2018-14937](https://insights.sbomify.com/CVE-2018-14937/): Cross-site scripting in mylittleforum:my little forum (medium 4.8) - [CVE-2018-14936](https://insights.sbomify.com/CVE-2018-14936/): Cross-site scripting in mylittleforum:my little forum (medium 4.8) - [CVE-2018-14935](https://insights.sbomify.com/CVE-2018-14935/): Cross-site scripting in polycom:trio 8500 firmware (medium 6.1) - [CVE-2018-14934](https://insights.sbomify.com/CVE-2018-14934/): Missing authorization in polycom:trio 8500 firmware (medium 6.5) - [CVE-2018-14933](https://insights.sbomify.com/CVE-2018-14933/): NUUO NVRmini Devices OS Command Injection Vulnerability (critical 9.8, exploited in the wild) - [CVE-2018-14931](https://insights.sbomify.com/CVE-2018-14931/): Open redirect in polarisft:intellect core banking (medium 6.1) - [CVE-2018-14930](https://insights.sbomify.com/CVE-2018-14930/): Cross-site request forgery in polarisft:intellect core banking (high 8.8) - [CVE-2018-14929](https://insights.sbomify.com/CVE-2018-14929/): Cross-site scripting in matera:banco (medium 6.1) - [CVE-2018-14928](https://insights.sbomify.com/CVE-2018-14928/): Missing authorization in matera:banco (high 7.5) - [CVE-2018-14927](https://insights.sbomify.com/CVE-2018-14927/): Path traversal in matera:banco (medium 5.3) - [CVE-2018-14926](https://insights.sbomify.com/CVE-2018-14926/): Cross-site request forgery in matera:banco (high 8.8) - [CVE-2018-14925](https://insights.sbomify.com/CVE-2018-14925/): Information disclosure in matera:banco (critical 9.8) - [CVE-2018-14924](https://insights.sbomify.com/CVE-2018-14924/): Cross-site scripting in matera:banco (medium 6.1) - [CVE-2018-14923](https://insights.sbomify.com/CVE-2018-14923/): Other in uniview:ezplayer (high 7.8) - [CVE-2018-14922](https://insights.sbomify.com/CVE-2018-14922/): Cross-site scripting in monstra:monstra (medium 6.1) - [CVE-2018-1492](https://insights.sbomify.com/CVE-2018-1492/): Auth bypass in Rational Collaborative Lifecycle Management (medium 4.3) - [CVE-2018-14919](https://insights.sbomify.com/CVE-2018-14919/): Cross-site scripting in loytec:lgate-902 firmware (medium 6.1) - [CVE-2018-14918](https://insights.sbomify.com/CVE-2018-14918/): Path traversal in loytec:lgate-902 firmware (high 7.5) - [CVE-2018-14916](https://insights.sbomify.com/CVE-2018-14916/): Path traversal in loytec:lgate-902 firmware (critical 9.1) - [CVE-2018-14912](https://insights.sbomify.com/CVE-2018-14912/): Path traversal in cgit project:cgit (high 7.5) - [CVE-2018-14911](https://insights.sbomify.com/CVE-2018-14911/): File upload in ukcms:ukcms (high 7.2) - [CVE-2018-14910](https://insights.sbomify.com/CVE-2018-14910/): Code injection in seacms:seacms (high 8.8) - [CVE-2018-14908](https://insights.sbomify.com/CVE-2018-14908/): Cross-site request forgery in samsung:syncthru web service (high 8.8) - [CVE-2018-14907](https://insights.sbomify.com/CVE-2018-14907/): Information disclosure in 3cx:3cx web server (medium 5.3) - [CVE-2018-14906](https://insights.sbomify.com/CVE-2018-14906/): Cross-site scripting in 3cx:3cx web server (medium 6.1) - [CVE-2018-14905](https://insights.sbomify.com/CVE-2018-14905/): Cross-site scripting in 3cx:3cx web server (medium 6.1) - [CVE-2018-14904](https://insights.sbomify.com/CVE-2018-14904/): Cross-site scripting in samsung:syncthru web service (medium 6.1) - [CVE-2018-14903](https://insights.sbomify.com/CVE-2018-14903/): Security feature bypass in epson:wf-2750 firmware (high 7.5) - [CVE-2018-14902](https://insights.sbomify.com/CVE-2018-14902/): Information disclosure in epson:iprint (high 7.5) - [CVE-2018-14901](https://insights.sbomify.com/CVE-2018-14901/): Hardcoded credentials in epson:iprint (high 7.5) - [CVE-2018-14900](https://insights.sbomify.com/CVE-2018-14900/): Missing authorization in epson:wf-2750 firmware (high 7.5) --- From sbomify Insights: https://insights.sbomify.com/years/2018/page/108/