# Vulnerabilities published in 2018


- [CVE-2018-14899](https://insights.sbomify.com/CVE-2018-14899/): Cross-site scripting in epson:wf-2750 firmware (medium 6.1)
- [CVE-2018-14894](https://insights.sbomify.com/CVE-2018-14894/): Privilege escalation in cyberark:endpoint privilege manager (high 7.8)
- [CVE-2018-14893](https://insights.sbomify.com/CVE-2018-14893/): Command injection in zyxel:nsa325 v2 firmware (high 8.8)
- [CVE-2018-14892](https://insights.sbomify.com/CVE-2018-14892/): Cross-site request forgery in zyxel:nsa325 v2 firmware (high 8.8)
- [CVE-2018-14891](https://insights.sbomify.com/CVE-2018-14891/): Privilege escalation in vectra:cognito (high 7.8)
- [CVE-2018-14890](https://insights.sbomify.com/CVE-2018-14890/): Cross-site scripting in vectra:cognito (medium 5.4)
- [CVE-2018-14889](https://insights.sbomify.com/CVE-2018-14889/): Code injection in apache:couchdb (high 7.8)
- [CVE-2018-14888](https://insights.sbomify.com/CVE-2018-14888/): Cross-site scripting in thank you\/like project:thank you\/like (medium 6.1)
- [CVE-2018-14887](https://insights.sbomify.com/CVE-2018-14887/): Other in odoo:odoo (medium 6.5)
- [CVE-2018-14886](https://insights.sbomify.com/CVE-2018-14886/): Path traversal in odoo:odoo (medium 4.9)
- [CVE-2018-14885](https://insights.sbomify.com/CVE-2018-14885/): Auth bypass in odoo:odoo (critical 9.8)
- [CVE-2018-14884](https://insights.sbomify.com/CVE-2018-14884/): Null dereference in netapp:storage automation store (high 7.5)
- [CVE-2018-14883](https://insights.sbomify.com/CVE-2018-14883/): Integer overflow in canonical:ubuntu linux (high 7.5)
- [CVE-2018-14882](https://insights.sbomify.com/CVE-2018-14882/): Memory corruption in apple:mac os x (critical 9.8)
- [CVE-2018-14881](https://insights.sbomify.com/CVE-2018-14881/): Memory corruption in apple:mac os x (critical 9.8)
- [CVE-2018-14880](https://insights.sbomify.com/CVE-2018-14880/): Memory corruption in apple:mac os x (high 7.5)
- [CVE-2018-1488](https://insights.sbomify.com/CVE-2018-1488/): Memory corruption in DB2 for Linux, UNIX and Windows (high 8.4)
- [CVE-2018-14879](https://insights.sbomify.com/CVE-2018-14879/): Memory corruption in apple:mac os x (high 7.0)
- [CVE-2018-14878](https://insights.sbomify.com/CVE-2018-14878/): Deserialization in jetbrains:dotpeek (high 7.8)
- [CVE-2018-14877](https://insights.sbomify.com/CVE-2018-14877/): Cross-site scripting in weaselcms project:weaselcms (medium 5.4)
- [CVE-2018-14876](https://insights.sbomify.com/CVE-2018-14876/): Memory corruption in flif:flif (medium 5.5)
- [CVE-2018-14875](https://insights.sbomify.com/CVE-2018-14875/): Cross-site scripting in polarisft:intellect core banking (medium 5.4)
- [CVE-2018-14874](https://insights.sbomify.com/CVE-2018-14874/): SQL injection in polarisft:intellect core banking (high 8.8)
- [CVE-2018-14873](https://insights.sbomify.com/CVE-2018-14873/): Cross-site scripting in rincewind project:rincewind (medium 5.4)
- [CVE-2018-14872](https://insights.sbomify.com/CVE-2018-14872/): Missing authorization in rincewind project:rincewind (high 7.5)
- [CVE-2018-1487](https://insights.sbomify.com/CVE-2018-1487/): Privilege escalation in DB2 for Linux, UNIX and Windows (high 8.4)
- [CVE-2018-14869](https://insights.sbomify.com/CVE-2018-14869/): Cross-site scripting in php template store script project:php template store script (medium 5.4)
- [CVE-2018-14868](https://insights.sbomify.com/CVE-2018-14868/): Missing authorization in odoo:odoo (medium 6.5)
- [CVE-2018-14867](https://insights.sbomify.com/CVE-2018-14867/): Missing authorization in odoo:odoo (medium 5.3)
- [CVE-2018-14866](https://insights.sbomify.com/CVE-2018-14866/): Missing authorization in odoo:odoo (medium 4.3)
- [CVE-2018-14865](https://insights.sbomify.com/CVE-2018-14865/): Information disclosure in odoo:odoo (medium 6.5)
- [CVE-2018-14864](https://insights.sbomify.com/CVE-2018-14864/): Cross-site scripting in odoo:odoo (medium 6.5)
- [CVE-2018-14863](https://insights.sbomify.com/CVE-2018-14863/): Missing authorization in odoo:odoo (high 8.1)
- [CVE-2018-14862](https://insights.sbomify.com/CVE-2018-14862/): Missing authorization in odoo:odoo (medium 6.5)
- [CVE-2018-14861](https://insights.sbomify.com/CVE-2018-14861/): Missing authorization in odoo:odoo (medium 6.5)
- [CVE-2018-14860](https://insights.sbomify.com/CVE-2018-14860/): Code injection in odoo:odoo (critical 9.1)
- [CVE-2018-14859](https://insights.sbomify.com/CVE-2018-14859/): Missing authorization in odoo:odoo (high 8.1)
- [CVE-2018-14858](https://insights.sbomify.com/CVE-2018-14858/): Server-side request forgery in icmsdev:icms (high 7.5)
- [CVE-2018-14857](https://insights.sbomify.com/CVE-2018-14857/): File upload in ocsinventory-ng:ocs inventory server (high 8.8)
- [CVE-2018-14856](https://insights.sbomify.com/CVE-2018-14856/): Memory corruption in samsung:galaxy s6 firmware (medium 6.3)
- [CVE-2018-14855](https://insights.sbomify.com/CVE-2018-14855/): Memory corruption in samsung:galaxy s6 firmware (medium 6.3)
- [CVE-2018-14854](https://insights.sbomify.com/CVE-2018-14854/): Memory corruption in samsung:galaxy s6 firmware (medium 6.3)
- [CVE-2018-14853](https://insights.sbomify.com/CVE-2018-14853/): Null dereference in samsung:galaxy s6 firmware (medium 4.3)
- [CVE-2018-14852](https://insights.sbomify.com/CVE-2018-14852/): Memory corruption in samsung:galaxy s6 firmware (medium 6.3)
- [CVE-2018-14851](https://insights.sbomify.com/CVE-2018-14851/): Memory corruption in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-14850](https://insights.sbomify.com/CVE-2018-14850/): Cross-site scripting in tiki:tikiwiki cms\/groupware (medium 5.4)
- [CVE-2018-1485](https://insights.sbomify.com/CVE-2018-1485/): Auth bypass in BigFix Platform (low 3.1)
- [CVE-2018-14849](https://insights.sbomify.com/CVE-2018-14849/): Cross-site scripting in tiki:tikiwiki cms\/groupware (medium 5.4)
- [CVE-2018-14847](https://insights.sbomify.com/CVE-2018-14847/): MikroTik Router OS Directory Traversal (critical 9.1, exploited in the wild)
- [CVE-2018-14846](https://insights.sbomify.com/CVE-2018-14846/): Cross-site scripting in mondula:multi step form (medium 5.4)
- [CVE-2018-14840](https://insights.sbomify.com/CVE-2018-14840/): Subrion CMS Cross-site Scripting (medium 6.1)
- [CVE-2018-1484](https://insights.sbomify.com/CVE-2018-1484/): Information disclosure in BigFix Platform (low 3.7)
- [CVE-2018-14839](https://insights.sbomify.com/CVE-2018-14839/): LG N1A1 NAS Remote Command Execution (critical 9.8, exploited in the wild)
- [CVE-2018-14838](https://insights.sbomify.com/CVE-2018-14838/): Cross-site scripting in rejucms project:rejucms (medium 6.1)
- [CVE-2018-14837](https://insights.sbomify.com/CVE-2018-14837/): Cross-site scripting in wolfcms:wolf cms (medium 4.8)
- [CVE-2018-14836](https://insights.sbomify.com/CVE-2018-14836/): Privilege escalation in subrion:subrion cms (medium 6.5)
- [CVE-2018-14835](https://insights.sbomify.com/CVE-2018-14835/): Subrion CMS XSS (medium 5.4)
- [CVE-2018-14833](https://insights.sbomify.com/CVE-2018-14833/): Missing authorization in intuit:lacerte (medium 5.9)
- [CVE-2018-14831](https://insights.sbomify.com/CVE-2018-14831/): Path traversal in damicms:damicms (medium 4.9)
- [CVE-2018-1483](https://insights.sbomify.com/CVE-2018-1483/): Cross-site scripting in WebSphere Portal (medium 6.1)
- [CVE-2018-14829](https://insights.sbomify.com/CVE-2018-14829/): Memory corruption in RSLinx Classic (critical 9.8)
- [CVE-2018-14828](https://insights.sbomify.com/CVE-2018-14828/): Privilege escalation in Advantech WebAccess (high 7.8)
- [CVE-2018-14827](https://insights.sbomify.com/CVE-2018-14827/): Denial of service in RSLinx Classic (high 7.5)
- [CVE-2018-14826](https://insights.sbomify.com/CVE-2018-14826/): Auth bypass in EMG12 (critical 9.8)
- [CVE-2018-14825](https://insights.sbomify.com/CVE-2018-14825/): Privilege escalation in Mobile Computers (medium 5.8)
- [CVE-2018-14824](https://insights.sbomify.com/CVE-2018-14824/): Memory corruption in Delta Industrial Automation PMSoft (medium 6.5)
- [CVE-2018-14823](https://insights.sbomify.com/CVE-2018-14823/): Memory corruption in V-Server (critical 9.8)
- [CVE-2018-14822](https://insights.sbomify.com/CVE-2018-14822/): Information disclosure in EMG12 (critical 9.8)
- [CVE-2018-14821](https://insights.sbomify.com/CVE-2018-14821/): Memory corruption in RSLinx Classic (high 7.5)
- [CVE-2018-14820](https://insights.sbomify.com/CVE-2018-14820/): Path traversal in Advantech WebAccess (high 7.5)
- [CVE-2018-14819](https://insights.sbomify.com/CVE-2018-14819/): Memory corruption in V-Server (critical 9.8)
- [CVE-2018-14818](https://insights.sbomify.com/CVE-2018-14818/): Memory corruption in PI Studio (critical 9.8)
- [CVE-2018-14817](https://insights.sbomify.com/CVE-2018-14817/): Integer overflow in V-Server (critical 9.8)
- [CVE-2018-14816](https://insights.sbomify.com/CVE-2018-14816/): Memory corruption in Advantech WebAccess (critical 9.8)
- [CVE-2018-14815](https://insights.sbomify.com/CVE-2018-14815/): Memory corruption in fujielectric:v-server firmware (critical 9.8)
- [CVE-2018-14814](https://insights.sbomify.com/CVE-2018-14814/): Memory corruption in WECON Technology PI Studio HMI (medium 6.5)
- [CVE-2018-14813](https://insights.sbomify.com/CVE-2018-14813/): Memory corruption in V-Server (critical 9.8)
- [CVE-2018-14812](https://insights.sbomify.com/CVE-2018-14812/): Other in Energy Savings Estimator (high 7.8)
- [CVE-2018-14811](https://insights.sbomify.com/CVE-2018-14811/): Memory corruption in V-Server (critical 9.8)
- [CVE-2018-14810](https://insights.sbomify.com/CVE-2018-14810/): Memory corruption in PI Studio (high 8.8)
- [CVE-2018-1481](https://insights.sbomify.com/CVE-2018-1481/): Information disclosure in BigFix Platform (low 3.7)
- [CVE-2018-14809](https://insights.sbomify.com/CVE-2018-14809/): Use after free in V-Server (critical 9.8)
- [CVE-2018-14808](https://insights.sbomify.com/CVE-2018-14808/): Privilege escalation in AMS Device Manager (medium 6.5)
- [CVE-2018-14807](https://insights.sbomify.com/CVE-2018-14807/): Memory corruption in PAC Control Basic and PAC Control Professional (critical 9.8)
- [CVE-2018-14806](https://insights.sbomify.com/CVE-2018-14806/): Path traversal in Advantech WebAccess (critical 9.8)
- [CVE-2018-14805](https://insights.sbomify.com/CVE-2018-14805/): Auth bypass in ABB eSOMS (critical 9.8)
- [CVE-2018-14804](https://insights.sbomify.com/CVE-2018-14804/): Code injection in AMS Device Manager (critical 9.8)
- [CVE-2018-14803](https://insights.sbomify.com/CVE-2018-14803/): Information disclosure in e-Alert Unit (non-medical device) (medium 5.3)
- [CVE-2018-14802](https://insights.sbomify.com/CVE-2018-14802/): Memory corruption in FRENIC LOADER of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace (critical 9.8)
- [CVE-2018-14801](https://insights.sbomify.com/CVE-2018-14801/): Hardcoded credentials in PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs (medium 6.2)
- [CVE-2018-14800](https://insights.sbomify.com/CVE-2018-14800/): Memory corruption in ISPSoft (high 7.8)
- [CVE-2018-1480](https://insights.sbomify.com/CVE-2018-1480/): Misconfiguration in BigFix Platform (medium 4.0)
- [CVE-2018-14799](https://insights.sbomify.com/CVE-2018-14799/): Memory corruption in PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs (low 3.7)
- [CVE-2018-14798](https://insights.sbomify.com/CVE-2018-14798/): Memory corruption in FRENIC LOADER of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace (medium 5.3)
- [CVE-2018-14797](https://insights.sbomify.com/CVE-2018-14797/): Other in DeltaV DCS (high 7.8)
- [CVE-2018-14796](https://insights.sbomify.com/CVE-2018-14796/): Missing authorization in SmartCooler (high 7.5)
- [CVE-2018-14795](https://insights.sbomify.com/CVE-2018-14795/): Path traversal in DeltaV (high 8.8)
- [CVE-2018-14794](https://insights.sbomify.com/CVE-2018-14794/): Memory corruption in Alpha5 Smart Loader (critical 9.8)
- [CVE-2018-14793](https://insights.sbomify.com/CVE-2018-14793/): Memory corruption in DeltaV (high 8.8)
- [CVE-2018-14792](https://insights.sbomify.com/CVE-2018-14792/): Memory corruption in PLC Editor (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/109/