# Vulnerabilities published in 2018


- [CVE-2018-1392](https://insights.sbomify.com/CVE-2018-1392/): Information disclosure in Financial Transaction Manager (low 3.1)
- [CVE-2018-13919](https://insights.sbomify.com/CVE-2018-13919/): Use after free in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables (high 7.8)
- [CVE-2018-13918](https://insights.sbomify.com/CVE-2018-13918/): Memory corruption in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, (high 7.8)
- [CVE-2018-13916](https://insights.sbomify.com/CVE-2018-13916/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (high 7.8)
- [CVE-2018-13914](https://insights.sbomify.com/CVE-2018-13914/): Memory corruption in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables (high 7.8)
- [CVE-2018-13913](https://insights.sbomify.com/CVE-2018-13913/): Memory corruption in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (high 7.8)
- [CVE-2018-13912](https://insights.sbomify.com/CVE-2018-13912/): Memory corruption in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (medium 5.5)
- [CVE-2018-13911](https://insights.sbomify.com/CVE-2018-13911/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (critical 9.8)
- [CVE-2018-13910](https://insights.sbomify.com/CVE-2018-13910/): Memory corruption in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking (high 7.8)
- [CVE-2018-1391](https://insights.sbomify.com/CVE-2018-1391/): Denial of service in Financial Transaction Manager (medium 6.5)
- [CVE-2018-13909](https://insights.sbomify.com/CVE-2018-13909/): Race condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music (high 7.0)
- [CVE-2018-13908](https://insights.sbomify.com/CVE-2018-13908/): Weak cryptography in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (high 7.8)
- [CVE-2018-13907](https://insights.sbomify.com/CVE-2018-13907/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (medium 5.3)
- [CVE-2018-13906](https://insights.sbomify.com/CVE-2018-13906/): Weak cryptography in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (critical 9.1)
- [CVE-2018-13905](https://insights.sbomify.com/CVE-2018-13905/): Use after free in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables (high 7.8)
- [CVE-2018-13904](https://insights.sbomify.com/CVE-2018-13904/): Other in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile (critical 9.8)
- [CVE-2018-13903](https://insights.sbomify.com/CVE-2018-13903/): Race condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables (high 8.1)
- [CVE-2018-13902](https://insights.sbomify.com/CVE-2018-13902/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (high 7.5)
- [CVE-2018-13901](https://insights.sbomify.com/CVE-2018-13901/): Missing authorization in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (medium 5.5)
- [CVE-2018-13900](https://insights.sbomify.com/CVE-2018-13900/): Use after free in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (high 7.8)
- [CVE-2018-1390](https://insights.sbomify.com/CVE-2018-1390/): Cross-site scripting in Financial Transaction Manager (medium 5.4)
- [CVE-2018-13899](https://insights.sbomify.com/CVE-2018-13899/): Use after free in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables (high 7.8)
- [CVE-2018-13898](https://insights.sbomify.com/CVE-2018-13898/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music (critical 9.8)
- [CVE-2018-13897](https://insights.sbomify.com/CVE-2018-13897/): Information disclosure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables (high 7.5)
- [CVE-2018-13896](https://insights.sbomify.com/CVE-2018-13896/): Security feature bypass in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking (high 7.8)
- [CVE-2018-13895](https://insights.sbomify.com/CVE-2018-13895/): Missing authorization in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables (high 7.8)
- [CVE-2018-13893](https://insights.sbomify.com/CVE-2018-13893/): Memory corruption in Android for MSM, Firefox OS for MSM, QRD Android (high 7.8)
- [CVE-2018-1389](https://insights.sbomify.com/CVE-2018-1389/): Missing authorization in API Connect (medium 6.5)
- [CVE-2018-13889](https://insights.sbomify.com/CVE-2018-13889/): Use after free in Android for MSM, Firefox OS for MSM, QRD Android (high 7.8)
- [CVE-2018-13888](https://insights.sbomify.com/CVE-2018-13888/): Memory corruption in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables (high 7.8)
- [CVE-2018-13887](https://insights.sbomify.com/CVE-2018-13887/): Integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables (critical 9.8)
- [CVE-2018-13886](https://insights.sbomify.com/CVE-2018-13886/): Integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (critical 9.8)
- [CVE-2018-13885](https://insights.sbomify.com/CVE-2018-13885/): Information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables (medium 5.5)
- [CVE-2018-1388](https://insights.sbomify.com/CVE-2018-1388/): Weak cryptography in WebSphere MQ (high 7.5)
- [CVE-2018-13879](https://insights.sbomify.com/CVE-2018-13879/): Cross-site scripting in rocket.chat:rocket.chat (medium 5.4)
- [CVE-2018-13878](https://insights.sbomify.com/CVE-2018-13878/): Cross-site scripting in rocket.chat:rocket.chat (medium 6.1)
- [CVE-2018-13877](https://insights.sbomify.com/CVE-2018-13877/): Denial of service in megacryptopolis:megacryptopolis (high 7.5)
- [CVE-2018-13876](https://insights.sbomify.com/CVE-2018-13876/): Memory corruption in hdfgroup:hdf5 (critical 9.8)
- [CVE-2018-13875](https://insights.sbomify.com/CVE-2018-13875/): Memory corruption in hdfgroup:hdf5 (high 7.8)
- [CVE-2018-13874](https://insights.sbomify.com/CVE-2018-13874/): Memory corruption in hdfgroup:hdf5 (critical 9.8)
- [CVE-2018-13873](https://insights.sbomify.com/CVE-2018-13873/): Memory corruption in hdfgroup:hdf5 (critical 9.8)
- [CVE-2018-13872](https://insights.sbomify.com/CVE-2018-13872/): Memory corruption in hdfgroup:hdf5 (critical 9.8)
- [CVE-2018-13871](https://insights.sbomify.com/CVE-2018-13871/): Memory corruption in hdfgroup:hdf5 (critical 9.8)
- [CVE-2018-13870](https://insights.sbomify.com/CVE-2018-13870/): Memory corruption in hdfgroup:hdf5 (critical 9.8)
- [CVE-2018-1387](https://insights.sbomify.com/CVE-2018-1387/): Information disclosure in Monitoring (medium 5.3)
- [CVE-2018-13869](https://insights.sbomify.com/CVE-2018-13869/): Memory corruption in hdfgroup:hdf5 (critical 9.8)
- [CVE-2018-13868](https://insights.sbomify.com/CVE-2018-13868/): Memory corruption in hdfgroup:hdf5 (critical 9.8)
- [CVE-2018-13867](https://insights.sbomify.com/CVE-2018-13867/): Memory corruption in hdfgroup:hdf5 (critical 9.8)
- [CVE-2018-13866](https://insights.sbomify.com/CVE-2018-13866/): Memory corruption in hdfgroup:hdf5 (critical 9.8)
- [CVE-2018-13865](https://insights.sbomify.com/CVE-2018-13865/): Cross-site scripting in idreamsoft:icms (medium 6.1)
- [CVE-2018-13864](https://insights.sbomify.com/CVE-2018-13864/): Play Framework's Assets controller vulnerable to directory traversal (high 7.5)
- [CVE-2018-13863](https://insights.sbomify.com/CVE-2018-13863/): js-bson vulnerable to REDoS (high 7.5)
- [CVE-2018-13862](https://insights.sbomify.com/CVE-2018-13862/): Auth bypass in trivum:webtouch setup v9 firmware (critical 9.8)
- [CVE-2018-13861](https://insights.sbomify.com/CVE-2018-13861/): Missing authorization in trivum:webtouch setup v9 firmware (critical 9.8)
- [CVE-2018-13860](https://insights.sbomify.com/CVE-2018-13860/): Information disclosure in trivum:c4 professional firmware (high 7.5)
- [CVE-2018-1386](https://insights.sbomify.com/CVE-2018-1386/): Misconfiguration in Workload Scheduler (high 7.4)
- [CVE-2018-13859](https://insights.sbomify.com/CVE-2018-13859/): Auth bypass in trivum:c4 professional firmware (critical 9.8)
- [CVE-2018-13858](https://insights.sbomify.com/CVE-2018-13858/): Missing authorization in trivum:c4 professional firmware (critical 9.8)
- [CVE-2018-13850](https://insights.sbomify.com/CVE-2018-13850/): SQL injection in icanstudioz:firebase push notification on ios \/ fcm \+ advance admin panel (critical 9.8)
- [CVE-2018-13849](https://insights.sbomify.com/CVE-2018-13849/): Cross-site scripting in instagram-clone project:instagram-clone (medium 6.1)
- [CVE-2018-13848](https://insights.sbomify.com/CVE-2018-13848/): Memory corruption in axiosys:bento4 (high 7.5)
- [CVE-2018-13847](https://insights.sbomify.com/CVE-2018-13847/): Memory corruption in axiosys:bento4 (high 7.5)
- [CVE-2018-13846](https://insights.sbomify.com/CVE-2018-13846/): Memory corruption in axiosys:bento4 (critical 9.8)
- [CVE-2018-13845](https://insights.sbomify.com/CVE-2018-13845/): Memory corruption in htslib:htslib (critical 9.8)
- [CVE-2018-13844](https://insights.sbomify.com/CVE-2018-13844/): Denial of service in htslib:htslib (high 7.5)
- [CVE-2018-13843](https://insights.sbomify.com/CVE-2018-13843/): Denial of service in htslib:htslib (high 7.5)
- [CVE-2018-1384](https://insights.sbomify.com/CVE-2018-1384/): Cross-site scripting in Business Process Manager (medium 5.4)
- [CVE-2018-13836](https://insights.sbomify.com/CVE-2018-13836/): Integer overflow in rocket coin project:rocket coin (high 7.5)
- [CVE-2018-13833](https://insights.sbomify.com/CVE-2018-13833/): Memory corruption in cmft project:cmft (high 7.8)
- [CVE-2018-13832](https://insights.sbomify.com/CVE-2018-13832/): Cross-site scripting in techotronic:all in one favicon (medium 4.8)
- [CVE-2018-1383](https://insights.sbomify.com/CVE-2018-1383/): Privilege escalation in AIX (critical 9.1)
- [CVE-2018-13826](https://insights.sbomify.com/CVE-2018-13826/): XML external entity in PPM (critical 9.1)
- [CVE-2018-13825](https://insights.sbomify.com/CVE-2018-13825/): Cross-site scripting in PPM (medium 6.1)
- [CVE-2018-13824](https://insights.sbomify.com/CVE-2018-13824/): SQL injection in PPM (critical 9.8)
- [CVE-2018-13823](https://insights.sbomify.com/CVE-2018-13823/): XML external entity in PPM (high 7.5)
- [CVE-2018-13822](https://insights.sbomify.com/CVE-2018-13822/): Information disclosure in PPM (high 7.5)
- [CVE-2018-13821](https://insights.sbomify.com/CVE-2018-13821/): Auth bypass in Unified Infrastructure Management (critical 9.8)
- [CVE-2018-13820](https://insights.sbomify.com/CVE-2018-13820/): Hardcoded credentials in Unified Infrastructure Management (high 7.5)
- [CVE-2018-1382](https://insights.sbomify.com/CVE-2018-1382/): Cross-site scripting in API Connect (medium 5.4)
- [CVE-2018-13819](https://insights.sbomify.com/CVE-2018-13819/): Hardcoded credentials in Unified Infrastructure Management (high 7.5)
- [CVE-2018-13818](https://insights.sbomify.com/CVE-2018-13818/): Code injection in symfony:twig (critical 9.8)
- [CVE-2018-13816](https://insights.sbomify.com/CVE-2018-13816/): Auth bypass in TIM 1531 IRC (critical 10.0)
- [CVE-2018-13815](https://insights.sbomify.com/CVE-2018-13815/): Denial of service in SIMATIC S7-1200, SIMATIC S7-1500 (high 7.5)
- [CVE-2018-13814](https://insights.sbomify.com/CVE-2018-13814/): Other in SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort Outdoor Panels 7" & 15", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (high 8.8)
- [CVE-2018-13813](https://insights.sbomify.com/CVE-2018-13813/): Open redirect in SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort Outdoor Panels 7" & 15", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (high 8.1)
- [CVE-2018-13812](https://insights.sbomify.com/CVE-2018-13812/): Path traversal in SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort Outdoor Panels 7" & 15", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (high 7.5)
- [CVE-2018-13811](https://insights.sbomify.com/CVE-2018-13811/): Weak cryptography in SIMATIC STEP 7 (TIA Portal) (medium 5.5)
- [CVE-2018-13810](https://insights.sbomify.com/CVE-2018-13810/): Cross-site request forgery in CP 1604 (medium 6.5)
- [CVE-2018-13809](https://insights.sbomify.com/CVE-2018-13809/): Cross-site scripting in CP 1604 (medium 6.1)
- [CVE-2018-13808](https://insights.sbomify.com/CVE-2018-13808/): Information disclosure in CP 1604 (critical 9.1)
- [CVE-2018-13807](https://insights.sbomify.com/CVE-2018-13807/): Denial of service in SCALANCE X300, SCALANCE X408, SCALANCE X414 (high 8.6)
- [CVE-2018-13806](https://insights.sbomify.com/CVE-2018-13806/): Other in SIEMENS TD Keypad Designer (high 7.8)
- [CVE-2018-13805](https://insights.sbomify.com/CVE-2018-13805/): Denial of service in SIMATIC ET 200SP Open Controller (high 7.5)
- [CVE-2018-13804](https://insights.sbomify.com/CVE-2018-13804/): Auth bypass in SIMATIC IT LMS, SIMATIC IT Production Suite, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing (high 8.1)
- [CVE-2018-13802](https://insights.sbomify.com/CVE-2018-13802/): Privilege escalation in ROX II (high 7.2)
- [CVE-2018-13801](https://insights.sbomify.com/CVE-2018-13801/): Privilege escalation in ROX II (high 8.8)
- [CVE-2018-13800](https://insights.sbomify.com/CVE-2018-13800/): Cross-site request forgery in SIMATIC S7-1200 CPU family version 4 (high 7.3)
- [CVE-2018-1380](https://insights.sbomify.com/CVE-2018-1380/): Privilege escalation in InfoSphere Master Data Management Collaboration Server (low 2.7)
- [CVE-2018-13799](https://insights.sbomify.com/CVE-2018-13799/): Privilege escalation in SIMATIC WinCC OA V3.14 and prior (critical 9.1)
- [CVE-2018-13798](https://insights.sbomify.com/CVE-2018-13798/): Denial of service in SICAM A8000 CP-8000, SICAM A8000 CP-802X, SICAM A8000 CP-8050 (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/116/