# Vulnerabilities published in 2018 - [CVE-2018-13403](https://insights.sbomify.com/CVE-2018-13403/): Cross-site scripting in Jira (medium 5.4) - [CVE-2018-13402](https://insights.sbomify.com/CVE-2018-13402/): Open redirect in Jira (medium 6.1) - [CVE-2018-13401](https://insights.sbomify.com/CVE-2018-13401/): Open redirect in Jira (medium 6.1) - [CVE-2018-13400](https://insights.sbomify.com/CVE-2018-13400/): Privilege escalation in Jira (medium 4.7) - [CVE-2018-1340](https://insights.sbomify.com/CVE-2018-1340/): Missing Encryption of Sensitive Data in Apache Guacamole (high 7.5) - [CVE-2018-13399](https://insights.sbomify.com/CVE-2018-13399/): Privilege escalation in Fisheye and Crucible (high 7.8) - [CVE-2018-13398](https://insights.sbomify.com/CVE-2018-13398/): Cross-site request forgery in Fisheye and Crucible (medium 6.5) - [CVE-2018-13397](https://insights.sbomify.com/CVE-2018-13397/): Command injection in Sourcetree for Windows (high 8.8) - [CVE-2018-13396](https://insights.sbomify.com/CVE-2018-13396/): Command injection in Sourcetree for macOS (high 8.8) - [CVE-2018-13395](https://insights.sbomify.com/CVE-2018-13395/): Cross-site scripting in Jira (medium 6.1) - [CVE-2018-13394](https://insights.sbomify.com/CVE-2018-13394/): Cross-site request forgery in Confluence Questions (medium 6.5) - [CVE-2018-13393](https://insights.sbomify.com/CVE-2018-13393/): Cross-site request forgery in Confluence Questions (medium 6.5) - [CVE-2018-13392](https://insights.sbomify.com/CVE-2018-13392/): Cross-site scripting in Fisheye and Crucible (medium 6.1) - [CVE-2018-13391](https://insights.sbomify.com/CVE-2018-13391/): Information disclosure in Jira (medium 5.3) - [CVE-2018-13390](https://insights.sbomify.com/CVE-2018-13390/): Cloudtoken Insufficiently Protects Credentials (medium 6.1) - [CVE-2018-1339](https://insights.sbomify.com/CVE-2018-1339/): org.apache.tika:tika-parsers has an Infinite Loop vulnerability (medium 5.5) - [CVE-2018-13389](https://insights.sbomify.com/CVE-2018-13389/): Other in Confluence (medium 4.7) - [CVE-2018-13388](https://insights.sbomify.com/CVE-2018-13388/): Cross-site scripting in Fisheye and Crucible (medium 5.4) - [CVE-2018-13387](https://insights.sbomify.com/CVE-2018-13387/): Cross-site scripting in Jira (medium 6.1) - [CVE-2018-13386](https://insights.sbomify.com/CVE-2018-13386/): Command injection in Sourcetree for Windows (high 8.1) - [CVE-2018-13385](https://insights.sbomify.com/CVE-2018-13385/): Command injection in Sourcetree for macOS (critical 9.8) - [CVE-2018-13384](https://insights.sbomify.com/CVE-2018-13384/): Open redirect in Fortinet FortiOS (medium 6.1) - [CVE-2018-13383](https://insights.sbomify.com/CVE-2018-13383/): Fortinet FortiOS and FortiProxy Out-of-bounds Write (medium 4.3, exploited in the wild) - [CVE-2018-13382](https://insights.sbomify.com/CVE-2018-13382/): Fortinet FortiOS and FortiProxy Improper Authorization (critical 9.1, exploited in the wild) - [CVE-2018-13381](https://insights.sbomify.com/CVE-2018-13381/): Memory corruption in Fortinet FortiOS and FortiProxy (medium 5.3) - [CVE-2018-13380](https://insights.sbomify.com/CVE-2018-13380/): Cross-site scripting in Fortinet FortiOS and FortiProxy (medium 4.7) - [CVE-2018-1338](https://insights.sbomify.com/CVE-2018-1338/): Moderate severity vulnerability that affects org.apache.tika:tika-core (medium 5.5) - [CVE-2018-13379](https://insights.sbomify.com/CVE-2018-13379/): Fortinet FortiOS SSL VPN Path Traversal (critical 9.1, exploited in the wild) - [CVE-2018-13378](https://insights.sbomify.com/CVE-2018-13378/): Information disclosure in Fortinet FortiSIEM (high 7.2) - [CVE-2018-13376](https://insights.sbomify.com/CVE-2018-13376/): Information disclosure in Fortinet FortiOS (high 7.5) - [CVE-2018-13375](https://insights.sbomify.com/CVE-2018-13375/): Cross-site scripting in FortiAnalyzer (medium 6.1) - [CVE-2018-13374](https://insights.sbomify.com/CVE-2018-13374/): Fortinet FortiOS and FortiADC Improper Access Control (medium 4.3, exploited in the wild) - [CVE-2018-13371](https://insights.sbomify.com/CVE-2018-13371/): Missing authorization in Fortinet FortiOS (high 8.8) - [CVE-2018-1337](https://insights.sbomify.com/CVE-2018-1337/): Credential leak in org.apache.directory.api:apache-ldap-api (critical 9.8) - [CVE-2018-13368](https://insights.sbomify.com/CVE-2018-13368/): Command injection in Fortinet FortiClient for Windows (high 7.8) - [CVE-2018-13367](https://insights.sbomify.com/CVE-2018-13367/): Information disclosure in FortiOS (medium 5.3) - [CVE-2018-13366](https://insights.sbomify.com/CVE-2018-13366/): Information disclosure in Fortinet FortiOS (medium 5.3) - [CVE-2018-13365](https://insights.sbomify.com/CVE-2018-13365/): Information disclosure in Fortinet FortiOS (medium 5.3) - [CVE-2018-13361](https://insights.sbomify.com/CVE-2018-13361/): Information disclosure in terra-master:terramaster operating system (medium 5.3) - [CVE-2018-13360](https://insights.sbomify.com/CVE-2018-13360/): Cross-site scripting in terra-master:terramaster operating system (medium 6.1) - [CVE-2018-1336](https://insights.sbomify.com/CVE-2018-1336/): In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder (high 7.5) - [CVE-2018-13359](https://insights.sbomify.com/CVE-2018-13359/): Cross-site scripting in terra-master:terramaster operating system (high 8.8) - [CVE-2018-13358](https://insights.sbomify.com/CVE-2018-13358/): Command injection in terra-master:terramaster operating system (high 8.8) - [CVE-2018-13357](https://insights.sbomify.com/CVE-2018-13357/): Cross-site scripting in terra-master:terramaster operating system (medium 5.4) - [CVE-2018-13356](https://insights.sbomify.com/CVE-2018-13356/): Privilege escalation in terra-master:terramaster operating system (high 8.8) - [CVE-2018-13355](https://insights.sbomify.com/CVE-2018-13355/): Missing authorization in terra-master:terramaster operating system (medium 6.5) - [CVE-2018-13354](https://insights.sbomify.com/CVE-2018-13354/): Command injection in terra-master:terramaster operating system (critical 9.8) - [CVE-2018-13353](https://insights.sbomify.com/CVE-2018-13353/): Command injection in terra-master:terramaster operating system (high 8.8) - [CVE-2018-13352](https://insights.sbomify.com/CVE-2018-13352/): Information disclosure in terra-master:terramaster operating system (high 7.5) - [CVE-2018-13351](https://insights.sbomify.com/CVE-2018-13351/): Cross-site scripting in terra-master:terramaster operating system (medium 4.8) - [CVE-2018-13350](https://insights.sbomify.com/CVE-2018-13350/): SQL injection in terra-master:terramaster operating system (critical 9.8) - [CVE-2018-1335](https://insights.sbomify.com/CVE-2018-1335/): Command injection in org.apache.tika:tika-core (high 8.1) - [CVE-2018-13349](https://insights.sbomify.com/CVE-2018-13349/): Cross-site scripting in terra-master:terramaster operating system (medium 6.1) - [CVE-2018-13348](https://insights.sbomify.com/CVE-2018-13348/): Mercurial Improper Input Validation vulnerability (high 7.5) - [CVE-2018-13347](https://insights.sbomify.com/CVE-2018-13347/): Mercurial mishandles integer addition and subtraction (critical 9.8) - [CVE-2018-13346](https://insights.sbomify.com/CVE-2018-13346/): Mercurial Improper Input Validation vulnerability (high 7.5) - [CVE-2018-13342](https://insights.sbomify.com/CVE-2018-13342/): Hardcoded credentials in linhandante:anda (critical 9.8) - [CVE-2018-13341](https://insights.sbomify.com/CVE-2018-13341/): Weak cryptography in crestron:mc3 firmware (high 8.8) - [CVE-2018-13340](https://insights.sbomify.com/CVE-2018-13340/): Cross-site request forgery in gleeztech:gleez cms (high 8.8) - [CVE-2018-1334](https://insights.sbomify.com/CVE-2018-1334/): Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark (medium 4.7) - [CVE-2018-13339](https://insights.sbomify.com/CVE-2018-13339/): Angular Redactor XSS Vulnerability (medium 6.1) - [CVE-2018-13338](https://insights.sbomify.com/CVE-2018-13338/): Command injection in terra-master:terramaster operating system (critical 9.8) - [CVE-2018-13337](https://insights.sbomify.com/CVE-2018-13337/): Auth bypass in terra-master:terramaster operating system (medium 5.4) - [CVE-2018-13336](https://insights.sbomify.com/CVE-2018-13336/): Command injection in terra-master:terramaster operating system (critical 9.8) - [CVE-2018-13335](https://insights.sbomify.com/CVE-2018-13335/): Cross-site scripting in terra-master:terramaster operating system (medium 5.4) - [CVE-2018-13334](https://insights.sbomify.com/CVE-2018-13334/): Cross-site scripting in terra-master:terramaster operating system (medium 6.1) - [CVE-2018-13333](https://insights.sbomify.com/CVE-2018-13333/): Cross-site scripting in terra-master:terramaster operating system (medium 6.1) - [CVE-2018-13332](https://insights.sbomify.com/CVE-2018-13332/): Path traversal in terra-master:terramaster operating system (high 7.5) - [CVE-2018-13331](https://insights.sbomify.com/CVE-2018-13331/): Cross-site scripting in terra-master:terramaster operating system (medium 6.1) - [CVE-2018-13330](https://insights.sbomify.com/CVE-2018-13330/): Command injection in terra-master:terramaster operating system (high 7.2) - [CVE-2018-1333](https://insights.sbomify.com/CVE-2018-1333/): DoS for HTTP/2 connections by crafted requests (high 7.5) - [CVE-2018-13329](https://insights.sbomify.com/CVE-2018-13329/): Cross-site scripting in terra-master:terramaster operating system (medium 6.1) - [CVE-2018-13328](https://insights.sbomify.com/CVE-2018-13328/): Integer overflow in pfg project:pfg (high 7.5) - [CVE-2018-13327](https://insights.sbomify.com/CVE-2018-13327/): Integer overflow in chucunlingaigo project:chucunlingaigo (high 7.5) - [CVE-2018-13326](https://insights.sbomify.com/CVE-2018-13326/): Integer overflow in bittelux project:bittelux (high 7.5) - [CVE-2018-13325](https://insights.sbomify.com/CVE-2018-13325/): Integer overflow in boodskap:growchain (high 7.5) - [CVE-2018-13324](https://insights.sbomify.com/CVE-2018-13324/): Auth bypass in buffalo:ts5600d1206 firmware (critical 9.8) - [CVE-2018-13323](https://insights.sbomify.com/CVE-2018-13323/): Cross-site scripting in buffalo:ts5600d1206 firmware (medium 6.1) - [CVE-2018-13322](https://insights.sbomify.com/CVE-2018-13322/): Path traversal in buffalo:ts5600d1206 firmware (medium 6.5) - [CVE-2018-13321](https://insights.sbomify.com/CVE-2018-13321/): Missing authorization in buffalo:ts5600d1206 firmware (high 8.8) - [CVE-2018-13320](https://insights.sbomify.com/CVE-2018-13320/): Command injection in buffalo:ts5600d1206 firmware (high 7.2) - [CVE-2018-1332](https://insights.sbomify.com/CVE-2018-1332/): Moderate severity vulnerability that affects org.apache.storm:storm-core (medium 6.5) - [CVE-2018-13319](https://insights.sbomify.com/CVE-2018-13319/): Missing authorization in buffalo:ts5600d1206 firmware (high 7.5) - [CVE-2018-13318](https://insights.sbomify.com/CVE-2018-13318/): Command injection in buffalo:ts5600d1206 firmware (high 7.2) - [CVE-2018-13317](https://insights.sbomify.com/CVE-2018-13317/): Information disclosure in totolink:a3002ru firmware (medium 6.1) - [CVE-2018-13316](https://insights.sbomify.com/CVE-2018-13316/): Command injection in totolink:a3002ru firmware (critical 9.8) - [CVE-2018-13315](https://insights.sbomify.com/CVE-2018-13315/): Missing authorization in totolink:a3002ru firmware (critical 9.8) - [CVE-2018-13314](https://insights.sbomify.com/CVE-2018-13314/): Command injection in totolink:a3002ru firmware (critical 9.8) - [CVE-2018-13313](https://insights.sbomify.com/CVE-2018-13313/): Admin Password returned in password.htm (medium 6.5) - [CVE-2018-13312](https://insights.sbomify.com/CVE-2018-13312/): Cross-site scripting in totolink:a3002ru firmware (medium 6.1) - [CVE-2018-13311](https://insights.sbomify.com/CVE-2018-13311/): Command injection in totolink:a3002ru firmware (critical 9.8) - [CVE-2018-13310](https://insights.sbomify.com/CVE-2018-13310/): Cross-site scripting in totolink:a3002ru firmware (medium 6.1) - [CVE-2018-1331](https://insights.sbomify.com/CVE-2018-1331/): Code execution in org.apache.storm:storm-core (high 8.8) - [CVE-2018-13309](https://insights.sbomify.com/CVE-2018-13309/): Cross-site scripting in totolink:a3002ru firmware (medium 6.1) - [CVE-2018-13308](https://insights.sbomify.com/CVE-2018-13308/): Cross-site scripting in totolink:a3002ru firmware (medium 6.1) - [CVE-2018-13307](https://insights.sbomify.com/CVE-2018-13307/): Command injection in totolink:a3002ru firmware (critical 9.8) - [CVE-2018-13306](https://insights.sbomify.com/CVE-2018-13306/): Command injection in totolink:a3002ru firmware (critical 9.8) - [CVE-2018-13305](https://insights.sbomify.com/CVE-2018-13305/): Memory corruption in ffmpeg:ffmpeg (high 8.1) - [CVE-2018-13304](https://insights.sbomify.com/CVE-2018-13304/): Denial of service in ffmpeg:ffmpeg (medium 6.5) - [CVE-2018-13303](https://insights.sbomify.com/CVE-2018-13303/): Null dereference in ffmpeg:ffmpeg (medium 6.5) --- From sbomify Insights: https://insights.sbomify.com/years/2018/page/121/