# Vulnerabilities published in 2018


- [CVE-2018-13065](https://insights.sbomify.com/CVE-2018-13065/): Cross-site scripting in owasp:modsecurity (medium 6.1)
- [CVE-2018-13063](https://insights.sbomify.com/CVE-2018-13063/): Missing authorization in easyappointments:easy\!appointments (high 7.5)
- [CVE-2018-13060](https://insights.sbomify.com/CVE-2018-13060/): Security feature bypass in easyappointments:easy\!appointments (medium 6.5)
- [CVE-2018-1306](https://insights.sbomify.com/CVE-2018-1306/): Exposure of Sensitive Information in Apache Pluto (high 7.5)
- [CVE-2018-13056](https://insights.sbomify.com/CVE-2018-13056/): Path traversal in zzcms:zzcms (high 7.5)
- [CVE-2018-13055](https://insights.sbomify.com/CVE-2018-13055/): MantisBT allows XSS via View Filters page (medium 6.1)
- [CVE-2018-13054](https://insights.sbomify.com/CVE-2018-13054/): Privilege escalation in debian:debian linux (high 8.1)
- [CVE-2018-13053](https://insights.sbomify.com/CVE-2018-13053/): Integer overflow in canonical:ubuntu linux (low 3.3)
- [CVE-2018-13052](https://insights.sbomify.com/CVE-2018-13052/): Privilege escalation in cyberark:endpoint privilege manager (critical 9.8)
- [CVE-2018-13050](https://insights.sbomify.com/CVE-2018-13050/): SQL injection in zohocorp:manageengine applications manager (critical 9.8)
- [CVE-2018-1305](https://insights.sbomify.com/CVE-2018-1305/): Apache Tomcat information exposure vulnerability (medium 6.5)
- [CVE-2018-13049](https://insights.sbomify.com/CVE-2018-13049/): SQL injection in glpi-project:glpi (high 8.8)
- [CVE-2018-13045](https://insights.sbomify.com/CVE-2018-13045/): SQL injection in yeswiki:cercopitheque (critical 9.8)
- [CVE-2018-13043](https://insights.sbomify.com/CVE-2018-13043/): Code injection in canonical:ubuntu linux (critical 9.8)
- [CVE-2018-13042](https://insights.sbomify.com/CVE-2018-13042/): Denial of service in 1password:1password (medium 5.9)
- [CVE-2018-13041](https://insights.sbomify.com/CVE-2018-13041/): Integer overflow in linktoken project:linktoken (high 7.5)
- [CVE-2018-13040](https://insights.sbomify.com/CVE-2018-13040/): Cross-site request forgery in opendesa:opensid (high 8.8)
- [CVE-2018-1304](https://insights.sbomify.com/CVE-2018-1304/): Apache Tomcat unauthorized access vulnerability (medium 5.9)
- [CVE-2018-13039](https://insights.sbomify.com/CVE-2018-13039/): Cross-site scripting in opendesa:opensid (medium 6.1)
- [CVE-2018-13038](https://insights.sbomify.com/CVE-2018-13038/): File upload in opendesa:opensid (critical 9.8)
- [CVE-2018-13037](https://insights.sbomify.com/CVE-2018-13037/): Memory corruption in jpeg-compressor project:jpeg compressor (high 7.8)
- [CVE-2018-13034](https://insights.sbomify.com/CVE-2018-13034/): Path traversal in jester project:jester (medium 5.3)
- [CVE-2018-13033](https://insights.sbomify.com/CVE-2018-13033/): Denial of service in gnu:binutils (medium 5.5)
- [CVE-2018-13032](https://insights.sbomify.com/CVE-2018-13032/): Cross-site request forgery in ecessa:shieldlink sl175ehq firmware (high 8.8)
- [CVE-2018-13031](https://insights.sbomify.com/CVE-2018-13031/): Cross-site request forgery in damicms:damicms (high 8.8)
- [CVE-2018-13030](https://insights.sbomify.com/CVE-2018-13030/): Memory corruption in jpeg-compressor project:jpeg compressor (high 7.8)
- [CVE-2018-1303](https://insights.sbomify.com/CVE-2018-1303/): Memory corruption in Apache HTTP Server (high 7.5)
- [CVE-2018-13026](https://insights.sbomify.com/CVE-2018-13026/): Memory corruption in gopro:gpmf-parser (critical 9.8)
- [CVE-2018-13025](https://insights.sbomify.com/CVE-2018-13025/): Path traversal in yxcms:yxcms (medium 4.9)
- [CVE-2018-13024](https://insights.sbomify.com/CVE-2018-13024/): File upload in metinfo:metinfo (high 7.2)
- [CVE-2018-13023](https://insights.sbomify.com/CVE-2018-13023/): Command injection in mi:miwifi os (high 8.8)
- [CVE-2018-13022](https://insights.sbomify.com/CVE-2018-13022/): Cross-site scripting in mi:miwifi os (medium 6.1)
- [CVE-2018-13021](https://insights.sbomify.com/CVE-2018-13021/): File upload in hongcms project:hongcms (high 7.2)
- [CVE-2018-1302](https://insights.sbomify.com/CVE-2018-1302/): Use after free in Apache HTTP Server (medium 5.9)
- [CVE-2018-13014](https://insights.sbomify.com/CVE-2018-13014/): Weak cryptography in safensoft:enterprise suite (high 7.8)
- [CVE-2018-13013](https://insights.sbomify.com/CVE-2018-13013/): Security feature bypass in safensoft:enterprise suite (high 7.8)
- [CVE-2018-13012](https://insights.sbomify.com/CVE-2018-13012/): Supply chain in safensoft:softcontrol enterprise suite (high 8.1)
- [CVE-2018-13011](https://insights.sbomify.com/CVE-2018-13011/): Memory corruption in gopro:gpmf-parser (critical 9.8)
- [CVE-2018-13010](https://insights.sbomify.com/CVE-2018-13010/): Cross-site request forgery in wstmall:wstmall (high 8.8)
- [CVE-2018-1301](https://insights.sbomify.com/CVE-2018-1301/): Memory corruption in Apache HTTP Server (medium 5.9)
- [CVE-2018-13009](https://insights.sbomify.com/CVE-2018-13009/): Memory corruption in gopro:gpmf-parser (critical 9.8)
- [CVE-2018-13008](https://insights.sbomify.com/CVE-2018-13008/): Memory corruption in gopro:gpmf-parser (critical 9.8)
- [CVE-2018-13007](https://insights.sbomify.com/CVE-2018-13007/): Memory corruption in gopro:gpmf-parser (critical 9.8)
- [CVE-2018-13006](https://insights.sbomify.com/CVE-2018-13006/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2018-13005](https://insights.sbomify.com/CVE-2018-13005/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2018-13003](https://insights.sbomify.com/CVE-2018-13003/): OpenTSDB Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2018-13002](https://insights.sbomify.com/CVE-2018-13002/): Cross-site scripting in weblication:cms core \& grid (medium 4.8)
- [CVE-2018-13001](https://insights.sbomify.com/CVE-2018-13001/): Cross-site scripting in sandoba:cp\ (medium 6.1)
- [CVE-2018-13000](https://insights.sbomify.com/CVE-2018-13000/): Cross-site scripting in anelectron:advanced electron forum (medium 4.8)
- [CVE-2018-12999](https://insights.sbomify.com/CVE-2018-12999/): Path traversal in zohocorp:manageengine desktop central (high 7.5)
- [CVE-2018-12998](https://insights.sbomify.com/CVE-2018-12998/): Cross-site scripting in zohocorp:firewall analyzer (medium 6.1)
- [CVE-2018-12997](https://insights.sbomify.com/CVE-2018-12997/): Missing authorization in zohocorp:firewall analyzer (high 7.5)
- [CVE-2018-12996](https://insights.sbomify.com/CVE-2018-12996/): Cross-site scripting in zohocorp:manageengine applications manager (medium 6.1)
- [CVE-2018-12995](https://insights.sbomify.com/CVE-2018-12995/): File upload in onefilecms:onefilecms (high 8.8)
- [CVE-2018-12994](https://insights.sbomify.com/CVE-2018-12994/): Code injection in onefilecms:onefilecms (high 8.8)
- [CVE-2018-12993](https://insights.sbomify.com/CVE-2018-12993/): Auth bypass in onefilecms:onefilecms (critical 9.8)
- [CVE-2018-12992](https://insights.sbomify.com/CVE-2018-12992/): Cross-site scripting in maelostore project:maelostore (medium 4.8)
- [CVE-2018-12990](https://insights.sbomify.com/CVE-2018-12990/): Information disclosure in phpwcms:phpwcms (medium 5.3)
- [CVE-2018-1299](https://insights.sbomify.com/CVE-2018-1299/): Path traversal in Apache Allura (high 7.5)
- [CVE-2018-12989](https://insights.sbomify.com/CVE-2018-12989/): Privilege escalation in pearsonvue:console 8 (medium 6.7)
- [CVE-2018-12988](https://insights.sbomify.com/CVE-2018-12988/): Path traversal in greencms:greencms (high 7.5)
- [CVE-2018-12984](https://insights.sbomify.com/CVE-2018-12984/): Auth bypass in hycus cms project:hycus cms (critical 9.8)
- [CVE-2018-12983](https://insights.sbomify.com/CVE-2018-12983/): Memory corruption in podofo project:podofo (high 7.8)
- [CVE-2018-12982](https://insights.sbomify.com/CVE-2018-12982/): Memory corruption in podofo project:podofo (medium 5.5)
- [CVE-2018-12981](https://insights.sbomify.com/CVE-2018-12981/): Cross-site scripting in wago:762-3000 firmware (medium 5.4)
- [CVE-2018-12980](https://insights.sbomify.com/CVE-2018-12980/): File upload in wago:762-3000 firmware (high 8.8)
- [CVE-2018-1298](https://insights.sbomify.com/CVE-2018-1298/): Moderate severity vulnerability that affects org.apache.qpid:apache-qpid-broker-j (medium 5.9)
- [CVE-2018-12979](https://insights.sbomify.com/CVE-2018-12979/): File upload in wago:762-3000 firmware (medium 6.5)
- [CVE-2018-12977](https://insights.sbomify.com/CVE-2018-12977/): SQL injection in softexpert:excellence suite (high 8.8)
- [CVE-2018-12976](https://insights.sbomify.com/CVE-2018-12976/): Path traversal in godoc:go doc dot org (critical 9.8)
- [CVE-2018-12975](https://insights.sbomify.com/CVE-2018-12975/): Weak cryptography in cryptosaga:cryptosaga (high 7.5)
- [CVE-2018-12973](https://insights.sbomify.com/CVE-2018-12973/): OpenTSDB Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2018-12972](https://insights.sbomify.com/CVE-2018-12972/): OpenTSDB vulnerable to OS Command Injection (critical 9.8)
- [CVE-2018-12971](https://insights.sbomify.com/CVE-2018-12971/): Cross-site request forgery in easycms:easycms (medium 6.5)
- [CVE-2018-1297](https://insights.sbomify.com/CVE-2018-1297/): Missing certificate validation in Apache JMeter (critical 9.8)
- [CVE-2018-1296](https://insights.sbomify.com/CVE-2018-1296/): Exposure of Sensitive Information to an Unauthorized Actor in Hadoop (high 7.5)
- [CVE-2018-12959](https://insights.sbomify.com/CVE-2018-12959/): Business logic in aditustoken project:aditustoken (high 7.5)
- [CVE-2018-1295](https://insights.sbomify.com/CVE-2018-1295/): Apache serialization mechanism does not have a list of classes allowed for serialization/deserialization (critical 9.8)
- [CVE-2018-12944](https://insights.sbomify.com/CVE-2018-12944/): Cross-site scripting in seeddms:seeddms (medium 6.1)
- [CVE-2018-12943](https://insights.sbomify.com/CVE-2018-12943/): Cross-site scripting in seeddms:seeddms (medium 6.1)
- [CVE-2018-12942](https://insights.sbomify.com/CVE-2018-12942/): SQL injection in seeddms:seeddms (high 8.8)
- [CVE-2018-12941](https://insights.sbomify.com/CVE-2018-12941/): Command injection in seeddms:seeddms (high 8.8)
- [CVE-2018-12940](https://insights.sbomify.com/CVE-2018-12940/): File upload in seeddms:seeddms (high 8.8)
- [CVE-2018-1294](https://insights.sbomify.com/CVE-2018-1294/): Improper Input Validation Apache Commons Email (high 7.5)
- [CVE-2018-12939](https://insights.sbomify.com/CVE-2018-12939/): Path traversal in seeddms:seeddms (medium 6.5)
- [CVE-2018-12934](https://insights.sbomify.com/CVE-2018-12934/): Denial of service in gnu:binutils (high 7.5)
- [CVE-2018-12933](https://insights.sbomify.com/CVE-2018-12933/): Memory corruption in winehq:wine (critical 9.8)
- [CVE-2018-12932](https://insights.sbomify.com/CVE-2018-12932/): Memory corruption in winehq:wine (critical 9.8)
- [CVE-2018-12931](https://insights.sbomify.com/CVE-2018-12931/): Memory corruption in canonical:ubuntu linux (high 7.8)
- [CVE-2018-12930](https://insights.sbomify.com/CVE-2018-12930/): Memory corruption in canonical:ubuntu linux (high 7.8)
- [CVE-2018-12929](https://insights.sbomify.com/CVE-2018-12929/): Use after free in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-12928](https://insights.sbomify.com/CVE-2018-12928/): Null dereference in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-12927](https://insights.sbomify.com/CVE-2018-12927/): Information disclosure in northernnep:northern electric \& power inverter firmware (high 7.5)
- [CVE-2018-12926](https://insights.sbomify.com/CVE-2018-12926/): Information disclosure in pharoscontrols:pharos firmware (high 7.5)
- [CVE-2018-12925](https://insights.sbomify.com/CVE-2018-12925/): Auth bypass in lantronix:mss firmware (critical 9.8)
- [CVE-2018-12924](https://insights.sbomify.com/CVE-2018-12924/): Hardcoded credentials in eztcp:cie-h10 firmware (critical 9.8)
- [CVE-2018-12923](https://insights.sbomify.com/CVE-2018-12923/): Information disclosure in bwssystems:ha bridge (high 7.5)
- [CVE-2018-12922](https://insights.sbomify.com/CVE-2018-12922/): Missing authorization in vertiv:liebert intellislot firmware (high 7.5)
- [CVE-2018-12921](https://insights.sbomify.com/CVE-2018-12921/): Information disclosure in electroind:gaugetech nexus firmware (high 7.5)
- [CVE-2018-12920](https://insights.sbomify.com/CVE-2018-12920/): Information disclosure in flir:brickstream 2300 firmware (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/124/