# Vulnerabilities published in 2018


- [CVE-2018-12691](https://insights.sbomify.com/CVE-2018-12691/): Race condition in onosproject:onos (medium 6.8)
- [CVE-2018-1269](https://insights.sbomify.com/CVE-2018-1269/): Denial of service in Loggregator (medium 6.5)
- [CVE-2018-12689](https://insights.sbomify.com/CVE-2018-12689/): Other in phpldapadmin project:phpldapadmin (critical 9.8)
- [CVE-2018-12688](https://insights.sbomify.com/CVE-2018-12688/): Memory corruption in tinyexr project:tinyexr (critical 9.8)
- [CVE-2018-12687](https://insights.sbomify.com/CVE-2018-12687/): Denial of service in tinyexr project:tinyexr (high 7.5)
- [CVE-2018-12684](https://insights.sbomify.com/CVE-2018-12684/): Memory corruption in civetweb project:civetweb (high 7.1)
- [CVE-2018-12680](https://insights.sbomify.com/CVE-2018-12680/): CoAPthon DoS due to Exceptions (high 7.5)
- [CVE-2018-1268](https://insights.sbomify.com/CVE-2018-1268/): Missing authorization in Loggregator (medium 6.8)
- [CVE-2018-12679](https://insights.sbomify.com/CVE-2018-12679/): CoAPthon3 vulnerable to Deserialization of Untrusted Data (high 7.5)
- [CVE-2018-12678](https://insights.sbomify.com/CVE-2018-12678/): Server-side request forgery in portainer:portainer (critical 9.8)
- [CVE-2018-12675](https://insights.sbomify.com/CVE-2018-12675/): Open redirect in sv3c:h.264 poe ip camera firmware (medium 6.1)
- [CVE-2018-12674](https://insights.sbomify.com/CVE-2018-12674/): Information disclosure in sv3c:h.264 poe ip camera firmware (medium 5.7)
- [CVE-2018-12673](https://insights.sbomify.com/CVE-2018-12673/): Information disclosure in sv3c:h.264 poe ip camera firmware (high 7.5)
- [CVE-2018-12672](https://insights.sbomify.com/CVE-2018-12672/): Cross-site scripting in sv3c:h.264 poe ip camera firmware (medium 5.4)
- [CVE-2018-12671](https://insights.sbomify.com/CVE-2018-12671/): Information disclosure in sv3c:h.264 poe ip camera firmware (critical 9.8)
- [CVE-2018-12670](https://insights.sbomify.com/CVE-2018-12670/): Command injection in sv3c:h.264 poe ip camera firmware (critical 9.8)
- [CVE-2018-1267](https://insights.sbomify.com/CVE-2018-1267/): Misconfiguration in cloudfoundry:silk-release (high 8.1)
- [CVE-2018-12669](https://insights.sbomify.com/CVE-2018-12669/): Missing authorization in sv3c:h.264 poe ip camera firmware (high 8.8)
- [CVE-2018-12668](https://insights.sbomify.com/CVE-2018-12668/): Hardcoded credentials in sv3c:h.264 poe ip camera firmware (critical 9.8)
- [CVE-2018-12667](https://insights.sbomify.com/CVE-2018-12667/): Auth bypass in sv3c:h.264 poe ip camera firmware (critical 9.8)
- [CVE-2018-12666](https://insights.sbomify.com/CVE-2018-12666/): Auth bypass in sv3c:h.264 poe ip camera firmware (critical 9.8)
- [CVE-2018-1266](https://insights.sbomify.com/CVE-2018-1266/): Path traversal in cloudfoundry:capi-release (high 8.1)
- [CVE-2018-12659](https://insights.sbomify.com/CVE-2018-12659/): Cross-site request forgery in slims akasia project:slims akasia (high 8.8)
- [CVE-2018-12658](https://insights.sbomify.com/CVE-2018-12658/): Cross-site scripting in slims project:slims (medium 6.1)
- [CVE-2018-12657](https://insights.sbomify.com/CVE-2018-12657/): Cross-site scripting in slims akasia project:slims akasia (medium 6.1)
- [CVE-2018-12656](https://insights.sbomify.com/CVE-2018-12656/): Cross-site scripting in slims akasia project:slims akasia (medium 6.1)
- [CVE-2018-12655](https://insights.sbomify.com/CVE-2018-12655/): Cross-site scripting in slims akasia project:slims akasia (medium 6.1)
- [CVE-2018-12654](https://insights.sbomify.com/CVE-2018-12654/): Cross-site scripting in slims akasia project:slims akasia (medium 6.1)
- [CVE-2018-12653](https://insights.sbomify.com/CVE-2018-12653/): Cross-site scripting in myadrenalin:adrenalin (medium 6.1)
- [CVE-2018-12652](https://insights.sbomify.com/CVE-2018-12652/): Cross-site scripting in myadrenalin:adrenalin (medium 6.1)
- [CVE-2018-12651](https://insights.sbomify.com/CVE-2018-12651/): Cross-site scripting in myadrenalin:human resource management software (medium 6.1)
- [CVE-2018-12650](https://insights.sbomify.com/CVE-2018-12650/): Cross-site scripting in myadrenalin:human resource management software (medium 6.1)
- [CVE-2018-1265](https://insights.sbomify.com/CVE-2018-1265/): Path traversal in Diego (high 7.2)
- [CVE-2018-12649](https://insights.sbomify.com/CVE-2018-12649/): Security feature bypass in misp-project:misp (critical 9.8)
- [CVE-2018-12648](https://insights.sbomify.com/CVE-2018-12648/): Null dereference in exempi project:exempi (high 7.5)
- [CVE-2018-12642](https://insights.sbomify.com/CVE-2018-12642/): Froxlor Incorrect Access Control (high 7.5)
- [CVE-2018-12641](https://insights.sbomify.com/CVE-2018-12641/): Denial of service in gnu:binutils (medium 5.5)
- [CVE-2018-12640](https://insights.sbomify.com/CVE-2018-12640/): Memory corruption in insteon:2864-222 firmware (critical 9.8)
- [CVE-2018-1264](https://insights.sbomify.com/CVE-2018-1264/): Log Cache logs UAA client secret on startup (critical 9.1)
- [CVE-2018-12638](https://insights.sbomify.com/CVE-2018-12638/): Cross-site scripting in bose:soundtouch (medium 6.1)
- [CVE-2018-12636](https://insights.sbomify.com/CVE-2018-12636/): SQL injection in ithemes:security (high 7.2)
- [CVE-2018-12635](https://insights.sbomify.com/CVE-2018-12635/): Missing authorization in circontrol:scada (high 7.5)
- [CVE-2018-12634](https://insights.sbomify.com/CVE-2018-12634/): Information disclosure in circontrol:circarlife scada (critical 9.8)
- [CVE-2018-12633](https://insights.sbomify.com/CVE-2018-12633/): Race condition in linux:linux kernel (medium 6.3)
- [CVE-2018-12632](https://insights.sbomify.com/CVE-2018-12632/): Information disclosure in redatam:redatam (medium 5.3)
- [CVE-2018-12631](https://insights.sbomify.com/CVE-2018-12631/): Path traversal in redatam:redatam (high 7.5)
- [CVE-2018-12630](https://insights.sbomify.com/CVE-2018-12630/): SQL injection in nmark:nmcms (critical 9.8)
- [CVE-2018-1263](https://insights.sbomify.com/CVE-2018-1263/): spring-integration-zip Arbitrary File Write (medium 4.7)
- [CVE-2018-12628](https://insights.sbomify.com/CVE-2018-12628/): Cross-site request forgery in eventum project:eventum (high 8.8)
- [CVE-2018-12627](https://insights.sbomify.com/CVE-2018-12627/): Cross-site scripting in eventum project:eventum (medium 6.1)
- [CVE-2018-12626](https://insights.sbomify.com/CVE-2018-12626/): Cross-site scripting in eventum project:eventum (medium 6.1)
- [CVE-2018-12625](https://insights.sbomify.com/CVE-2018-12625/): Cross-site scripting in eventum project:eventum (medium 6.1)
- [CVE-2018-12624](https://insights.sbomify.com/CVE-2018-12624/): Cross-site scripting in eventum project:eventum (medium 6.1)
- [CVE-2018-12623](https://insights.sbomify.com/CVE-2018-12623/): Cross-site scripting in eventum project:eventum (medium 6.1)
- [CVE-2018-12622](https://insights.sbomify.com/CVE-2018-12622/): Cross-site scripting in eventum project:eventum (medium 6.1)
- [CVE-2018-12621](https://insights.sbomify.com/CVE-2018-12621/): Open redirect in eventum project:eventum (medium 6.1)
- [CVE-2018-1262](https://insights.sbomify.com/CVE-2018-1262/): UAA privilege escalation across identity zones (high 7.2)
- [CVE-2018-12617](https://insights.sbomify.com/CVE-2018-12617/): Integer overflow in canonical:ubuntu linux (high 7.5)
- [CVE-2018-12615](https://insights.sbomify.com/CVE-2018-12615/): Phusion Passenger incorrect permission assignment (medium 5.3)
- [CVE-2018-12613](https://insights.sbomify.com/CVE-2018-12613/): phpMyAdmin Improper Authentication (high 8.8)
- [CVE-2018-12611](https://insights.sbomify.com/CVE-2018-12611/): Path traversal in open-xchange:open-xchange appsuite (medium 6.1)
- [CVE-2018-12610](https://insights.sbomify.com/CVE-2018-12610/): Information disclosure in open-xchange:open-xchange appsuite (medium 5.3)
- [CVE-2018-1261](https://insights.sbomify.com/CVE-2018-1261/): Path traversal in org.springframework.integration:spring-integration-zip (medium 4.7)
- [CVE-2018-12609](https://insights.sbomify.com/CVE-2018-12609/): Server-side request forgery in open-xchange:open-xchange appsuite (medium 6.5)
- [CVE-2018-12608](https://insights.sbomify.com/CVE-2018-12608/): Docker Authentication Bypass (high 7.5)
- [CVE-2018-12607](https://insights.sbomify.com/CVE-2018-12607/): Cross-site scripting in gitlab:gitlab (medium 5.4)
- [CVE-2018-12606](https://insights.sbomify.com/CVE-2018-12606/): Cross-site scripting in gitlab:gitlab (medium 5.4)
- [CVE-2018-12605](https://insights.sbomify.com/CVE-2018-12605/): Cross-site scripting in gitlab:gitlab (medium 5.4)
- [CVE-2018-12604](https://insights.sbomify.com/CVE-2018-12604/): Information disclosure in njtech:greencms (high 7.5)
- [CVE-2018-12603](https://insights.sbomify.com/CVE-2018-12603/): Cross-site request forgery in lfdycms:lfcms (high 8.8)
- [CVE-2018-12602](https://insights.sbomify.com/CVE-2018-12602/): Cross-site request forgery in lfdycms:lfcms (high 8.8)
- [CVE-2018-12601](https://insights.sbomify.com/CVE-2018-12601/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2018-12600](https://insights.sbomify.com/CVE-2018-12600/): Memory corruption in canonical:ubuntu linux (high 8.8)
- [CVE-2018-1260](https://insights.sbomify.com/CVE-2018-1260/): Spring Security OAuth vulnerable to remote code execution (RCE) (critical 9.8)
- [CVE-2018-12599](https://insights.sbomify.com/CVE-2018-12599/): Memory corruption in canonical:ubuntu linux (high 8.8)
- [CVE-2018-12596](https://insights.sbomify.com/CVE-2018-12596/): Missing authorization in episerver:ektron cms (critical 9.8)
- [CVE-2018-12594](https://insights.sbomify.com/CVE-2018-12594/): Information disclosure in reliablecontrols:mach-prowebcom firmware (high 7.5)
- [CVE-2018-12592](https://insights.sbomify.com/CVE-2018-12592/): Information disclosure in polycom:realpresence web suite (high 7.5)
- [CVE-2018-12591](https://insights.sbomify.com/CVE-2018-12591/): Command injection in ubnt:edgeswitch firmware (high 7.2)
- [CVE-2018-12590](https://insights.sbomify.com/CVE-2018-12590/): Code injection in ui:edgeswitch firmware (high 7.2)
- [CVE-2018-1259](https://insights.sbomify.com/CVE-2018-1259/): Spring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper restriction of XML external entity references (high 7.5)
- [CVE-2018-12589](https://insights.sbomify.com/CVE-2018-12589/): Code injection in polarisoffice:polaris office 2017 (high 7.8)
- [CVE-2018-12588](https://insights.sbomify.com/CVE-2018-12588/): Cross-site scripting in public knowledge project:open monograph press (medium 6.1)
- [CVE-2018-12587](https://insights.sbomify.com/CVE-2018-12587/): Cross-site scripting in german spelling dictionary project:german spelling dictionary (medium 6.1)
- [CVE-2018-12585](https://insights.sbomify.com/CVE-2018-12585/): XML external entity in opcfoundation:ua-.net-legacy (high 8.2)
- [CVE-2018-12584](https://insights.sbomify.com/CVE-2018-12584/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2018-12583](https://insights.sbomify.com/CVE-2018-12583/): Cross-site request forgery in akcms project:akcms (medium 6.5)
- [CVE-2018-12582](https://insights.sbomify.com/CVE-2018-12582/): Cross-site request forgery in akcms project:akcms (high 8.8)
- [CVE-2018-12581](https://insights.sbomify.com/CVE-2018-12581/): phpMyAdmin XSS Vulnerability (medium 6.1)
- [CVE-2018-12580](https://insights.sbomify.com/CVE-2018-12580/): Cross-site scripting in dragonbyte-tech:vbsecurity (medium 6.1)
- [CVE-2018-1258](https://insights.sbomify.com/CVE-2018-1258/): Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass (high 8.8)
- [CVE-2018-12579](https://insights.sbomify.com/CVE-2018-12579/): Auth bypass in oxid-esales:eshop (high 8.1)
- [CVE-2018-12578](https://insights.sbomify.com/CVE-2018-12578/): Memory corruption in sam2p project:sam2p (critical 9.8)
- [CVE-2018-12577](https://insights.sbomify.com/CVE-2018-12577/): Command injection in tp-link:tl-wr841n firmware (high 8.8)
- [CVE-2018-12576](https://insights.sbomify.com/CVE-2018-12576/): Other in tp-link:tl-wr841n firmware (medium 4.3)
- [CVE-2018-12575](https://insights.sbomify.com/CVE-2018-12575/): Auth bypass in tp-link:tl-wr841n firmware (critical 9.8)
- [CVE-2018-12574](https://insights.sbomify.com/CVE-2018-12574/): Cross-site request forgery in tp-link:tl-wr841n firmware (high 8.8)
- [CVE-2018-12572](https://insights.sbomify.com/CVE-2018-12572/): Information disclosure in avast:free antivirus (high 7.8)
- [CVE-2018-12571](https://insights.sbomify.com/CVE-2018-12571/): Server-side request forgery in microsoft:forefront unified access gateway (critical 9.8)
- [CVE-2018-1257](https://insights.sbomify.com/CVE-2018-1257/): Denial of Service in org.springframework:spring-core (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/127/