# Vulnerabilities published in 2018


- [CVE-2018-12565](https://insights.sbomify.com/CVE-2018-12565/): Deserialization in debian:debian linux (high 8.8)
- [CVE-2018-12564](https://insights.sbomify.com/CVE-2018-12564/): Server-side request forgery in debian:debian linux (medium 6.5)
- [CVE-2018-12563](https://insights.sbomify.com/CVE-2018-12563/): Path traversal in linaro:lava (medium 6.5)
- [CVE-2018-12562](https://insights.sbomify.com/CVE-2018-12562/): Command injection in cantata project:cantata (critical 9.8)
- [CVE-2018-12561](https://insights.sbomify.com/CVE-2018-12561/): Other in cantata project:cantata (high 8.8)
- [CVE-2018-12560](https://insights.sbomify.com/CVE-2018-12560/): Path traversal in cantata project:cantata (medium 6.5)
- [CVE-2018-1256](https://insights.sbomify.com/CVE-2018-1256/): Issuer validation regression in Spring Cloud SSO Connector (high 8.1)
- [CVE-2018-12559](https://insights.sbomify.com/CVE-2018-12559/): Path traversal in cantata project:cantata (high 8.8)
- [CVE-2018-12558](https://insights.sbomify.com/CVE-2018-12558/): Denial of service in email\:\ (high 7.5)
- [CVE-2018-12557](https://insights.sbomify.com/CVE-2018-12557/): Information disclosure in zuul-ci:zuul (critical 9.8)
- [CVE-2018-12556](https://insights.sbomify.com/CVE-2018-12556/): Security feature bypass in yarnpkg:website (medium 5.9)
- [CVE-2018-12551](https://insights.sbomify.com/CVE-2018-12551/): Auth bypass in Eclipse Mosquitto (high 8.1)
- [CVE-2018-12550](https://insights.sbomify.com/CVE-2018-12550/): Misconfiguration in Eclipse Mosquitto (high 8.1)
- [CVE-2018-1255](https://insights.sbomify.com/CVE-2018-1255/): Reflected Cross-Site Scripting Vulnerability (medium 6.1)
- [CVE-2018-12549](https://insights.sbomify.com/CVE-2018-12549/): Null dereference in Eclipse OpenJ9 (critical 9.8)
- [CVE-2018-12548](https://insights.sbomify.com/CVE-2018-12548/): Memory corruption in Eclipse OpenJ9 (critical 9.8)
- [CVE-2018-12547](https://insights.sbomify.com/CVE-2018-12547/): Memory corruption in Eclipse OpenJ9 (critical 9.8)
- [CVE-2018-12546](https://insights.sbomify.com/CVE-2018-12546/): Security feature bypass in Eclipse Mosquitto (medium 6.5)
- [CVE-2018-12545](https://insights.sbomify.com/CVE-2018-12545/): Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server (high 7.5)
- [CVE-2018-12544](https://insights.sbomify.com/CVE-2018-12544/): Moderate severity vulnerability that affects io.vertx:vertx-core (critical 9.8)
- [CVE-2018-12543](https://insights.sbomify.com/CVE-2018-12543/): Denial of service in Eclipse Mosquitto (high 7.5)
- [CVE-2018-12542](https://insights.sbomify.com/CVE-2018-12542/): Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location (critical 9.8)
- [CVE-2018-12541](https://insights.sbomify.com/CVE-2018-12541/): Excessive memory allocation (medium 6.5)
- [CVE-2018-12540](https://insights.sbomify.com/CVE-2018-12540/): High severity vulnerability that affects io.vertx:vertx-web (high 8.8)
- [CVE-2018-1254](https://insights.sbomify.com/CVE-2018-1254/): Cross-site scripting in RSA Authentication Manager (medium 6.1)
- [CVE-2018-12539](https://insights.sbomify.com/CVE-2018-12539/): Code injection in Eclipse OpenJ9 (high 7.8)
- [CVE-2018-12538](https://insights.sbomify.com/CVE-2018-12538/): Access and integrity issue within Eclipse Jetty (high 8.8)
- [CVE-2018-12537](https://insights.sbomify.com/CVE-2018-12537/): Moderate severity vulnerability that affects io.vertx:vertx-core (medium 5.3)
- [CVE-2018-12536](https://insights.sbomify.com/CVE-2018-12536/): Eclipse Jetty Server generates error message containing sensitive information (medium 5.3)
- [CVE-2018-12534](https://insights.sbomify.com/CVE-2018-12534/): SQL injection in quick chat project:quick chat (critical 9.8)
- [CVE-2018-12533](https://insights.sbomify.com/CVE-2018-12533/): Arbitrary code execution in Richfaces (critical 9.8)
- [CVE-2018-12532](https://insights.sbomify.com/CVE-2018-12532/): RichFaces vulnerable to Expression Language Injection (critical 9.8)
- [CVE-2018-12531](https://insights.sbomify.com/CVE-2018-12531/): Code injection in metinfo:metinfo (critical 9.8)
- [CVE-2018-12530](https://insights.sbomify.com/CVE-2018-12530/): Path traversal in metinfo:metinfo (medium 6.5)
- [CVE-2018-1253](https://insights.sbomify.com/CVE-2018-1253/): Stored cross-site scripting vulnerability (medium 6.5)
- [CVE-2018-12529](https://insights.sbomify.com/CVE-2018-12529/): Cross-site request forgery in intex:n150 firmware (high 8.8)
- [CVE-2018-12528](https://insights.sbomify.com/CVE-2018-12528/): File upload in intex:n150 firmware (high 8.1)
- [CVE-2018-12526](https://insights.sbomify.com/CVE-2018-12526/): Hardcoded credentials in telesquare:sdt-cs3b1 firmware (critical 9.8)
- [CVE-2018-12525](https://insights.sbomify.com/CVE-2018-12525/): Information disclosure in perfsonar:monitoring and debugging dashboard (medium 5.3)
- [CVE-2018-12524](https://insights.sbomify.com/CVE-2018-12524/): Information disclosure in perfsonar:monitoring and debugging dashboard (medium 5.3)
- [CVE-2018-12523](https://insights.sbomify.com/CVE-2018-12523/): Information disclosure in perfsonar:monitoring and debugging dashboard (medium 5.3)
- [CVE-2018-12522](https://insights.sbomify.com/CVE-2018-12522/): Information disclosure in perfsonar:monitoring and debugging dashboard (medium 5.3)
- [CVE-2018-12520](https://insights.sbomify.com/CVE-2018-12520/): Weak cryptography in ntop:ntopng (high 8.1)
- [CVE-2018-1252](https://insights.sbomify.com/CVE-2018-1252/): RSA Web Threat Detection SQL Injection Vulnerability (high 8.8)
- [CVE-2018-12519](https://insights.sbomify.com/CVE-2018-12519/): File upload in codenx:shopnx (high 8.8)
- [CVE-2018-12511](https://insights.sbomify.com/CVE-2018-12511/): Integer overflow in substratum:substratum (high 7.5)
- [CVE-2018-1251](https://insights.sbomify.com/CVE-2018-1251/): Open redirect in Dell EMC Unity (high 8.3)
- [CVE-2018-12504](https://insights.sbomify.com/CVE-2018-12504/): Denial of service in tinyexr project:tinyexr (high 7.5)
- [CVE-2018-12503](https://insights.sbomify.com/CVE-2018-12503/): Memory corruption in tinyexr project:tinyexr (critical 9.8)
- [CVE-2018-12501](https://insights.sbomify.com/CVE-2018-12501/): Cross-site scripting in nagios:fusion (medium 6.1)
- [CVE-2018-1250](https://insights.sbomify.com/CVE-2018-1250/): Missing authorization in Dell EMC Unity (medium 6.5)
- [CVE-2018-12499](https://insights.sbomify.com/CVE-2018-12499/): Security feature bypass in motorola:mbp853 firmware (high 7.4)
- [CVE-2018-12498](https://insights.sbomify.com/CVE-2018-12498/): SQL injection in icmsdev:icms (critical 9.8)
- [CVE-2018-12495](https://insights.sbomify.com/CVE-2018-12495/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2018-12494](https://insights.sbomify.com/CVE-2018-12494/): Path traversal in publiccms:publiccms (medium 6.5)
- [CVE-2018-12493](https://insights.sbomify.com/CVE-2018-12493/): Path traversal in publiccms:publiccms (medium 6.5)
- [CVE-2018-12492](https://insights.sbomify.com/CVE-2018-12492/): Path traversal in phpok:phpok (high 7.5)
- [CVE-2018-12491](https://insights.sbomify.com/CVE-2018-12491/): File upload in phpok:phpok (critical 9.8)
- [CVE-2018-1249](https://insights.sbomify.com/CVE-2018-1249/): Security feature bypass in iDRAC9 (medium 6.5)
- [CVE-2018-12483](https://insights.sbomify.com/CVE-2018-12483/): Command injection in ocsinventory-ng:ocsinventory ng (high 8.8)
- [CVE-2018-12482](https://insights.sbomify.com/CVE-2018-12482/): SQL injection in ocsinventory-ng:ocsinventory ng (high 8.8)
- [CVE-2018-12481](https://insights.sbomify.com/CVE-2018-12481/): Information disclosure in the olive tree ftp server project:the olive tree ftp server (critical 9.8)
- [CVE-2018-12480](https://insights.sbomify.com/CVE-2018-12480/): NetIQ Access Manager XSS vulnerability in versions prior to 4.4 SP3 (medium 6.1)
- [CVE-2018-1248](https://insights.sbomify.com/CVE-2018-1248/): Open redirect in RSA Authentication Manager Security Console, Operation Console and Self-Service Console (medium 6.1)
- [CVE-2018-12479](https://insights.sbomify.com/CVE-2018-12479/): Request controller allows to create requests with arbitrary request IDs (medium 6.5)
- [CVE-2018-12478](https://insights.sbomify.com/CVE-2018-12478/): obs-service-replace_using_package_version allows to specify arbitrary input files (medium 4.8)
- [CVE-2018-12477](https://insights.sbomify.com/CVE-2018-12477/): obs-service-refresh_patches can be tricked into deleting '..' or other unrelated directories (low 3.5)
- [CVE-2018-12476](https://insights.sbomify.com/CVE-2018-12476/): obs-service-extract_file's outfilename parameter allows to write files outside of package directory (medium 4.3)
- [CVE-2018-12475](https://insights.sbomify.com/CVE-2018-12475/): obs-service-download_files allows downloading from localhost or intranet hosts (medium 6.5)
- [CVE-2018-12474](https://insights.sbomify.com/CVE-2018-12474/): Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm (medium 5.4)
- [CVE-2018-12473](https://insights.sbomify.com/CVE-2018-12473/): path traversal in obs-service-tar_scm (low 3.1)
- [CVE-2018-12472](https://insights.sbomify.com/CVE-2018-12472/): Authentication bypass in sibling check (high 7.3)
- [CVE-2018-12471](https://insights.sbomify.com/CVE-2018-12471/): External Entity processing in the RegistrationSharing module (medium 6.5)
- [CVE-2018-12470](https://insights.sbomify.com/CVE-2018-12470/): SQL injection in RegistrationSharing module (critical 9.8)
- [CVE-2018-1247](https://insights.sbomify.com/CVE-2018-1247/): XML external entity in RSA Authentication Manager Security Console (high 7.1)
- [CVE-2018-12469](https://insights.sbomify.com/CVE-2018-12469/): Null dereference in Micro Focus Enterprise Developer, Micro Focus Enterprise Server (high 7.5)
- [CVE-2018-12468](https://insights.sbomify.com/CVE-2018-12468/): Arbitrary File Upload in GroupWise Administration Console (critical 9.1)
- [CVE-2018-12467](https://insights.sbomify.com/CVE-2018-12467/): delete package via link exploit in open buildservice (medium 6.0)
- [CVE-2018-12466](https://insights.sbomify.com/CVE-2018-12466/): openbuildservice allowed deleting packages via project links (medium 4.4)
- [CVE-2018-12465](https://insights.sbomify.com/CVE-2018-12465/): Remote Code Execution in Micro Focus Secure Messaging Gateway (critical 9.1)
- [CVE-2018-12464](https://insights.sbomify.com/CVE-2018-12464/): Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway (critical 10.0)
- [CVE-2018-12463](https://insights.sbomify.com/CVE-2018-12463/): MFSBGN03811 rev.1 - Fortify Software Security Center (SSC), Multiple vulnerabilities (high 7.3)
- [CVE-2018-12462](https://insights.sbomify.com/CVE-2018-12462/): NetIQ iManager XSS vulnerabilities (medium 4.8)
- [CVE-2018-12461](https://insights.sbomify.com/CVE-2018-12461/): Certificate Revocation Check failure (low 3.5)
- [CVE-2018-12460](https://insights.sbomify.com/CVE-2018-12460/): Null dereference in ffmpeg:ffmpeg (medium 6.5)
- [CVE-2018-1246](https://insights.sbomify.com/CVE-2018-1246/): Cross-site scripting in Dell EMC Unity (medium 4.7)
- [CVE-2018-12459](https://insights.sbomify.com/CVE-2018-12459/): Denial of service in ffmpeg:ffmpeg (medium 6.5)
- [CVE-2018-12458](https://insights.sbomify.com/CVE-2018-12458/): Denial of service in debian:debian linux (medium 6.5)
- [CVE-2018-12457](https://insights.sbomify.com/CVE-2018-12457/): express-cart allows any user to create an admin user (high 8.8)
- [CVE-2018-12456](https://insights.sbomify.com/CVE-2018-12456/): Cross-site request forgery in intelbras:nplug firmware (high 8.8)
- [CVE-2018-12455](https://insights.sbomify.com/CVE-2018-12455/): Auth bypass in intelbras:nplug firmware (high 8.1)
- [CVE-2018-12454](https://insights.sbomify.com/CVE-2018-12454/): Weak cryptography in 1000guess:1000 guess (high 7.5)
- [CVE-2018-12453](https://insights.sbomify.com/CVE-2018-12453/): Memory corruption in redislabs:redis (high 7.5)
- [CVE-2018-1245](https://insights.sbomify.com/CVE-2018-1245/): Authorization ByPass Vulnerability (critical 9.0)
- [CVE-2018-12449](https://insights.sbomify.com/CVE-2018-12449/): Other in Whale Browser Installer (high 7.8)
- [CVE-2018-12448](https://insights.sbomify.com/CVE-2018-12448/): Security feature bypass in Whale Browser (medium 5.3)
- [CVE-2018-12447](https://insights.sbomify.com/CVE-2018-12447/): Integer overflow in libbpg project:libbpg (high 8.8)
- [CVE-2018-12446](https://insights.sbomify.com/CVE-2018-12446/): Auth bypass in dropbox:dropbox (low 3.6)
- [CVE-2018-12445](https://insights.sbomify.com/CVE-2018-12445/): Auth bypass in dropbox:dropbox (low 3.1)
- [CVE-2018-12441](https://insights.sbomify.com/CVE-2018-12441/): Misconfiguration in corsair:corsair utility engine (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/128/