# Vulnerabilities published in 2018


- [CVE-2018-11495](https://insights.sbomify.com/CVE-2018-11495/): OpenCart Path Traversal (medium 4.9)
- [CVE-2018-11494](https://insights.sbomify.com/CVE-2018-11494/): OpenCart Path Traversal (high 8.0)
- [CVE-2018-11493](https://insights.sbomify.com/CVE-2018-11493/): Cross-site request forgery in wuzhicms:wuzhicms (high 8.8)
- [CVE-2018-11492](https://insights.sbomify.com/CVE-2018-11492/): Denial of service in asus:hg100 firmware (high 7.5)
- [CVE-2018-11491](https://insights.sbomify.com/CVE-2018-11491/): Auth bypass in asus:hg100 firmware (critical 9.8)
- [CVE-2018-11490](https://insights.sbomify.com/CVE-2018-11490/): Memory corruption in canonical:ubuntu linux (high 8.8)
- [CVE-2018-1149](https://insights.sbomify.com/CVE-2018-1149/): Memory corruption in NUUO NVRMini2 (critical 9.8)
- [CVE-2018-11489](https://insights.sbomify.com/CVE-2018-11489/): Memory corruption in giflib project:giflib (high 8.8)
- [CVE-2018-11488](https://insights.sbomify.com/CVE-2018-11488/): Denial of service in dtsearch:dtsearch (high 7.5)
- [CVE-2018-11487](https://insights.sbomify.com/CVE-2018-11487/): Cross-site scripting in phpmywind:phpmywind (medium 6.1)
- [CVE-2018-11486](https://insights.sbomify.com/CVE-2018-11486/): Cross-site scripting in multidots:advance search for woocommerce (medium 6.1)
- [CVE-2018-11485](https://insights.sbomify.com/CVE-2018-11485/): Cross-site scripting in multidots:woocommerce quick reports (medium 6.1)
- [CVE-2018-11482](https://insights.sbomify.com/CVE-2018-11482/): Hardcoded credentials in tp-link:ipc tl-ipc223\(p\)-6 firmware (critical 9.8)
- [CVE-2018-11481](https://insights.sbomify.com/CVE-2018-11481/): Code injection in tp-link:ipc tl-ipc223\(p\)-6 firmware (high 8.8)
- [CVE-2018-1148](https://insights.sbomify.com/CVE-2018-1148/): Auth bypass in Tenable Nessus (medium 6.5)
- [CVE-2018-11479](https://insights.sbomify.com/CVE-2018-11479/): Privilege escalation in windscribe:windscribe (high 7.8)
- [CVE-2018-11478](https://insights.sbomify.com/CVE-2018-11478/): Auth bypass in vgate:icar 2 wi-fi obd2 firmware (high 8.8)
- [CVE-2018-11477](https://insights.sbomify.com/CVE-2018-11477/): Information disclosure in vgate:icar 2 wi-fi obd2 firmware (medium 6.5)
- [CVE-2018-11476](https://insights.sbomify.com/CVE-2018-11476/): Auth bypass in vgate:icar 2 wi-fi obd2 firmware (high 8.8)
- [CVE-2018-11475](https://insights.sbomify.com/CVE-2018-11475/): Auth bypass in monstra:monstra (high 8.0)
- [CVE-2018-11474](https://insights.sbomify.com/CVE-2018-11474/): Auth bypass in monstra:monstra (high 8.0)
- [CVE-2018-11473](https://insights.sbomify.com/CVE-2018-11473/): Cross-site scripting in monstra:monstra (medium 6.1)
- [CVE-2018-11472](https://insights.sbomify.com/CVE-2018-11472/): Cross-site scripting in monstra:monstra (medium 6.1)
- [CVE-2018-11471](https://insights.sbomify.com/CVE-2018-11471/): Cross-site scripting in getcockpit:cockpit (medium 5.4)
- [CVE-2018-11470](https://insights.sbomify.com/CVE-2018-11470/): SQL injection in iscripts:eswap (high 8.8)
- [CVE-2018-1147](https://insights.sbomify.com/CVE-2018-1147/): Cross-site scripting in Tenable Nessus (medium 5.4)
- [CVE-2018-11469](https://insights.sbomify.com/CVE-2018-11469/): Information disclosure in canonical:ubuntu linux (medium 5.9)
- [CVE-2018-11468](https://insights.sbomify.com/CVE-2018-11468/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2018-11466](https://insights.sbomify.com/CVE-2018-11466/): Other in SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8 (critical 9.8)
- [CVE-2018-11465](https://insights.sbomify.com/CVE-2018-11465/): Memory corruption in SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8 (high 7.8)
- [CVE-2018-11464](https://insights.sbomify.com/CVE-2018-11464/): Denial of service in SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8 (low 3.7)
- [CVE-2018-11463](https://insights.sbomify.com/CVE-2018-11463/): Memory corruption in SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8 (high 7.8)
- [CVE-2018-11462](https://insights.sbomify.com/CVE-2018-11462/): Privilege escalation in SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8 (critical 9.8)
- [CVE-2018-11461](https://insights.sbomify.com/CVE-2018-11461/): Privilege escalation in SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8 (medium 6.6)
- [CVE-2018-11460](https://insights.sbomify.com/CVE-2018-11460/): Privilege escalation in SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8 (high 7.8)
- [CVE-2018-1146](https://insights.sbomify.com/CVE-2018-1146/): Auth bypass in N750 DB Wi-Fi Dual-Band N+ Gigabit Router (F9K1103) (high 7.5)
- [CVE-2018-11459](https://insights.sbomify.com/CVE-2018-11459/): Privilege escalation in SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8 (high 7.8)
- [CVE-2018-11458](https://insights.sbomify.com/CVE-2018-11458/): Integer overflow in SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8 (high 8.1)
- [CVE-2018-11457](https://insights.sbomify.com/CVE-2018-11457/): Memory corruption in SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8 (high 8.1)
- [CVE-2018-11456](https://insights.sbomify.com/CVE-2018-11456/): Server-side request forgery in Automation License Manager 5 (medium 5.8)
- [CVE-2018-11455](https://insights.sbomify.com/CVE-2018-11455/): Path traversal in Automation License Manager 5, Automation License Manager 6 (high 8.8)
- [CVE-2018-11454](https://insights.sbomify.com/CVE-2018-11454/): Misconfiguration in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12, SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V13, SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V14, SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V15 (high 8.6)
- [CVE-2018-11453](https://insights.sbomify.com/CVE-2018-11453/): Misconfiguration in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12, SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V13, SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V14, SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V15 (high 7.8)
- [CVE-2018-11452](https://insights.sbomify.com/CVE-2018-11452/): Denial of service in Firmware variant DNP3 TCP for EN100 Ethernet module (high 7.5)
- [CVE-2018-11451](https://insights.sbomify.com/CVE-2018-11451/): Denial of service in Firmware variant DNP3 TCP for EN100 Ethernet module (high 7.5)
- [CVE-2018-11450](https://insights.sbomify.com/CVE-2018-11450/): Cross-site scripting in Siemens PLM Software TEAMCENTER (medium 6.1)
- [CVE-2018-1145](https://insights.sbomify.com/CVE-2018-1145/): Memory corruption in N750 DB Wi-Fi Dual-Band N+ Gigabit Router (F9K1103) (critical 9.8)
- [CVE-2018-11449](https://insights.sbomify.com/CVE-2018-11449/): Information disclosure in SCALANCE M875 (high 7.8)
- [CVE-2018-11448](https://insights.sbomify.com/CVE-2018-11448/): Cross-site scripting in SCALANCE M875 (medium 4.8)
- [CVE-2018-11447](https://insights.sbomify.com/CVE-2018-11447/): Cross-site request forgery in SCALANCE M875 (high 8.8)
- [CVE-2018-11446](https://insights.sbomify.com/CVE-2018-11446/): Integer overflow in gold reward project:gold reward (high 7.5)
- [CVE-2018-11445](https://insights.sbomify.com/CVE-2018-11445/): Cross-site request forgery in easyservice billing project:easyservice billing (high 8.8)
- [CVE-2018-11444](https://insights.sbomify.com/CVE-2018-11444/): SQL injection in easyservice billing project:easyservice billing (critical 9.8)
- [CVE-2018-11443](https://insights.sbomify.com/CVE-2018-11443/): Cross-site scripting in easyservice billing project:easyservice billing (medium 6.1)
- [CVE-2018-11442](https://insights.sbomify.com/CVE-2018-11442/): Cross-site request forgery in easyservice billing project:easyservice billing (high 8.8)
- [CVE-2018-11440](https://insights.sbomify.com/CVE-2018-11440/): Memory corruption in canonical:ubuntu linux (high 8.8)
- [CVE-2018-1144](https://insights.sbomify.com/CVE-2018-1144/): Command injection in N750 DB Wi-Fi Dual-Band N+ Gigabit Router (F9K1103) (critical 9.8)
- [CVE-2018-11439](https://insights.sbomify.com/CVE-2018-11439/): Memory corruption in debian:debian linux (medium 6.5)
- [CVE-2018-11438](https://insights.sbomify.com/CVE-2018-11438/): Memory corruption in libmobi project:libmobi (high 8.8)
- [CVE-2018-11437](https://insights.sbomify.com/CVE-2018-11437/): Information disclosure in libmobi project:libmobi (medium 6.5)
- [CVE-2018-11436](https://insights.sbomify.com/CVE-2018-11436/): Memory corruption in libmobi project:libmobi (medium 6.5)
- [CVE-2018-11435](https://insights.sbomify.com/CVE-2018-11435/): Information disclosure in libmobi project:libmobi (medium 6.5)
- [CVE-2018-11434](https://insights.sbomify.com/CVE-2018-11434/): Memory corruption in libmobi project:libmobi (medium 6.5)
- [CVE-2018-11433](https://insights.sbomify.com/CVE-2018-11433/): Memory corruption in libmobi project:libmobi (medium 6.5)
- [CVE-2018-11432](https://insights.sbomify.com/CVE-2018-11432/): Memory corruption in libmobi project:libmobi (medium 6.5)
- [CVE-2018-11430](https://insights.sbomify.com/CVE-2018-11430/): Cross-site scripting in moderator log notes project:moderator log notes (medium 5.4)
- [CVE-2018-1143](https://insights.sbomify.com/CVE-2018-1143/): Command injection in N750 DB Wi-Fi Dual-Band N+ Gigabit Router (F9K1103) (critical 9.8)
- [CVE-2018-11429](https://insights.sbomify.com/CVE-2018-11429/): Integer overflow in atlant:atlant (high 7.5)
- [CVE-2018-11427](https://insights.sbomify.com/CVE-2018-11427/): Cross-site request forgery in moxa:oncell g3150-hspa-t firmware (high 8.8)
- [CVE-2018-11426](https://insights.sbomify.com/CVE-2018-11426/): Auth bypass in moxa:oncell g3150-hspa-t firmware (critical 9.8)
- [CVE-2018-11425](https://insights.sbomify.com/CVE-2018-11425/): Memory corruption in moxa:oncell g3470a-lte-eu-t firmware (critical 9.8)
- [CVE-2018-11424](https://insights.sbomify.com/CVE-2018-11424/): Memory corruption in moxa:oncell g3470a-lte-eu-t firmware (high 7.5)
- [CVE-2018-11423](https://insights.sbomify.com/CVE-2018-11423/): Memory corruption in moxa:oncell g3150-hspa-t firmware (high 7.5)
- [CVE-2018-11422](https://insights.sbomify.com/CVE-2018-11422/): Auth bypass in moxa:oncell g3150-hspa-t firmware (critical 9.8)
- [CVE-2018-11421](https://insights.sbomify.com/CVE-2018-11421/): Information disclosure in moxa:oncell g3150-hspa-t firmware (critical 9.8)
- [CVE-2018-11420](https://insights.sbomify.com/CVE-2018-11420/): Memory corruption in moxa:oncell g3150-hspa-t firmware (critical 9.8)
- [CVE-2018-1142](https://insights.sbomify.com/CVE-2018-1142/): Cross-site scripting in Tenable Appliance (medium 5.4)
- [CVE-2018-11419](https://insights.sbomify.com/CVE-2018-11419/): Memory corruption in jerryscript:jerryscript (critical 9.8)
- [CVE-2018-11418](https://insights.sbomify.com/CVE-2018-11418/): Memory corruption in jerryscript:jerryscript (critical 9.8)
- [CVE-2018-11416](https://insights.sbomify.com/CVE-2018-11416/): Memory corruption in jpegoptim project:jpegoptim (high 8.8)
- [CVE-2018-11415](https://insights.sbomify.com/CVE-2018-11415/): Cross-site scripting in sap:internet transaction server (medium 6.1)
- [CVE-2018-11414](https://insights.sbomify.com/CVE-2018-11414/): SQL injection in bearadmin project:bearadmin (high 8.8)
- [CVE-2018-11413](https://insights.sbomify.com/CVE-2018-11413/): Path traversal in bearadmin project:bearadmin (medium 6.5)
- [CVE-2018-11412](https://insights.sbomify.com/CVE-2018-11412/): Memory corruption in canonical:ubuntu linux (medium 5.9)
- [CVE-2018-11411](https://insights.sbomify.com/CVE-2018-11411/): Business logic in dimoncoin:dimoncoin (high 7.5)
- [CVE-2018-11410](https://insights.sbomify.com/CVE-2018-11410/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2018-1141](https://insights.sbomify.com/CVE-2018-1141/): Misconfiguration in Nessus (high 7.0)
- [CVE-2018-11409](https://insights.sbomify.com/CVE-2018-11409/): Information disclosure in splunk:splunk (medium 5.3)
- [CVE-2018-11408](https://insights.sbomify.com/CVE-2018-11408/): Symfony Open Redirect (medium 6.1)
- [CVE-2018-11407](https://insights.sbomify.com/CVE-2018-11407/): Symfony Authentication Bypass (critical 9.8)
- [CVE-2018-11406](https://insights.sbomify.com/CVE-2018-11406/): Symfony CSRF Token Fixation (high 8.8)
- [CVE-2018-11405](https://insights.sbomify.com/CVE-2018-11405/): Cross-site request forgery in kliqqi:kliqqi cms (high 8.8)
- [CVE-2018-11404](https://insights.sbomify.com/CVE-2018-11404/): Cross-site scripting in domainmod:domainmod (medium 6.1)
- [CVE-2018-11403](https://insights.sbomify.com/CVE-2018-11403/): Cross-site scripting in domainmod:domainmod (medium 5.4)
- [CVE-2018-11402](https://insights.sbomify.com/CVE-2018-11402/): Information disclosure in simplisafe:u9k-kp1000 firmware (medium 6.6)
- [CVE-2018-11401](https://insights.sbomify.com/CVE-2018-11401/): Security feature bypass in simplisafe:u9k-bs1000 firmware (medium 4.6)
- [CVE-2018-11400](https://insights.sbomify.com/CVE-2018-11400/): Security feature bypass in simplisafe:u9k-bs1000 firmware (medium 4.6)
- [CVE-2018-1140](https://insights.sbomify.com/CVE-2018-1140/): Denial of service in samba (medium 6.5)
- [CVE-2018-11399](https://insights.sbomify.com/CVE-2018-11399/): Information disclosure in simplisafe:u9k-es1000 firmware (medium 4.3)
- [CVE-2018-11396](https://insights.sbomify.com/CVE-2018-11396/): Null dereference in gnome:epiphany (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/137/