# Vulnerabilities published in 2018


- [CVE-2018-10083](https://insights.sbomify.com/CVE-2018-10083/): Path traversal in cmsmadesimple:cms made simple (high 7.5)
- [CVE-2018-10082](https://insights.sbomify.com/CVE-2018-10082/): Information disclosure in cmsmadesimple:cms made simple (medium 5.3)
- [CVE-2018-10081](https://insights.sbomify.com/CVE-2018-10081/): Auth bypass in cmsmadesimple:cms made simple (critical 9.8)
- [CVE-2018-10080](https://insights.sbomify.com/CVE-2018-10080/): Auth bypass in secutech project:ris-11 firmware (high 8.6)
- [CVE-2018-1008](https://insights.sbomify.com/CVE-2018-1008/): Memory corruption in Windows 10 (high 7.0)
- [CVE-2018-10079](https://insights.sbomify.com/CVE-2018-10079/): Misconfiguration in vertiv:watchdog console (high 7.8)
- [CVE-2018-10078](https://insights.sbomify.com/CVE-2018-10078/): Cross-site scripting in vertiv:watchdog console (medium 4.8)
- [CVE-2018-10077](https://insights.sbomify.com/CVE-2018-10077/): XML external entity in vertiv:watchdog console (medium 4.9)
- [CVE-2018-10076](https://insights.sbomify.com/CVE-2018-10076/): Cross-site scripting in zohocorp:manageengine eventlog analyzer (medium 6.1)
- [CVE-2018-10075](https://insights.sbomify.com/CVE-2018-10075/): Cross-site scripting in zohocorp:manageengine eventlog analyzer (medium 6.1)
- [CVE-2018-10074](https://insights.sbomify.com/CVE-2018-10074/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2018-10073](https://insights.sbomify.com/CVE-2018-10073/): Cross-site scripting in joyplus-cms project:joyplus-cms (medium 4.8)
- [CVE-2018-10072](https://insights.sbomify.com/CVE-2018-10072/): Denial of service in jungo:windriver (medium 5.5)
- [CVE-2018-10071](https://insights.sbomify.com/CVE-2018-10071/): Denial of service in jungo:windriver (medium 5.5)
- [CVE-2018-10070](https://insights.sbomify.com/CVE-2018-10070/): Denial of service in mikrotik:router firmware (high 7.5)
- [CVE-2018-1007](https://insights.sbomify.com/CVE-2018-1007/): Information disclosure in Microsoft Office (medium 5.3)
- [CVE-2018-10068](https://insights.sbomify.com/CVE-2018-10068/): Cross-site scripting in jdownloads:jdownloads (medium 6.1)
- [CVE-2018-10066](https://insights.sbomify.com/CVE-2018-10066/): Security feature bypass in mikrotik:routeros (high 8.1)
- [CVE-2018-10063](https://insights.sbomify.com/CVE-2018-10063/): Code injection in convert forms project:convert forms (high 7.8)
- [CVE-2018-10061](https://insights.sbomify.com/CVE-2018-10061/): Cross-site scripting in cacti:cacti (medium 5.4)
- [CVE-2018-10060](https://insights.sbomify.com/CVE-2018-10060/): Cross-site scripting in cacti:cacti (medium 5.4)
- [CVE-2018-10059](https://insights.sbomify.com/CVE-2018-10059/): Cross-site scripting in cacti:cacti (medium 5.4)
- [CVE-2018-10058](https://insights.sbomify.com/CVE-2018-10058/): Memory corruption in bfgminer:bfgminer (high 8.8)
- [CVE-2018-10057](https://insights.sbomify.com/CVE-2018-10057/): Path traversal in bfgminer:bfgminer (medium 6.5)
- [CVE-2018-10055](https://insights.sbomify.com/CVE-2018-10055/): Improper Restriction of Operations within the Bounds of a Memory Buffer in Google TensorFlow (high 8.1)
- [CVE-2018-10054](https://insights.sbomify.com/CVE-2018-10054/): Improper Input Validation in Datomic (high 8.8)
- [CVE-2018-10052](https://insights.sbomify.com/CVE-2018-10052/): Cross-site scripting in iscripts:supportdesk (medium 4.8)
- [CVE-2018-10051](https://insights.sbomify.com/CVE-2018-10051/): Cross-site scripting in iscripts:supportdesk (medium 5.4)
- [CVE-2018-10050](https://insights.sbomify.com/CVE-2018-10050/): SQL injection in iscripts:eswap (high 7.2)
- [CVE-2018-1005](https://insights.sbomify.com/CVE-2018-1005/): Cross-site scripting in Microsoft SharePoint (medium 5.4)
- [CVE-2018-10049](https://insights.sbomify.com/CVE-2018-10049/): Cross-site scripting in iscripts:eswap (medium 4.8)
- [CVE-2018-10048](https://insights.sbomify.com/CVE-2018-10048/): Cross-site request forgery in iscripts:eswap (high 8.8)
- [CVE-2018-1004](https://insights.sbomify.com/CVE-2018-1004/): Memory corruption in Internet Explorer 9 (high 8.8)
- [CVE-2018-10033](https://insights.sbomify.com/CVE-2018-10033/): Cross-site scripting in cmsmadesimple:cms made simple (medium 4.8)
- [CVE-2018-10032](https://insights.sbomify.com/CVE-2018-10032/): Cross-site scripting in cmsmadesimple:cms made simple (medium 4.8)
- [CVE-2018-10031](https://insights.sbomify.com/CVE-2018-10031/): Cross-site request forgery in cmsmadesimple:cms made simple (high 8.8)
- [CVE-2018-10030](https://insights.sbomify.com/CVE-2018-10030/): Cross-site request forgery in cmsmadesimple:cms made simple (high 8.8)
- [CVE-2018-1003](https://insights.sbomify.com/CVE-2018-1003/): Memory corruption in Windows 10 (high 7.8)
- [CVE-2018-10029](https://insights.sbomify.com/CVE-2018-10029/): Cross-site scripting in cmsmadesimple:cms made simple (medium 4.8)
- [CVE-2018-10028](https://insights.sbomify.com/CVE-2018-10028/): Information disclosure in joyplus-cms project:joyplus-cms (medium 5.3)
- [CVE-2018-10027](https://insights.sbomify.com/CVE-2018-10027/): Code injection in estsoft:alzip (high 7.8)
- [CVE-2018-10026](https://insights.sbomify.com/CVE-2018-10026/): Cross-site scripting in yzmcms:yzmcms (medium 4.8)
- [CVE-2018-10024](https://insights.sbomify.com/CVE-2018-10024/): Information disclosure in ubiquoss:vp5208a firmware (critical 9.8)
- [CVE-2018-10023](https://insights.sbomify.com/CVE-2018-10023/): Cross-site scripting in catfish-cms:catfish cms (medium 5.4)
- [CVE-2018-1002209](https://insights.sbomify.com/CVE-2018-1002209/): Path traversal in quazip (medium 5.5)
- [CVE-2018-1002208](https://insights.sbomify.com/CVE-2018-1002208/): Improper Limitation of a Pathname to a Restricted Directory in SharpZipLib (medium 5.5)
- [CVE-2018-1002207](https://insights.sbomify.com/CVE-2018-1002207/): Arbitrary File Write via Archive Extraction in mholt/archiver (medium 5.5)
- [CVE-2018-1002206](https://insights.sbomify.com/CVE-2018-1002206/): Directory Traversal in SharpCompress (medium 5.5)
- [CVE-2018-1002205](https://insights.sbomify.com/CVE-2018-1002205/): DotNetZip Zip-Slip Vulnerability (medium 5.5)
- [CVE-2018-1002204](https://insights.sbomify.com/CVE-2018-1002204/): Arbitrary File Write in adm-zip (medium 5.5)
- [CVE-2018-1002203](https://insights.sbomify.com/CVE-2018-1002203/): Arbitrary File Write via Archive Extraction in unzipper (medium 5.5)
- [CVE-2018-1002202](https://insights.sbomify.com/CVE-2018-1002202/): Improper Limitation of a Pathname to a Restricted Directory in Zip4j (medium 6.5)
- [CVE-2018-1002201](https://insights.sbomify.com/CVE-2018-1002201/): Improper Limitation of a Pathname to a Restricted Directory in zt-zip (medium 5.5)
- [CVE-2018-1002200](https://insights.sbomify.com/CVE-2018-1002200/): Improper Limitation of a Pathname to a Restricted Directory in plexus-archiver (medium 5.5)
- [CVE-2018-1002150](https://insights.sbomify.com/CVE-2018-1002150/): Koji hub call does not perform correct access checks (critical 9.1)
- [CVE-2018-1002105](https://insights.sbomify.com/CVE-2018-1002105/): Privilege Escalation in Kubernetes (critical 9.8)
- [CVE-2018-1002104](https://insights.sbomify.com/CVE-2018-1002104/): Kubernetes ingress exposes sensitive information (medium 5.3)
- [CVE-2018-1002103](https://insights.sbomify.com/CVE-2018-1002103/): Minikube RCE via DNS Rebinding (high 8.1)
- [CVE-2018-1002102](https://insights.sbomify.com/CVE-2018-1002102/): Kubernetes API server follows unvalidated redirects from streaming Kubelet endpoints (low 2.6)
- [CVE-2018-1002101](https://insights.sbomify.com/CVE-2018-1002101/): Kubernetes Arbitrary Command Injection (medium 5.9)
- [CVE-2018-1002100](https://insights.sbomify.com/CVE-2018-1002100/): Kubernetes arbitrary file overwrite (medium 4.2)
- [CVE-2018-10021](https://insights.sbomify.com/CVE-2018-10021/): Denial of service in linux:linux kernel (medium 5.5)
- [CVE-2018-1002009](https://insights.sbomify.com/CVE-2018-1002009/): Cross-site scripting in Arigato Autoresponder and Newsletter (medium 4.8)
- [CVE-2018-1002008](https://insights.sbomify.com/CVE-2018-1002008/): Cross-site scripting in Arigato Autoresponder and Newsletter (medium 4.8)
- [CVE-2018-1002007](https://insights.sbomify.com/CVE-2018-1002007/): Cross-site scripting in Arigato Autoresponder and Newsletter (medium 4.8)
- [CVE-2018-1002006](https://insights.sbomify.com/CVE-2018-1002006/): Cross-site scripting in Arigato Autoresponder and Newsletter (medium 4.8)
- [CVE-2018-1002005](https://insights.sbomify.com/CVE-2018-1002005/): Cross-site scripting in Arigato Autoresponder and Newsletter (medium 4.8)
- [CVE-2018-1002004](https://insights.sbomify.com/CVE-2018-1002004/): Cross-site scripting in Arigato Autoresponder and Newsletter (medium 4.8)
- [CVE-2018-1002003](https://insights.sbomify.com/CVE-2018-1002003/): Cross-site scripting in Arigato Autoresponder and Newsletter (medium 4.8)
- [CVE-2018-1002002](https://insights.sbomify.com/CVE-2018-1002002/): Cross-site scripting in Arigato Autoresponder and Newsletter (medium 4.8)
- [CVE-2018-1002001](https://insights.sbomify.com/CVE-2018-1002001/): Cross-site scripting in Arigato Autoresponder and Newsletter (medium 4.8)
- [CVE-2018-1002000](https://insights.sbomify.com/CVE-2018-1002000/): SQL injection in Arigato Autoresponder and Newsletter (high 7.2)
- [CVE-2018-10018](https://insights.sbomify.com/CVE-2018-10018/): Memory corruption in gdata-software:total security (high 8.8)
- [CVE-2018-10017](https://insights.sbomify.com/CVE-2018-10017/): Memory corruption in openmpt:libopenmpt (medium 6.5)
- [CVE-2018-10016](https://insights.sbomify.com/CVE-2018-10016/): Denial of service in nasm:netwide assembler (medium 5.5)
- [CVE-2018-1001](https://insights.sbomify.com/CVE-2018-1001/): Memory corruption in Internet Explorer 10 (high 7.5)
- [CVE-2018-1000998](https://insights.sbomify.com/CVE-2018-1000998/): Cross-site scripting in freebsd:cvsweb (medium 6.1)
- [CVE-2018-1000997](https://insights.sbomify.com/CVE-2018-1000997/): Improper Limitation of a Pathname to a Restricted Directory in Jenkins (medium 6.5)
- [CVE-2018-1000893](https://insights.sbomify.com/CVE-2018-1000893/): Denial of service in bitcoinsv:bitcoin sv (high 7.5)
- [CVE-2018-1000892](https://insights.sbomify.com/CVE-2018-1000892/): Denial of service in bitcoinsv:bitcoin sv (high 7.5)
- [CVE-2018-1000891](https://insights.sbomify.com/CVE-2018-1000891/): Denial of service in bitcoinsv:bitcoin sv (high 7.5)
- [CVE-2018-1000890](https://insights.sbomify.com/CVE-2018-1000890/): SQL injection in frontaccounting:frontaccounting (high 7.5)
- [CVE-2018-1000889](https://insights.sbomify.com/CVE-2018-1000889/): XML external entity in logisim-evolution project:logisim-evolution (high 8.8)
- [CVE-2018-1000888](https://insights.sbomify.com/CVE-2018-1000888/): Archive_Tar contains Potential RCE if filename starts with phar:// (high 8.8)
- [CVE-2018-1000887](https://insights.sbomify.com/CVE-2018-1000887/): Cross-site scripting in peel:peel shopping (medium 4.8)
- [CVE-2018-1000886](https://insights.sbomify.com/CVE-2018-1000886/): Memory corruption in nasm:netwide assembler (medium 5.5)
- [CVE-2018-1000885](https://insights.sbomify.com/CVE-2018-1000885/): Command injection in phkp project:phkp (critical 9.8)
- [CVE-2018-1000884](https://insights.sbomify.com/CVE-2018-1000884/): Information disclosure in vestacp:vesta control panel (critical 9.8)
- [CVE-2018-1000883](https://insights.sbomify.com/CVE-2018-1000883/): Header Injection (medium 6.5)
- [CVE-2018-1000882](https://insights.sbomify.com/CVE-2018-1000882/): Path traversal in webidsupport:webid (high 7.5)
- [CVE-2018-1000881](https://insights.sbomify.com/CVE-2018-1000881/): Code injection in traccar:server (critical 9.8)
- [CVE-2018-1000880](https://insights.sbomify.com/CVE-2018-1000880/): Denial of service in canonical:ubuntu linux (medium 6.5)
- [CVE-2018-1000879](https://insights.sbomify.com/CVE-2018-1000879/): Null dereference in fedoraproject:fedora (medium 6.5)
- [CVE-2018-1000878](https://insights.sbomify.com/CVE-2018-1000878/): Use after free in canonical:ubuntu linux (high 8.8)
- [CVE-2018-1000877](https://insights.sbomify.com/CVE-2018-1000877/): Memory corruption in canonical:ubuntu linux (high 8.8)
- [CVE-2018-1000876](https://insights.sbomify.com/CVE-2018-1000876/): Integer overflow in canonical:ubuntu linux (high 7.8)
- [CVE-2018-1000875](https://insights.sbomify.com/CVE-2018-1000875/): Auth bypass in universityofcalifornia:boinc server (critical 9.8)
- [CVE-2018-1000874](https://insights.sbomify.com/CVE-2018-1000874/): Cross-site scripting in cebe:markdown (medium 6.1)
- [CVE-2018-1000873](https://insights.sbomify.com/CVE-2018-1000873/): Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353 (medium 6.5)
- [CVE-2018-1000872](https://insights.sbomify.com/CVE-2018-1000872/): PyKMIP Denial of service vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/149/