# Vulnerabilities published in 2018 - [CVE-2018-7993](https://insights.sbomify.com/CVE-2018-7993/): Use after free in HUAWEI Mate 10 (high 7.8) - [CVE-2018-7992](https://insights.sbomify.com/CVE-2018-7992/): Memory corruption in MediaPad M3; Mate 9 Pro; P10 Plus (medium 5.5) - [CVE-2018-7991](https://insights.sbomify.com/CVE-2018-7991/): Security feature bypass in Mate10 (medium 4.6) - [CVE-2018-7990](https://insights.sbomify.com/CVE-2018-7990/): Security feature bypass in Mate10 Pro (medium 4.6) - [CVE-2018-7989](https://insights.sbomify.com/CVE-2018-7989/): Auth bypass in Mate 10 pro (medium 4.6) - [CVE-2018-7988](https://insights.sbomify.com/CVE-2018-7988/): Auth bypass in Huawei nova 2 Plus, Huawei Mate9 Pro (medium 4.6) - [CVE-2018-7987](https://insights.sbomify.com/CVE-2018-7987/): Memory corruption in Huawei P20 (medium 5.9) - [CVE-2018-7977](https://insights.sbomify.com/CVE-2018-7977/): Information disclosure in FusionSphere OpenStack (high 7.5) - [CVE-2018-7976](https://insights.sbomify.com/CVE-2018-7976/): Cross-site scripting in eSpace Desktop (medium 5.4) - [CVE-2018-7961](https://insights.sbomify.com/CVE-2018-7961/): Information disclosure in Emily-AL00A (medium 6.5) - [CVE-2018-7960](https://insights.sbomify.com/CVE-2018-7960/): Information disclosure in eSpace 7950 (high 7.4) - [CVE-2018-7959](https://insights.sbomify.com/CVE-2018-7959/): Weak cryptography in eSpace 7950 (medium 5.9) - [CVE-2018-7958](https://insights.sbomify.com/CVE-2018-7958/): Security feature bypass in eSpace 7950 (high 7.4) - [CVE-2018-7957](https://insights.sbomify.com/CVE-2018-7957/): Missing authorization in Victoria-AL00 (low 3.3) - [CVE-2018-7956](https://insights.sbomify.com/CVE-2018-7956/): Huawei VIP App is a mobile app for Malaysia customers that purchased P20 Series, Nova 3/3i and Mate 20. (medium 5.3) - [CVE-2018-7951](https://insights.sbomify.com/CVE-2018-7951/): Code injection in 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3; CH121L V5 ; CH121 V5 ; CH140 V3; CH140L V3; CH220 V3; CH222 V3; CH242 V3; CH242 V5 ; RH1288 V3; RH2288 V3; RH2288H V3; XH310 V3; XH321 V3; XH321 V5; XH620 V3 (high 8.8) - [CVE-2018-7950](https://insights.sbomify.com/CVE-2018-7950/): Code injection in 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3; CH121L V5 ; CH121 V5 ; CH140 V3; CH140L V3; CH220 V3; CH222 V3; CH242 V3; CH242 V5 ; RH1288 V3; RH2288 V3; RH2288H V3; XH310 V3; XH321 V3; XH321 V5; XH620 V3 (high 8.8) - [CVE-2018-7949](https://insights.sbomify.com/CVE-2018-7949/): Privilege escalation in 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3; CH121L V5 ; CH121 V5 ; CH140 V3; CH140L V3; CH220 V3; CH222 V3; CH242 V3; CH242 V5 ; RH1288 V3; RH2288 V3; RH2288H V3; XH310 V3; XH321 V3; XH321 V5; XH620 V3 (high 8.8) - [CVE-2018-7947](https://insights.sbomify.com/CVE-2018-7947/): Auth bypass in Emily-AL00A (low 3.9) - [CVE-2018-7946](https://insights.sbomify.com/CVE-2018-7946/): Information disclosure in Huawei Honor 7A, Huawei Honor 9 Lite (medium 4.3) - [CVE-2018-7944](https://insights.sbomify.com/CVE-2018-7944/): Security feature bypass in Emily-AL00A (medium 6.8) - [CVE-2018-7943](https://insights.sbomify.com/CVE-2018-7943/): Auth bypass in 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3; CH121L V5 ; CH121 V5 ; CH140 V3; CH140L V3; CH220 V3; CH222 V3; CH242 V3; CH242 V5 ; RH1288 V3; RH2288 V3; RH2288H V3; XH310 V3; XH321 V3; XH321 V5; XH620 V3 (high 8.8) - [CVE-2018-7942](https://insights.sbomify.com/CVE-2018-7942/): Auth bypass in 1288H V5; 2288H V5; 2488 V5; CH121 V3; CH121L V3; CH121L V5; CH121 V5; CH140 V3; CH140L V3; CH220 V3; CH222 V3; CH242 V3; CH242 V5; RH1288 V3; RH2288 V3; RH2288H V3; XH310 V3; XH321 V3; XH321 V5; XH620 V3 (high 7.5) - [CVE-2018-7941](https://insights.sbomify.com/CVE-2018-7941/): Auth bypass in iBMC (high 8.8) - [CVE-2018-7940](https://insights.sbomify.com/CVE-2018-7940/): Auth bypass in HUAWEI Mate 10, HUAWEI Mate 10 Pro (medium 6.2) - [CVE-2018-7939](https://insights.sbomify.com/CVE-2018-7939/): Security feature bypass in G9 Lite, Honor 5A, Honor 6X, Honor 8 (medium 4.6) - [CVE-2018-7938](https://insights.sbomify.com/CVE-2018-7938/): Information disclosure in P10 (low 3.3) - [CVE-2018-7937](https://insights.sbomify.com/CVE-2018-7937/): Security feature bypass in HiRouter-CD20, WS5200-10 (high 7.8) - [CVE-2018-7936](https://insights.sbomify.com/CVE-2018-7936/): Security feature bypass in Mate 10 Pro (medium 4.6) - [CVE-2018-7935](https://insights.sbomify.com/CVE-2018-7935/): Denial of service in E5573Cs-322 (medium 5.3) - [CVE-2018-7934](https://insights.sbomify.com/CVE-2018-7934/): Denial of service in Mate 10 Pro (medium 5.5) - [CVE-2018-7933](https://insights.sbomify.com/CVE-2018-7933/): Path traversal in HiRouter-CD20, WS5200 (high 7.8) - [CVE-2018-7932](https://insights.sbomify.com/CVE-2018-7932/): Cross-site scripting in n/a (high 8.8) - [CVE-2018-7931](https://insights.sbomify.com/CVE-2018-7931/): Security feature bypass in AppGallery (medium 4.3) - [CVE-2018-7930](https://insights.sbomify.com/CVE-2018-7930/): Information disclosure in Mate 9 (medium 5.7) - [CVE-2018-7929](https://insights.sbomify.com/CVE-2018-7929/): Auth bypass in Mate RS (medium 6.8) - [CVE-2018-7928](https://insights.sbomify.com/CVE-2018-7928/): Security feature bypass in MyCloud (medium 4.6) - [CVE-2018-7926](https://insights.sbomify.com/CVE-2018-7926/): Missing authorization in Huawei Watch 2 (medium 4.6) - [CVE-2018-7925](https://insights.sbomify.com/CVE-2018-7925/): Auth bypass in Emily-AL00A (medium 6.8) - [CVE-2018-7924](https://insights.sbomify.com/CVE-2018-7924/): Information disclosure in Anne-AL00 (low 2.4) - [CVE-2018-7923](https://insights.sbomify.com/CVE-2018-7923/): Code injection in ALP-L09 (high 7.8) - [CVE-2018-7922](https://insights.sbomify.com/CVE-2018-7922/): Other in ALP-L09 (high 7.8) - [CVE-2018-7921](https://insights.sbomify.com/CVE-2018-7921/): Information disclosure in B315s-22 (medium 6.5) - [CVE-2018-7920](https://insights.sbomify.com/CVE-2018-7920/): Denial of service in AR1200, AR160, AR200, AR2200, AR3200 (high 7.5) - [CVE-2018-7911](https://insights.sbomify.com/CVE-2018-7911/): Security feature bypass in ALP-AL00B, ALP-AL00B-RSC, BLA-TL00B, Charlotte-AL00A, Emily-AL00A, (medium 4.6) - [CVE-2018-7910](https://insights.sbomify.com/CVE-2018-7910/): Auth bypass in ALP-AL00B, ALP-TL00B, BLA-AL00B, BLA-L09C, BLA-L29C (medium 6.8) - [CVE-2018-7907](https://insights.sbomify.com/CVE-2018-7907/): Information disclosure in Agassi-L09,Agassi-W09,Baggio2-U01A,Bond-AL00C,Bond-AL10B,Bond-TL10B,Bond-TL10C,Haydn-L1JB,Kobe-L09A,Kobe-L09AHN,Kobe-W09C,LelandP-L22C,LelandP-L22D,Rhone-AL00,Selina-L02,Stanford-L09S,Toronto-AL00,Toronto-AL00A,Toronto-TL10 (medium 5.5) - [CVE-2018-7906](https://insights.sbomify.com/CVE-2018-7906/): Denial of service in Leland-AL00, Leland-AL00A (medium 5.5) - [CVE-2018-7904](https://insights.sbomify.com/CVE-2018-7904/): Code injection in 1288H V5; 2288H V5 (high 8.8) - [CVE-2018-7903](https://insights.sbomify.com/CVE-2018-7903/): Code injection in 1288H V5; 2288H V5 (high 8.8) - [CVE-2018-7902](https://insights.sbomify.com/CVE-2018-7902/): Code injection in 1288H V5; 2288H V5 (high 8.8) - [CVE-2018-7901](https://insights.sbomify.com/CVE-2018-7901/): Security feature bypass in ALP-AL00B, BLA-AL00B (medium 4.4) - [CVE-2018-7900](https://insights.sbomify.com/CVE-2018-7900/): Information disclosure in some HG products (medium 6.5) - [CVE-2018-7899](https://insights.sbomify.com/CVE-2018-7899/): Use after free in Berkeley-AL20, Berkeley-BD (medium 5.5) - [CVE-2018-7894](https://insights.sbomify.com/CVE-2018-7894/): Cross-site scripting in n/a (medium 6.1) - [CVE-2018-7893](https://insights.sbomify.com/CVE-2018-7893/): Cross-site scripting in n/a (medium 4.8) - [CVE-2018-7891](https://insights.sbomify.com/CVE-2018-7891/): Deserialization in n/a (high 8.1) - [CVE-2018-7890](https://insights.sbomify.com/CVE-2018-7890/): Command injection in n/a (critical 9.8) - [CVE-2018-7889](https://insights.sbomify.com/CVE-2018-7889/): Deserialization in n/a (high 7.8) - [CVE-2018-7886](https://insights.sbomify.com/CVE-2018-7886/): Memory corruption in n/a (high 7.8) - [CVE-2018-7884](https://insights.sbomify.com/CVE-2018-7884/): Privilege escalation in n/a (high 7.8) - [CVE-2018-7877](https://insights.sbomify.com/CVE-2018-7877/): Memory corruption in n/a (medium 6.5) - [CVE-2018-7876](https://insights.sbomify.com/CVE-2018-7876/): Denial of service in n/a (medium 6.5) - [CVE-2018-7875](https://insights.sbomify.com/CVE-2018-7875/): Memory corruption in n/a (medium 6.5) - [CVE-2018-7874](https://insights.sbomify.com/CVE-2018-7874/): Null dereference in n/a (medium 6.5) - [CVE-2018-7873](https://insights.sbomify.com/CVE-2018-7873/): Memory corruption in n/a (medium 6.5) - [CVE-2018-7872](https://insights.sbomify.com/CVE-2018-7872/): Null dereference in n/a (medium 6.5) - [CVE-2018-7871](https://insights.sbomify.com/CVE-2018-7871/): Memory corruption in n/a (high 8.8) - [CVE-2018-7870](https://insights.sbomify.com/CVE-2018-7870/): Null dereference in n/a (medium 6.5) - [CVE-2018-7869](https://insights.sbomify.com/CVE-2018-7869/): Denial of service in n/a (high 7.5) - [CVE-2018-7868](https://insights.sbomify.com/CVE-2018-7868/): Memory corruption in n/a (medium 6.5) - [CVE-2018-7867](https://insights.sbomify.com/CVE-2018-7867/): Memory corruption in n/a (medium 6.5) - [CVE-2018-7866](https://insights.sbomify.com/CVE-2018-7866/): Null dereference in n/a (medium 6.5) - [CVE-2018-7859](https://insights.sbomify.com/CVE-2018-7859/): Cross-site scripting in n/a (medium 6.1) - [CVE-2018-7858](https://insights.sbomify.com/CVE-2018-7858/): Denial of service in n/a (medium 5.5) - [CVE-2018-7857](https://insights.sbomify.com/CVE-2018-7857/): Denial of service in Modicon M580 Modicon M340 Modicon Quantum Modicon Premium (high 7.5) - [CVE-2018-7856](https://insights.sbomify.com/CVE-2018-7856/): Denial of service in Modicon M580 Modicon M340 Modicon Quantum Modicon Premium (high 7.5) - [CVE-2018-7855](https://insights.sbomify.com/CVE-2018-7855/): Denial of service in Modicon M580 Modicon M340 Modicon Quantum Modicon Premium (high 7.5) - [CVE-2018-7854](https://insights.sbomify.com/CVE-2018-7854/): Denial of service in Modicon M580 Modicon M340 Modicon Quantum Modicon Premium (high 7.5) - [CVE-2018-7853](https://insights.sbomify.com/CVE-2018-7853/): Denial of service in Modicon M580 Modicon M340 Modicon Quantum Modicon Premium (high 7.5) - [CVE-2018-7852](https://insights.sbomify.com/CVE-2018-7852/): Denial of service in Modicon M580 Modicon M340 Modicon Quantum Modicon Premium (high 7.5) - [CVE-2018-7851](https://insights.sbomify.com/CVE-2018-7851/): Denial of service in Modicon M580 with firmware prior to V2.50 Modicon M340 with firmware prior to V3.01 BMxCRA312xx with firmware prior to V2.40 All firmware versions of Modicon Premium and 140CRA312xxx (medium 6.5) - [CVE-2018-7850](https://insights.sbomify.com/CVE-2018-7850/): Other in Modicon M580 Modicon M340 Modicon Quantum Modicon Premium (medium 5.3) - [CVE-2018-7849](https://insights.sbomify.com/CVE-2018-7849/): Denial of service in Modicon M580 Modicon M340 Modicon Quantum Modicon Premium (high 7.5) - [CVE-2018-7848](https://insights.sbomify.com/CVE-2018-7848/): Information disclosure in Modicon M580 Modicon M340 Modicon Quantum Modicon Premium (high 7.5) - [CVE-2018-7847](https://insights.sbomify.com/CVE-2018-7847/): Missing authorization in Modicon M580 Modicon M340 Modicon Quantum Modicon Premium (critical 9.8) - [CVE-2018-7846](https://insights.sbomify.com/CVE-2018-7846/): Auth bypass in Modicon M580 Modicon M340 Modicon Quantum Modicon Premium (critical 9.8) - [CVE-2018-7845](https://insights.sbomify.com/CVE-2018-7845/): Information disclosure in Modicon M580 Modicon M340 Modicon Quantum Modicon Premium (high 7.5) - [CVE-2018-7844](https://insights.sbomify.com/CVE-2018-7844/): Information disclosure in Modicon M580 Modicon M340 Modicon Quantum Modicon Premium (high 7.5) - [CVE-2018-7843](https://insights.sbomify.com/CVE-2018-7843/): Denial of service in Modicon M580 Modicon M340 Modicon Quantum Modicon Premium (high 7.5) - [CVE-2018-7842](https://insights.sbomify.com/CVE-2018-7842/): Auth bypass in Modicon M580 Modicon M340 Modicon Quantum Modicon Premium (critical 9.8) - [CVE-2018-7841](https://insights.sbomify.com/CVE-2018-7841/): Schneider Electric U.motion Builder SQL Injection (critical 9.8, exploited in the wild) - [CVE-2018-7840](https://insights.sbomify.com/CVE-2018-7840/): Other in VideoXpert OpsCenter versions prior to 3.1 (high 7.8) - [CVE-2018-7839](https://insights.sbomify.com/CVE-2018-7839/): Weak cryptography in IIoT Monitor 3.1.38 (medium 5.5) - [CVE-2018-7838](https://insights.sbomify.com/CVE-2018-7838/): Denial of service in Modicon M580 CPU - BMEP582040 all versions before V2.90 and Modicon Ethernet Module BMENOC0301 all versions before V2.16 (high 7.5) - [CVE-2018-7837](https://insights.sbomify.com/CVE-2018-7837/): XML external entity in IIoT Monitor 3.1.38 (high 7.5) - [CVE-2018-7836](https://insights.sbomify.com/CVE-2018-7836/): File upload in IIoT Monitor 3.1.38 (critical 9.8) - [CVE-2018-7835](https://insights.sbomify.com/CVE-2018-7835/): Path traversal in IIoT Monitor 3.1.38 (high 7.5) - [CVE-2018-7834](https://insights.sbomify.com/CVE-2018-7834/): Cross-site scripting in ConneXium Gateway, TSXETG100 - all versions (medium 6.1) - [CVE-2018-7833](https://insights.sbomify.com/CVE-2018-7833/): Denial of service in Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 (high 7.5) --- From sbomify Insights: https://insights.sbomify.com/years/2018/page/15/