# Vulnerabilities published in 2018


- [CVE-2018-1000871](https://insights.sbomify.com/CVE-2018-1000871/): SQL injection in digitaldruid:hoteldruid (critical 9.8)
- [CVE-2018-1000870](https://insights.sbomify.com/CVE-2018-1000870/): Cross-site scripting in phpipam:phpipam (medium 5.4)
- [CVE-2018-1000869](https://insights.sbomify.com/CVE-2018-1000869/): SQL injection in phpipam:phpipam (critical 9.8)
- [CVE-2018-1000868](https://insights.sbomify.com/CVE-2018-1000868/): Cross-site scripting in webidsupport:webid (medium 6.1)
- [CVE-2018-1000867](https://insights.sbomify.com/CVE-2018-1000867/): SQL injection in webidsupport:webid (high 8.8)
- [CVE-2018-1000866](https://insights.sbomify.com/CVE-2018-1000866/): Jenkins Script Security and Pipeline Groovy Plugins Sandbox Bypass (high 8.8)
- [CVE-2018-1000865](https://insights.sbomify.com/CVE-2018-1000865/): Improper Privilege Management in Jenkins (high 8.8)
- [CVE-2018-1000864](https://insights.sbomify.com/CVE-2018-1000864/): Loop with Unreachable Exit Condition in Jenkins (medium 6.5)
- [CVE-2018-1000863](https://insights.sbomify.com/CVE-2018-1000863/): Improper Limitation of a Pathname to a Restricted Directory in Jenkins (high 8.2)
- [CVE-2018-1000862](https://insights.sbomify.com/CVE-2018-1000862/): Exposure of Sensitive Information to an Unauthorized Actor in Jenkins (medium 4.3)
- [CVE-2018-1000861](https://insights.sbomify.com/CVE-2018-1000861/): Jenkins Stapler Web Framework Deserialization of Untrusted Data (critical 9.8, exploited in the wild)
- [CVE-2018-1000860](https://insights.sbomify.com/CVE-2018-1000860/): Cross-site scripting in phpipam:phpipam (medium 4.7)
- [CVE-2018-1000858](https://insights.sbomify.com/CVE-2018-1000858/): Cross-site request forgery in canonical:ubuntu linux (high 8.8)
- [CVE-2018-1000857](https://insights.sbomify.com/CVE-2018-1000857/): Path traversal in open-systems:log-user-session (high 8.8)
- [CVE-2018-1000856](https://insights.sbomify.com/CVE-2018-1000856/): Cross-site scripting in domainmod:domainmod (medium 4.8)
- [CVE-2018-1000855](https://insights.sbomify.com/CVE-2018-1000855/): Cross Site Scripting (XSS) vulnerability in easymon (medium 6.1)
- [CVE-2018-1000854](https://insights.sbomify.com/CVE-2018-1000854/): Remote Code Execution in esigate-core (critical 9.8)
- [CVE-2018-1000852](https://insights.sbomify.com/CVE-2018-1000852/): Memory corruption in canonical:ubuntu linux (medium 6.5)
- [CVE-2018-1000851](https://insights.sbomify.com/CVE-2018-1000851/): Information disclosure in copay:copay bitcoin wallet (critical 9.8)
- [CVE-2018-1000850](https://insights.sbomify.com/CVE-2018-1000850/): Directory Traversal vulnerability in Square Retrofit (high 7.5)
- [CVE-2018-1000849](https://insights.sbomify.com/CVE-2018-1000849/): Path traversal in alpinelinux:alpine linux (high 8.8)
- [CVE-2018-1000848](https://insights.sbomify.com/CVE-2018-1000848/): Cross-site scripting in wampserver:wampserver (medium 6.1)
- [CVE-2018-1000847](https://insights.sbomify.com/CVE-2018-1000847/): Cross-site scripting in freshdns project:freshdns (medium 5.4)
- [CVE-2018-1000846](https://insights.sbomify.com/CVE-2018-1000846/): Cross-site request forgery in freshdns project:freshdns (high 8.8)
- [CVE-2018-1000844](https://insights.sbomify.com/CVE-2018-1000844/): XML External Entity (XXE) vulnerability in Square Retrofit (critical 9.1)
- [CVE-2018-1000843](https://insights.sbomify.com/CVE-2018-1000843/): Cross-Site Request Forgery (CSRF) in Luigi (high 8.8)
- [CVE-2018-1000842](https://insights.sbomify.com/CVE-2018-1000842/): Fat Free CRM vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2018-1000841](https://insights.sbomify.com/CVE-2018-1000841/): Cross-site scripting in zend:zendto (medium 6.1)
- [CVE-2018-1000840](https://insights.sbomify.com/CVE-2018-1000840/): XML external entity in processing:processing (medium 6.5)
- [CVE-2018-1000839](https://insights.sbomify.com/CVE-2018-1000839/): File upload in librehealth:librehealth ehr (high 8.8)
- [CVE-2018-1000838](https://insights.sbomify.com/CVE-2018-1000838/): XML external entity in sleuthkit:autopsy (critical 10.0)
- [CVE-2018-1000837](https://insights.sbomify.com/CVE-2018-1000837/): XML external entity in obeo:uml designer (critical 10.0)
- [CVE-2018-1000836](https://insights.sbomify.com/CVE-2018-1000836/): XML External Entity (XXE) vulnerability in bw-calendar-engine (critical 9.0)
- [CVE-2018-1000835](https://insights.sbomify.com/CVE-2018-1000835/): XML external entity in keepassdx:keepass dx (critical 10.0)
- [CVE-2018-1000834](https://insights.sbomify.com/CVE-2018-1000834/): XML external entity in runelite:runelite (critical 9.0)
- [CVE-2018-1000833](https://insights.sbomify.com/CVE-2018-1000833/): Deserialization in zoneminder:zoneminder (critical 9.8)
- [CVE-2018-1000832](https://insights.sbomify.com/CVE-2018-1000832/): Deserialization in zoneminder:zoneminder (critical 9.8)
- [CVE-2018-1000831](https://insights.sbomify.com/CVE-2018-1000831/): XML external entity in k9mail:k-9 mail (critical 10.0)
- [CVE-2018-1000830](https://insights.sbomify.com/CVE-2018-1000830/): XML external entity in xr3player project:xr3player (critical 10.0)
- [CVE-2018-1000829](https://insights.sbomify.com/CVE-2018-1000829/): XML external entity in anyplace project:anyplace (critical 9.0)
- [CVE-2018-1000828](https://insights.sbomify.com/CVE-2018-1000828/): XML external entity in frostwire:frostwire (critical 9.0)
- [CVE-2018-1000827](https://insights.sbomify.com/CVE-2018-1000827/): Deserialization in ubilling:ubilling (critical 9.8)
- [CVE-2018-1000826](https://insights.sbomify.com/CVE-2018-1000826/): Microweber XSS Vulnerability (medium 6.1)
- [CVE-2018-1000825](https://insights.sbomify.com/CVE-2018-1000825/): XML external entity in freecol:freecol (critical 10.0)
- [CVE-2018-1000824](https://insights.sbomify.com/CVE-2018-1000824/): Deserialization in megamek:megamek (critical 9.8)
- [CVE-2018-1000823](https://insights.sbomify.com/CVE-2018-1000823/): exist-db:exist-core XML External Entity (XXE) vulnerability (critical 10.0)
- [CVE-2018-1000822](https://insights.sbomify.com/CVE-2018-1000822/): XML External Entity (XXE) vulnerability in codelibs fess (critical 10.0)
- [CVE-2018-1000821](https://insights.sbomify.com/CVE-2018-1000821/): XML external entity in micromathematics project:micromathematics (critical 10.0)
- [CVE-2018-1000820](https://insights.sbomify.com/CVE-2018-1000820/): XML External Entity (XXE) vulnerability in neo4j.procedure:apoc (critical 10.0)
- [CVE-2018-1000817](https://insights.sbomify.com/CVE-2018-1000817/): Asset Pipeline Grails Plugin vulnerable to Path Traversal (high 7.5)
- [CVE-2018-1000816](https://insights.sbomify.com/CVE-2018-1000816/): Grafana XSS Vulnerability (medium 5.4)
- [CVE-2018-1000815](https://insights.sbomify.com/CVE-2018-1000815/): Security feature bypass in brave:brave (medium 4.3)
- [CVE-2018-1000814](https://insights.sbomify.com/CVE-2018-1000814/): aiohttp-session creates non-expiring sessions (medium 6.5)
- [CVE-2018-1000813](https://insights.sbomify.com/CVE-2018-1000813/): Cross-site scripting in backdropcms:backdrop cms (medium 4.8)
- [CVE-2018-1000812](https://insights.sbomify.com/CVE-2018-1000812/): Auth bypass in artica:integria ims (high 8.1)
- [CVE-2018-1000811](https://insights.sbomify.com/CVE-2018-1000811/): File upload in bludit:bludit (high 8.8)
- [CVE-2018-1000810](https://insights.sbomify.com/CVE-2018-1000810/): Integer overflow in rust-lang:rust (critical 9.8)
- [CVE-2018-1000809](https://insights.sbomify.com/CVE-2018-1000809/): privacyIDEA Improper Input Validation vulnerability (high 7.5)
- [CVE-2018-1000808](https://insights.sbomify.com/CVE-2018-1000808/): Pyopenssl Incorrect Memory Management (medium 5.9)
- [CVE-2018-1000807](https://insights.sbomify.com/CVE-2018-1000807/): PyOpenSSL Use-After-Free vulnerability (high 8.1)
- [CVE-2018-1000805](https://insights.sbomify.com/CVE-2018-1000805/): Paramiko Authentication Bypass vulnerability (high 8.8)
- [CVE-2018-1000804](https://insights.sbomify.com/CVE-2018-1000804/): Memory corruption in contiki-ng:contiki-ng (critical 9.8)
- [CVE-2018-1000803](https://insights.sbomify.com/CVE-2018-1000803/): Gitea Exposes Private Email Addresses (medium 5.3)
- [CVE-2018-1000802](https://insights.sbomify.com/CVE-2018-1000802/): Command injection in canonical:ubuntu linux (critical 9.8)
- [CVE-2018-1000801](https://insights.sbomify.com/CVE-2018-1000801/): Path traversal in debian:debian linux (medium 5.5)
- [CVE-2018-1000800](https://insights.sbomify.com/CVE-2018-1000800/): Null dereference in zephyrproject:zephyr (critical 9.8)
- [CVE-2018-1000773](https://insights.sbomify.com/CVE-2018-1000773/): Code injection in wordpress:wordpress (high 8.8)
- [CVE-2018-1000671](https://insights.sbomify.com/CVE-2018-1000671/): Open redirect in debian:debian linux (medium 6.1)
- [CVE-2018-1000670](https://insights.sbomify.com/CVE-2018-1000670/): Cross-site scripting in koha:koha (medium 6.1)
- [CVE-2018-1000669](https://insights.sbomify.com/CVE-2018-1000669/): Cross-site request forgery in koha:koha (high 8.8)
- [CVE-2018-1000668](https://insights.sbomify.com/CVE-2018-1000668/): Memory corruption in jsish:jsish (medium 6.5)
- [CVE-2018-1000667](https://insights.sbomify.com/CVE-2018-1000667/): Memory corruption in nasm:netwide assembler (medium 5.5)
- [CVE-2018-1000666](https://insights.sbomify.com/CVE-2018-1000666/): Command injection in gig:jumpscale (critical 9.8)
- [CVE-2018-1000665](https://insights.sbomify.com/CVE-2018-1000665/): Improper Neutralization of Input During Web Page Generation in Dojo Dojo Objective Harness (medium 6.1)
- [CVE-2018-1000664](https://insights.sbomify.com/CVE-2018-1000664/): Security feature bypass in dsub for subsonic project:dsub for subsonic (medium 5.9)
- [CVE-2018-1000663](https://insights.sbomify.com/CVE-2018-1000663/): Memory corruption in jsish:jsish (medium 6.5)
- [CVE-2018-1000661](https://insights.sbomify.com/CVE-2018-1000661/): Null dereference in jsish:jsish (medium 6.5)
- [CVE-2018-1000660](https://insights.sbomify.com/CVE-2018-1000660/): Memory corruption in tockos:tock (high 7.5)
- [CVE-2018-1000659](https://insights.sbomify.com/CVE-2018-1000659/): Path traversal in limesurvey:limesurvey (high 8.8)
- [CVE-2018-1000658](https://insights.sbomify.com/CVE-2018-1000658/): File upload in limesurvey:limesurvey (high 8.8)
- [CVE-2018-1000657](https://insights.sbomify.com/CVE-2018-1000657/): Memory corruption in rust-lang:rust (high 7.8)
- [CVE-2018-1000656](https://insights.sbomify.com/CVE-2018-1000656/): Flask is vulnerable to Denial of Service via incorrect encoding of JSON data (high 7.5)
- [CVE-2018-1000655](https://insights.sbomify.com/CVE-2018-1000655/): Null dereference in jsish:jsish (medium 6.5)
- [CVE-2018-1000654](https://insights.sbomify.com/CVE-2018-1000654/): Denial of service in gnu:libtasn1 (medium 5.5)
- [CVE-2018-1000653](https://insights.sbomify.com/CVE-2018-1000653/): SQL injection in zzcms:zzcms (critical 9.8)
- [CVE-2018-1000652](https://insights.sbomify.com/CVE-2018-1000652/): XML external entity in jabref:jabref (critical 10.0)
- [CVE-2018-1000651](https://insights.sbomify.com/CVE-2018-1000651/): XML external entity in gchq:stroom (critical 10.0)
- [CVE-2018-1000650](https://insights.sbomify.com/CVE-2018-1000650/): SQL injection in librehealth:librehealth ehr (high 8.8)
- [CVE-2018-1000649](https://insights.sbomify.com/CVE-2018-1000649/): File upload in librehealth:librehealth ehr (high 8.8)
- [CVE-2018-1000648](https://insights.sbomify.com/CVE-2018-1000648/): File upload in librehealth:librehealth ehr (high 8.8)
- [CVE-2018-1000647](https://insights.sbomify.com/CVE-2018-1000647/): Path traversal in librehealth:librehealth ehr (high 7.1)
- [CVE-2018-1000646](https://insights.sbomify.com/CVE-2018-1000646/): File upload in librehealth:librehealth ehr (high 8.8)
- [CVE-2018-1000645](https://insights.sbomify.com/CVE-2018-1000645/): Path traversal in librehealth:librehealth ehr (medium 6.5)
- [CVE-2018-1000644](https://insights.sbomify.com/CVE-2018-1000644/): Eclipse RDF4j vulnerable to XML External Entity (critical 10.0)
- [CVE-2018-1000642](https://insights.sbomify.com/CVE-2018-1000642/): Cross-site scripting in flightairmap:flightairmap (medium 6.1)
- [CVE-2018-1000641](https://insights.sbomify.com/CVE-2018-1000641/): Deserialization in yeswiki:yeswiki (critical 9.8)
- [CVE-2018-1000640](https://insights.sbomify.com/CVE-2018-1000640/): OpenCart-Overclocked Cross-site Scripting Vulnerability (medium 6.1)
- [CVE-2018-1000639](https://insights.sbomify.com/CVE-2018-1000639/): XML external entity in latexdraw project:latexdraw (critical 9.6)
- [CVE-2018-1000638](https://insights.sbomify.com/CVE-2018-1000638/): Cross-site scripting in 1234n:minicms (medium 6.1)
- [CVE-2018-1000637](https://insights.sbomify.com/CVE-2018-1000637/): Memory corruption in debian:debian linux (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/150/