# Vulnerabilities published in 2018


- [CVE-2018-1000636](https://insights.sbomify.com/CVE-2018-1000636/): Null dereference in jerryscript:jerryscript (medium 6.5)
- [CVE-2018-1000635](https://insights.sbomify.com/CVE-2018-1000635/): Information disclosure in openmicroscopy:omero (medium 6.7)
- [CVE-2018-1000634](https://insights.sbomify.com/CVE-2018-1000634/): Privilege escalation in openmicroscopy:omero (high 7.2)
- [CVE-2018-1000633](https://insights.sbomify.com/CVE-2018-1000633/): Information disclosure in openmicroscopy:omero (high 7.2)
- [CVE-2018-1000632](https://insights.sbomify.com/CVE-2018-1000632/): Dom4j contains a XML Injection vulnerability (high 7.5)
- [CVE-2018-1000631](https://insights.sbomify.com/CVE-2018-1000631/): SQL injection in battelle:v2i hub (critical 9.8)
- [CVE-2018-1000630](https://insights.sbomify.com/CVE-2018-1000630/): SQL injection in battelle:v2i hub (high 7.2)
- [CVE-2018-1000629](https://insights.sbomify.com/CVE-2018-1000629/): Cross-site scripting in battelle:v2i hub (medium 6.1)
- [CVE-2018-1000628](https://insights.sbomify.com/CVE-2018-1000628/): Auth bypass in battelle:v2i hub (critical 9.8)
- [CVE-2018-1000627](https://insights.sbomify.com/CVE-2018-1000627/): Information disclosure in battelle:v2i hub (critical 9.8)
- [CVE-2018-1000626](https://insights.sbomify.com/CVE-2018-1000626/): Hardcoded credentials in battelle:v2i hub (critical 9.8)
- [CVE-2018-1000625](https://insights.sbomify.com/CVE-2018-1000625/): Hardcoded credentials in battelle:v2i hub (critical 9.8)
- [CVE-2018-1000624](https://insights.sbomify.com/CVE-2018-1000624/): Missing authorization in battelle:v2i hub (high 7.5)
- [CVE-2018-1000623](https://insights.sbomify.com/CVE-2018-1000623/): Path traversal in jfrog:artifactory (high 7.2)
- [CVE-2018-1000622](https://insights.sbomify.com/CVE-2018-1000622/): Code injection in rust-lang:rust (high 7.8)
- [CVE-2018-1000621](https://insights.sbomify.com/CVE-2018-1000621/): Misconfiguration in mycroft:mycroft-core (high 8.1)
- [CVE-2018-1000620](https://insights.sbomify.com/CVE-2018-1000620/): Insufficient Entropy in cryptiles (critical 9.8)
- [CVE-2018-1000619](https://insights.sbomify.com/CVE-2018-1000619/): File upload in ovidentia:ovidentia (high 8.8)
- [CVE-2018-1000618](https://insights.sbomify.com/CVE-2018-1000618/): Denial of service in eosio project:eos (critical 9.8)
- [CVE-2018-1000617](https://insights.sbomify.com/CVE-2018-1000617/): Denial of service in atlassian:floodlight controller (high 7.5)
- [CVE-2018-1000616](https://insights.sbomify.com/CVE-2018-1000616/): XML external entity in onosproject:onos (critical 9.8)
- [CVE-2018-1000615](https://insights.sbomify.com/CVE-2018-1000615/): Denial of service in onosproject:onos (high 7.5)
- [CVE-2018-1000614](https://insights.sbomify.com/CVE-2018-1000614/): XML external entity in onosproject:onos (critical 9.8)
- [CVE-2018-1000613](https://insights.sbomify.com/CVE-2018-1000613/): Deserialization of Untrusted Data in Bouncy castle (critical 9.8)
- [CVE-2018-1000611](https://insights.sbomify.com/CVE-2018-1000611/): Cross-site scripting in openconext:openconext engineblock (medium 6.1)
- [CVE-2018-1000610](https://insights.sbomify.com/CVE-2018-1000610/): Jenkins Configuration as Code Plugin has Insufficiently Protected Credentials (high 8.8)
- [CVE-2018-1000609](https://insights.sbomify.com/CVE-2018-1000609/): Jenkins Configuration as Code Plugin vulnerable to Exposure of Sensitive Information (medium 6.5)
- [CVE-2018-1000608](https://insights.sbomify.com/CVE-2018-1000608/): Jenkins z/OS Connector Plugin allows local attacker to retrieve configured password (high 7.2)
- [CVE-2018-1000607](https://insights.sbomify.com/CVE-2018-1000607/): Arbitrary file write vulnerability in Jenkins Fortify CloudScan Plugin (medium 6.5)
- [CVE-2018-1000606](https://insights.sbomify.com/CVE-2018-1000606/): URLTrigger Plugin server-side request forgery vulnerability (medium 6.5)
- [CVE-2018-1000605](https://insights.sbomify.com/CVE-2018-1000605/): Jenkins CollabNet Plugin man in the middle vulnerability (high 7.4)
- [CVE-2018-1000604](https://insights.sbomify.com/CVE-2018-1000604/): Jenkins Badge Plugin cross-site scripting vulnerability (medium 5.4)
- [CVE-2018-1000603](https://insights.sbomify.com/CVE-2018-1000603/): CSRF vulnerability and missing permission checks in Openstack Cloud Plugin allowed capturing credentials (high 8.8)
- [CVE-2018-1000602](https://insights.sbomify.com/CVE-2018-1000602/): Jenkins SAML Plugin Session Fixation vulnerability (medium 5.9)
- [CVE-2018-1000601](https://insights.sbomify.com/CVE-2018-1000601/): Exposure of Sensitive Information to an Unauthorized Actor in Jenkins SSH Credentials Plugin (medium 6.5)
- [CVE-2018-1000600](https://insights.sbomify.com/CVE-2018-1000600/): CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials (high 8.8)
- [CVE-2018-1000559](https://insights.sbomify.com/CVE-2018-1000559/): Qutebrowser XSS Vulnerability (medium 6.1)
- [CVE-2018-1000558](https://insights.sbomify.com/CVE-2018-1000558/): SQL injection in ocsinventory-ng:ocsinventory ng (medium 6.5)
- [CVE-2018-1000557](https://insights.sbomify.com/CVE-2018-1000557/): Cross-site scripting in ocsinventory-ng:ocsinventory ng (medium 6.1)
- [CVE-2018-1000556](https://insights.sbomify.com/CVE-2018-1000556/): Cross-site scripting in veronalabs:wp statistics (medium 6.1)
- [CVE-2018-1000554](https://insights.sbomify.com/CVE-2018-1000554/): Weak cryptography in trovebox:trovebox (critical 9.8)
- [CVE-2018-1000553](https://insights.sbomify.com/CVE-2018-1000553/): Server-side request forgery in trovebox:trovebox (high 8.8)
- [CVE-2018-1000552](https://insights.sbomify.com/CVE-2018-1000552/): SQL injection in trovebox:trovebox (high 8.8)
- [CVE-2018-1000551](https://insights.sbomify.com/CVE-2018-1000551/): Auth bypass in trovebox:trovebox (high 8.8)
- [CVE-2018-1000550](https://insights.sbomify.com/CVE-2018-1000550/): Path traversal in debian:debian linux (critical 9.8)
- [CVE-2018-1000549](https://insights.sbomify.com/CVE-2018-1000549/): Information disclosure in wekan project:wekan (medium 5.3)
- [CVE-2018-1000548](https://insights.sbomify.com/CVE-2018-1000548/): XML external entity in umlet:umlet (high 7.8)
- [CVE-2018-1000547](https://insights.sbomify.com/CVE-2018-1000547/): Missing authorization in corebos:corebos (medium 5.3)
- [CVE-2018-1000546](https://insights.sbomify.com/CVE-2018-1000546/): XML external entity in triplea-game:triplea (high 7.8)
- [CVE-2018-1000544](https://insights.sbomify.com/CVE-2018-1000544/): Rubyzip gem contains a Directory Traversal vulnerability in zip file component (critical 9.8)
- [CVE-2018-1000543](https://insights.sbomify.com/CVE-2018-1000543/): Cross-site scripting in rockiger:akiee (medium 6.1)
- [CVE-2018-1000542](https://insights.sbomify.com/CVE-2018-1000542/): XML external entity in netbeans-mmd-plugin project:netbeans-mmd-plugin (high 7.8)
- [CVE-2018-1000540](https://insights.sbomify.com/CVE-2018-1000540/): XML external entity in loboevolution project:loboevolution (high 7.8)
- [CVE-2018-1000539](https://insights.sbomify.com/CVE-2018-1000539/): Json-jwt did not verify the cryptographic signature for data (medium 5.3)
- [CVE-2018-1000538](https://insights.sbomify.com/CVE-2018-1000538/): Denial of service in minio:minio (high 7.5)
- [CVE-2018-1000537](https://insights.sbomify.com/CVE-2018-1000537/): Memory corruption in marlinfw:marlin firmware (critical 9.8)
- [CVE-2018-1000536](https://insights.sbomify.com/CVE-2018-1000536/): Cross-site scripting in getmedis:medis (medium 6.1)
- [CVE-2018-1000535](https://insights.sbomify.com/CVE-2018-1000535/): Path traversal in lms:lms (high 7.5)
- [CVE-2018-1000534](https://insights.sbomify.com/CVE-2018-1000534/): Joplin Vulnerable to Cross-site Scripting in Note Content (medium 6.1)
- [CVE-2018-1000533](https://insights.sbomify.com/CVE-2018-1000533/): Command injection in gitlist:gitlist (critical 9.8)
- [CVE-2018-1000532](https://insights.sbomify.com/CVE-2018-1000532/): Path traversal in beep project:beep (medium 4.7)
- [CVE-2018-1000531](https://insights.sbomify.com/CVE-2018-1000531/): Security feature bypass in inversoft:prime-jwt (high 7.5)
- [CVE-2018-1000529](https://insights.sbomify.com/CVE-2018-1000529/): Stored Cross Site Scripting in Grails Fields Plugin (medium 6.1)
- [CVE-2018-1000528](https://insights.sbomify.com/CVE-2018-1000528/): Cross-site scripting in debian:debian linux (medium 6.1)
- [CVE-2018-1000527](https://insights.sbomify.com/CVE-2018-1000527/): Froxlor PHP Object Injection vulnerability (high 7.2)
- [CVE-2018-1000526](https://insights.sbomify.com/CVE-2018-1000526/): XML external entity in openpsa2:openpsa (high 7.5)
- [CVE-2018-1000525](https://insights.sbomify.com/CVE-2018-1000525/): Deserialization in openpsa2:openpsa (critical 9.8)
- [CVE-2018-1000524](https://insights.sbomify.com/CVE-2018-1000524/): Integer overflow in spheredev:minisphere (medium 5.5)
- [CVE-2018-1000523](https://insights.sbomify.com/CVE-2018-1000523/): Topydo Improper Input Validation vulnerability (high 8.1)
- [CVE-2018-1000521](https://insights.sbomify.com/CVE-2018-1000521/): Cross-site scripting in bigtreecms:bigtree cms (medium 6.1)
- [CVE-2018-1000520](https://insights.sbomify.com/CVE-2018-1000520/): Security feature bypass in arm:mbed tls (high 7.5)
- [CVE-2018-1000519](https://insights.sbomify.com/CVE-2018-1000519/): aiohttp-session Session Fixation vulnerability (medium 6.5)
- [CVE-2018-1000518](https://insights.sbomify.com/CVE-2018-1000518/): websockets is vulnerable to denial of service by memory exhaustion (high 7.5)
- [CVE-2018-1000517](https://insights.sbomify.com/CVE-2018-1000517/): Memory corruption in busybox:busybox (high 8.0)
- [CVE-2018-1000516](https://insights.sbomify.com/CVE-2018-1000516/): Galaxy cross-site scripting (XSS) (medium 6.1)
- [CVE-2018-1000515](https://insights.sbomify.com/CVE-2018-1000515/): XML external entity in news-articles project:news-articles (high 7.5)
- [CVE-2018-1000514](https://insights.sbomify.com/CVE-2018-1000514/): Cross-site request forgery in limesurvey:limesurvey (medium 4.3)
- [CVE-2018-1000513](https://insights.sbomify.com/CVE-2018-1000513/): Cross-site scripting in limesurvey:limesurvey (medium 4.8)
- [CVE-2018-1000512](https://insights.sbomify.com/CVE-2018-1000512/): Cross-site scripting in tooltipy project:tooltipy (medium 6.1)
- [CVE-2018-1000511](https://insights.sbomify.com/CVE-2018-1000511/): Missing authorization in wpulike:ulike (high 7.5)
- [CVE-2018-1000510](https://insights.sbomify.com/CVE-2018-1000510/): Missing authorization in silkypress:image zoom (medium 6.5)
- [CVE-2018-1000509](https://insights.sbomify.com/CVE-2018-1000509/): Deserialization in redirection:redirection (high 7.2)
- [CVE-2018-1000508](https://insights.sbomify.com/CVE-2018-1000508/): Cross-site scripting in wpulike:ulike (medium 4.8)
- [CVE-2018-1000507](https://insights.sbomify.com/CVE-2018-1000507/): Cross-site request forgery in jjj:wp user groups (medium 6.5)
- [CVE-2018-1000506](https://insights.sbomify.com/CVE-2018-1000506/): Cross-site request forgery in mediaron:metronet tag manager (high 8.8)
- [CVE-2018-1000505](https://insights.sbomify.com/CVE-2018-1000505/): Cross-site request forgery in tooltipy:tooltipy (medium 6.5)
- [CVE-2018-1000504](https://insights.sbomify.com/CVE-2018-1000504/): Code injection in redirection:redirection (high 7.2)
- [CVE-2018-1000503](https://insights.sbomify.com/CVE-2018-1000503/): Missing authorization in mybb:mybb (medium 4.3)
- [CVE-2018-1000502](https://insights.sbomify.com/CVE-2018-1000502/): Path traversal in mybb:mybb (high 7.2)
- [CVE-2018-1000501](https://insights.sbomify.com/CVE-2018-1000501/): Auth bypass in instant-update:instant update cms (critical 9.8)
- [CVE-2018-1000500](https://insights.sbomify.com/CVE-2018-1000500/): Security feature bypass in busybox:busybox (medium 6.5)
- [CVE-2018-1000426](https://insights.sbomify.com/CVE-2018-1000426/): Stored XSS vulnerability in Jenkins Git Changelog Plugin (medium 6.1)
- [CVE-2018-1000425](https://insights.sbomify.com/CVE-2018-1000425/): Jenkins SonarQube Scanner Plugin stored server authentication token in plain text (high 7.8)
- [CVE-2018-1000424](https://insights.sbomify.com/CVE-2018-1000424/): Jenkins Artifactory Plugin stored old directly entered credentials unencrypted on disk (high 7.8)
- [CVE-2018-1000423](https://insights.sbomify.com/CVE-2018-1000423/): Jenkins Crowd 2 Integration Plugin stored credentials in plain text (high 7.8)
- [CVE-2018-1000422](https://insights.sbomify.com/CVE-2018-1000422/): Jenkins Crowd 2 Integration Plugin server-side request forgery vulnerability (medium 6.5)
- [CVE-2018-1000421](https://insights.sbomify.com/CVE-2018-1000421/): Server-side request forgery vulnerability in Jenkins Mesos Plugin (medium 6.5)
- [CVE-2018-1000420](https://insights.sbomify.com/CVE-2018-1000420/): Improper authorization vulnerability in Jenkins Mesos Plugin (medium 6.5)
- [CVE-2018-1000419](https://insights.sbomify.com/CVE-2018-1000419/): Jenkins HipChat Plugin allows attackers with Overall/Read access to obtain credential IDs (medium 6.5)
- [CVE-2018-1000418](https://insights.sbomify.com/CVE-2018-1000418/): Jenkins HipChat Plugin allows credential capture due to incorrect authorization (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/151/