# Vulnerabilities published in 2018


- [CVE-2018-1000417](https://insights.sbomify.com/CVE-2018-1000417/): CSRF vulnerability in Email Extension Template Plugin (high 8.1)
- [CVE-2018-1000416](https://insights.sbomify.com/CVE-2018-1000416/): Jenkins Job Config History Plugin reflected XSS vulnerability (medium 6.1)
- [CVE-2018-1000415](https://insights.sbomify.com/CVE-2018-1000415/): Cross-site Scripting in Jenkins Rebuilder Plugin (medium 5.4)
- [CVE-2018-1000414](https://insights.sbomify.com/CVE-2018-1000414/): CSRF vulnerability in Config File Provider Plugin (high 8.1)
- [CVE-2018-1000413](https://insights.sbomify.com/CVE-2018-1000413/): Stored XSS vulnerability in Config File Provider Plugin (medium 5.4)
- [CVE-2018-1000412](https://insights.sbomify.com/CVE-2018-1000412/): Jenkins Jira Plugin Incorrect Authorization vulnerability (high 8.8)
- [CVE-2018-1000411](https://insights.sbomify.com/CVE-2018-1000411/): Jenkins JUnit Plugin CSRF vulnerability (medium 6.5)
- [CVE-2018-1000410](https://insights.sbomify.com/CVE-2018-1000410/): Exposure of Sensitive Information to an Unauthorized Actor in Jenkins (high 7.8)
- [CVE-2018-1000409](https://insights.sbomify.com/CVE-2018-1000409/): Session Fixation in Jenkins (medium 5.4)
- [CVE-2018-1000408](https://insights.sbomify.com/CVE-2018-1000408/): Improper Authorization in Jenkins (medium 6.5)
- [CVE-2018-1000407](https://insights.sbomify.com/CVE-2018-1000407/): Cross-site Scripting in Jenkins (medium 6.1)
- [CVE-2018-1000406](https://insights.sbomify.com/CVE-2018-1000406/): Path Traversal in Jenkins (medium 6.5)
- [CVE-2018-1000404](https://insights.sbomify.com/CVE-2018-1000404/): Insufficiently Protected Credentials in Jenkins AWS CodeBuild Plugin (high 7.8)
- [CVE-2018-1000403](https://insights.sbomify.com/CVE-2018-1000403/): AWS CodeDeploy Plugin stored AWS Secret Key in plain text (high 7.8)
- [CVE-2018-1000402](https://insights.sbomify.com/CVE-2018-1000402/): Jenkins AWS CodeDeploy Plugin has Insufficiently Protected Credentials (medium 4.3)
- [CVE-2018-1000401](https://insights.sbomify.com/CVE-2018-1000401/): Jenkins AWS CodePipeline Plugin has Insufficiently Protected Credentials (high 7.8)
- [CVE-2018-1000400](https://insights.sbomify.com/CVE-2018-1000400/): Privilege escalation in kubernetes:cri-o (high 8.8)
- [CVE-2018-1000301](https://insights.sbomify.com/CVE-2018-1000301/): Memory corruption in canonical:ubuntu linux (critical 9.1)
- [CVE-2018-1000300](https://insights.sbomify.com/CVE-2018-1000300/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2018-1000226](https://insights.sbomify.com/CVE-2018-1000226/): Cobbler Improper Validation of Security Tokens (critical 9.8)
- [CVE-2018-1000225](https://insights.sbomify.com/CVE-2018-1000225/): Cobbler XSS Vulnerability (medium 6.1)
- [CVE-2018-1000224](https://insights.sbomify.com/CVE-2018-1000224/): Integer overflow in godotengine:godot (high 7.5)
- [CVE-2018-1000223](https://insights.sbomify.com/CVE-2018-1000223/): Memory corruption in surina:soundtouch (high 8.8)
- [CVE-2018-1000222](https://insights.sbomify.com/CVE-2018-1000222/): Memory corruption in canonical:ubuntu linux (high 8.8)
- [CVE-2018-1000221](https://insights.sbomify.com/CVE-2018-1000221/): Memory corruption in pkgconf:pkgconf (critical 9.8)
- [CVE-2018-1000219](https://insights.sbomify.com/CVE-2018-1000219/): Cross-site scripting in open-emr:openemr (medium 5.4)
- [CVE-2018-1000218](https://insights.sbomify.com/CVE-2018-1000218/): Cross-site scripting in open-emr:openemr (medium 5.4)
- [CVE-2018-1000217](https://insights.sbomify.com/CVE-2018-1000217/): Use after free in davegamble:cjson (critical 9.8)
- [CVE-2018-1000216](https://insights.sbomify.com/CVE-2018-1000216/): Memory corruption in davegamble:cjson (high 8.8)
- [CVE-2018-1000215](https://insights.sbomify.com/CVE-2018-1000215/): Denial of service in davegamble:cjson (high 7.5)
- [CVE-2018-1000211](https://insights.sbomify.com/CVE-2018-1000211/): Doorkeeper subject to Incorrect Permission Assignment (high 7.5)
- [CVE-2018-1000210](https://insights.sbomify.com/CVE-2018-1000210/): High severity vulnerability that affects YamlDotNet and YamlDotNet.Signed (high 7.8)
- [CVE-2018-1000209](https://insights.sbomify.com/CVE-2018-1000209/): Privilege escalation in sensu:sensu core (high 8.8)
- [CVE-2018-1000208](https://insights.sbomify.com/CVE-2018-1000208/): Path traversal in modx:modx revolution (high 7.5)
- [CVE-2018-1000207](https://insights.sbomify.com/CVE-2018-1000207/): MODX Revolution Incorrect Access Control vulnerability (high 7.2)
- [CVE-2018-1000206](https://insights.sbomify.com/CVE-2018-1000206/): Cross-site request forgery in jfrog:artifactory (high 8.8)
- [CVE-2018-1000205](https://insights.sbomify.com/CVE-2018-1000205/): Security feature bypass in denx:u-boot (medium 5.5)
- [CVE-2018-1000204](https://insights.sbomify.com/CVE-2018-1000204/): Information disclosure in canonical:ubuntu linux (medium 5.3)
- [CVE-2018-1000203](https://insights.sbomify.com/CVE-2018-1000203/): Supply chain in soarlabs:soarcoin (high 7.5)
- [CVE-2018-1000202](https://insights.sbomify.com/CVE-2018-1000202/): Jenkins Groovy Postbuild Plugin vulnerable to Cross-site Scripting (medium 5.4)
- [CVE-2018-1000201](https://insights.sbomify.com/CVE-2018-1000201/): Ruby-ffi has a DLL loading issue (high 7.8)
- [CVE-2018-1000200](https://insights.sbomify.com/CVE-2018-1000200/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2018-1000199](https://insights.sbomify.com/CVE-2018-1000199/): Memory corruption in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-1000198](https://insights.sbomify.com/CVE-2018-1000198/): XML External Entity processing vulnerability in Jenkins Black Duck Hub Plugin (medium 6.5)
- [CVE-2018-1000197](https://insights.sbomify.com/CVE-2018-1000197/): Jenkins Black Duck Hub Plugin allowed any user with Overall/Read to read and write its configuration (high 8.1)
- [CVE-2018-1000196](https://insights.sbomify.com/CVE-2018-1000196/): Jenkins Gitlab Hook Plugin stores and displays GitLab API token in plain text (medium 6.5)
- [CVE-2018-1000195](https://insights.sbomify.com/CVE-2018-1000195/): Cross-Site Request Forgery in Jenkins (medium 4.3)
- [CVE-2018-1000194](https://insights.sbomify.com/CVE-2018-1000194/): Path Traversal in Jenkins (high 8.1)
- [CVE-2018-1000193](https://insights.sbomify.com/CVE-2018-1000193/): Injection in Jenkins (medium 4.3)
- [CVE-2018-1000192](https://insights.sbomify.com/CVE-2018-1000192/): Exposure of Sensitive Information to an Unauthorized Actor in Jenkins (medium 4.3)
- [CVE-2018-1000191](https://insights.sbomify.com/CVE-2018-1000191/): Jenkins Black Duck Detect Plugin information exposure vulnerability (medium 6.5)
- [CVE-2018-1000190](https://insights.sbomify.com/CVE-2018-1000190/): Exposure of sensitive information vulnerability in Jenkins Black Duck Hub Plugin (medium 6.5)
- [CVE-2018-1000189](https://insights.sbomify.com/CVE-2018-1000189/): CSRF vulnerability and missing permission checks in Jenkins AbsInt Astrée Plugin (high 8.8)
- [CVE-2018-1000188](https://insights.sbomify.com/CVE-2018-1000188/): Jenkins CAS Plugin Server-Side Request Forgery vulnerability (medium 5.4)
- [CVE-2018-1000187](https://insights.sbomify.com/CVE-2018-1000187/): Exposure of Sensitive Information in Jenkins Kubernetes Plugin (medium 6.5)
- [CVE-2018-1000186](https://insights.sbomify.com/CVE-2018-1000186/): Jenkins GitHub Pull Request Builder Plugin credential capture vulnerability (medium 6.5)
- [CVE-2018-1000185](https://insights.sbomify.com/CVE-2018-1000185/): Jenkins GitHub Branch Source Plugin vulnerable to Server-Side Request Forgery (medium 4.3)
- [CVE-2018-1000184](https://insights.sbomify.com/CVE-2018-1000184/): Jenkins GitHub Plugin server-side request forgery vulnerability exists (medium 5.4)
- [CVE-2018-1000183](https://insights.sbomify.com/CVE-2018-1000183/): Jenkins GitHub Plugin exposure of sensitive information vulnerability exists (medium 6.5)
- [CVE-2018-1000182](https://insights.sbomify.com/CVE-2018-1000182/): Server-Side Request Forgery in Jenkins Git Plugin (medium 6.4)
- [CVE-2018-1000181](https://insights.sbomify.com/CVE-2018-1000181/): Information disclosure in ibm:kitura (high 7.5)
- [CVE-2018-1000180](https://insights.sbomify.com/CVE-2018-1000180/): Bouncy Castle has a flaw in the Low-level interface to RSA key pair generator (high 7.5)
- [CVE-2018-1000179](https://insights.sbomify.com/CVE-2018-1000179/): Null dereference in debian:debian linux (high 7.5)
- [CVE-2018-1000178](https://insights.sbomify.com/CVE-2018-1000178/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2018-1000177](https://insights.sbomify.com/CVE-2018-1000177/): Stored XSS vulnerability in Jenkins S3 Publisher Plugin (medium 5.4)
- [CVE-2018-1000176](https://insights.sbomify.com/CVE-2018-1000176/): Jenkins Email Extension Plugin showed plain text SMTP password in configuration form field (medium 6.5)
- [CVE-2018-1000175](https://insights.sbomify.com/CVE-2018-1000175/): Jenkins HTML Publisher Plugin path traversal vulnerability (medium 6.5)
- [CVE-2018-1000174](https://insights.sbomify.com/CVE-2018-1000174/): Jenkins Google Login Plugin Open Redirect vulnerability (medium 6.1)
- [CVE-2018-1000173](https://insights.sbomify.com/CVE-2018-1000173/): Jenkins Google Login Plugin Session Fixation vulnerability (medium 5.9)
- [CVE-2018-1000172](https://insights.sbomify.com/CVE-2018-1000172/): Cross-site scripting in imagely:nextgen gallery (medium 4.8)
- [CVE-2018-1000170](https://insights.sbomify.com/CVE-2018-1000170/): Cross-site Scripting in Jenkins Core (medium 5.4)
- [CVE-2018-1000169](https://insights.sbomify.com/CVE-2018-1000169/): Exposure of Sensitive Information to an Unauthorized Actor in Jenkins (medium 5.3)
- [CVE-2018-1000168](https://insights.sbomify.com/CVE-2018-1000168/): Null dereference in debian:debian linux (high 7.5)
- [CVE-2018-1000167](https://insights.sbomify.com/CVE-2018-1000167/): OISF suricata-update unsafely deserializes YAML data (high 7.8)
- [CVE-2018-1000165](https://insights.sbomify.com/CVE-2018-1000165/): LightSAML Incorrect Access Control vulnerability (high 7.5)
- [CVE-2018-1000164](https://insights.sbomify.com/CVE-2018-1000164/): Gunicorn contains Improper Neutralization of CRLF sequences in HTTP headers (high 7.5)
- [CVE-2018-1000163](https://insights.sbomify.com/CVE-2018-1000163/): Cross-site scripting in projectfloodlight:floodlight (medium 6.1)
- [CVE-2018-1000162](https://insights.sbomify.com/CVE-2018-1000162/): Cross-site Scripting in Parsedown (medium 6.1)
- [CVE-2018-1000161](https://insights.sbomify.com/CVE-2018-1000161/): Path traversal in nmap:nmap (medium 5.7)
- [CVE-2018-1000160](https://insights.sbomify.com/CVE-2018-1000160/): Cross-Site Scripting in @risingstack/protect (medium 6.1)
- [CVE-2018-1000159](https://insights.sbomify.com/CVE-2018-1000159/): tlslite-ng off-by-one error on mac checking (medium 5.9)
- [CVE-2018-1000158](https://insights.sbomify.com/CVE-2018-1000158/): Other in cmsmadesimple:cms made simple (high 8.8)
- [CVE-2018-1000156](https://insights.sbomify.com/CVE-2018-1000156/): Command injection in canonical:ubuntu linux (high 7.8)
- [CVE-2018-1000155](https://insights.sbomify.com/CVE-2018-1000155/): Missing authorization in opennetworking:openflow (critical 9.8)
- [CVE-2018-1000154](https://insights.sbomify.com/CVE-2018-1000154/): Cross-site scripting in zammad:zammad (medium 6.1)
- [CVE-2018-1000153](https://insights.sbomify.com/CVE-2018-1000153/): Jenkins vSphere Plugin Cross-Site Request Forgery vulnerability (high 8.8)
- [CVE-2018-1000152](https://insights.sbomify.com/CVE-2018-1000152/): Jenkins vSphere Plugin incorrect authorization vulnerability (medium 6.3)
- [CVE-2018-1000151](https://insights.sbomify.com/CVE-2018-1000151/): Jenkins vSphere Plugin disables SSL/TLS certificate validation by default (medium 5.6)
- [CVE-2018-1000150](https://insights.sbomify.com/CVE-2018-1000150/): Jenkins Reverse Proxy Auth Plugin allows attackers with local file system access to obtain a list of authorities for logged in users (low 3.3)
- [CVE-2018-1000149](https://insights.sbomify.com/CVE-2018-1000149/): Jenkins Ansible Plugin man in the middle vulnerability (medium 5.6)
- [CVE-2018-1000148](https://insights.sbomify.com/CVE-2018-1000148/): Jenkins Copy To Slave Plugin allows access to arbitrary files on the Jenkins controller file system (medium 6.5)
- [CVE-2018-1000147](https://insights.sbomify.com/CVE-2018-1000147/): Jenkins Perforce Plugin exposure of sensitive information vulnerability exists (medium 6.5)
- [CVE-2018-1000146](https://insights.sbomify.com/CVE-2018-1000146/): Liquibase Runner Plugin allows users to load arbitrary Java code into controller JVM (high 8.8)
- [CVE-2018-1000145](https://insights.sbomify.com/CVE-2018-1000145/): Jenkins Perforce Plugin uses ineffective credentials encryption (medium 6.5)
- [CVE-2018-1000144](https://insights.sbomify.com/CVE-2018-1000144/): Jenkins Cucumber Living Documentation Plugin Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2018-1000143](https://insights.sbomify.com/CVE-2018-1000143/): Jenkins GitHub Pull Request Builder Plugin (medium 6.7)
- [CVE-2018-1000142](https://insights.sbomify.com/CVE-2018-1000142/): Jenkins GitHub Pull Request Builder Plugin allows attacker with local file system access to obtain GitHub credentials (high 7.8)
- [CVE-2018-1000141](https://insights.sbomify.com/CVE-2018-1000141/): Missing authorization in scilico:i\, librarian (critical 9.1)
- [CVE-2018-1000140](https://insights.sbomify.com/CVE-2018-1000140/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2018-1000139](https://insights.sbomify.com/CVE-2018-1000139/): Cross-site scripting in scilico:i\, librarian (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/152/