# Vulnerabilities published in 2018


- [CVE-2018-1000138](https://insights.sbomify.com/CVE-2018-1000138/): Server-side request forgery in scilico:i\, librarian (critical 9.1)
- [CVE-2018-1000137](https://insights.sbomify.com/CVE-2018-1000137/): Cross-site request forgery in scilico:i\, librarian (high 8.8)
- [CVE-2018-1000136](https://insights.sbomify.com/CVE-2018-1000136/): Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration (high 8.1)
- [CVE-2018-1000135](https://insights.sbomify.com/CVE-2018-1000135/): Information disclosure in canonical:ubuntu linux (high 7.5)
- [CVE-2018-1000134](https://insights.sbomify.com/CVE-2018-1000134/): Weak Password Requirements in UnboundID LDAP SDK (critical 9.8)
- [CVE-2018-1000133](https://insights.sbomify.com/CVE-2018-1000133/): Privilege escalation in secluded:trident (high 7.5)
- [CVE-2018-1000132](https://insights.sbomify.com/CVE-2018-1000132/): Mercurial Incorrect Access Control vulnerability (critical 9.1)
- [CVE-2018-1000131](https://insights.sbomify.com/CVE-2018-1000131/): SQL injection in wpsupportplus:wp support plus responsive ticket system (critical 9.8)
- [CVE-2018-1000130](https://insights.sbomify.com/CVE-2018-1000130/): Injection in Jolokia agent (high 8.1)
- [CVE-2018-1000129](https://insights.sbomify.com/CVE-2018-1000129/): Cross-site Scripting in Jolokia agent (medium 6.1)
- [CVE-2018-1000127](https://insights.sbomify.com/CVE-2018-1000127/): Integer overflow in canonical:ubuntu linux (high 7.5)
- [CVE-2018-1000126](https://insights.sbomify.com/CVE-2018-1000126/): Information disclosure in ajenti:ajenti (high 7.5)
- [CVE-2018-1000125](https://insights.sbomify.com/CVE-2018-1000125/): Security feature bypass in inversoft:prime-jwt (critical 9.8)
- [CVE-2018-1000124](https://insights.sbomify.com/CVE-2018-1000124/): XML external entity in scilico:i\, librarian (critical 10.0)
- [CVE-2018-1000123](https://insights.sbomify.com/CVE-2018-1000123/): Information disclosure in ionicframework:ios keychain (critical 9.8)
- [CVE-2018-1000122](https://insights.sbomify.com/CVE-2018-1000122/): Memory corruption in canonical:ubuntu linux (critical 9.1)
- [CVE-2018-1000121](https://insights.sbomify.com/CVE-2018-1000121/): Null dereference in canonical:ubuntu linux (high 7.5)
- [CVE-2018-1000120](https://insights.sbomify.com/CVE-2018-1000120/): curl FTP path confusion leads to NIL byte out of bounds write (critical 9.8)
- [CVE-2018-1000119](https://insights.sbomify.com/CVE-2018-1000119/): rack-protection gem timing attack vulnerability when validating CSRF token (medium 5.9)
- [CVE-2018-1000118](https://insights.sbomify.com/CVE-2018-1000118/): Electron protocol handler browser vulnerable to Command Injection (high 8.8)
- [CVE-2018-1000117](https://insights.sbomify.com/CVE-2018-1000117/): Memory corruption in python:python (medium 6.7)
- [CVE-2018-1000116](https://insights.sbomify.com/CVE-2018-1000116/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2018-1000115](https://insights.sbomify.com/CVE-2018-1000115/): Denial of service in canonical:ubuntu linux (high 7.5)
- [CVE-2018-1000114](https://insights.sbomify.com/CVE-2018-1000114/): Jenkins Promoted Builds Plugin allowed unauthorized users to run some promotion processes (medium 4.3)
- [CVE-2018-1000113](https://insights.sbomify.com/CVE-2018-1000113/): Stored cross-site scripting vulnerability in Jenkins TestLink Plugin (medium 5.4)
- [CVE-2018-1000112](https://insights.sbomify.com/CVE-2018-1000112/): Incorrect Authorization in Jenkins Mercurial Plugin (medium 5.3)
- [CVE-2018-1000111](https://insights.sbomify.com/CVE-2018-1000111/): Jenkins Subversion Plugin Incorrect Authorization vulnerability (medium 5.3)
- [CVE-2018-1000110](https://insights.sbomify.com/CVE-2018-1000110/): Incorrect Authorization in Jenkins Git Plugin (medium 5.3)
- [CVE-2018-1000109](https://insights.sbomify.com/CVE-2018-1000109/): Jenkins Google Play Android Publisher Plugin allows attacker to obtain credential IDs (medium 4.3)
- [CVE-2018-1000108](https://insights.sbomify.com/CVE-2018-1000108/): Reflected cross-site-scripting vulnerability in report URL of Jenkins CppNCSS Plugin (medium 6.1)
- [CVE-2018-1000107](https://insights.sbomify.com/CVE-2018-1000107/): Improper authorization in Jenkins Job and Node Ownership Plugin (medium 6.5)
- [CVE-2018-1000106](https://insights.sbomify.com/CVE-2018-1000106/): Incorrect Authorization in Jenkins Gerrit Trigger Plugin (medium 5.4)
- [CVE-2018-1000105](https://insights.sbomify.com/CVE-2018-1000105/): Incorrect Authorization in Jenkins Gerrit Trigger Plugin (medium 4.3)
- [CVE-2018-1000104](https://insights.sbomify.com/CVE-2018-1000104/): Jenkins Coverity Plugin has Insufficiently Protected Credentials (high 7.8)
- [CVE-2018-1000101](https://insights.sbomify.com/CVE-2018-1000101/): Memory corruption in mingw-w64:mingw-w64 (critical 9.8)
- [CVE-2018-1000100](https://insights.sbomify.com/CVE-2018-1000100/): Memory corruption in canonical:ubuntu linux (high 7.8)
- [CVE-2018-10001](https://insights.sbomify.com/CVE-2018-10001/): Memory corruption in debian:debian linux (medium 6.5)
- [CVE-2018-1000099](https://insights.sbomify.com/CVE-2018-1000099/): Null dereference in debian:debian linux (high 7.5)
- [CVE-2018-1000098](https://insights.sbomify.com/CVE-2018-1000098/): Integer overflow in debian:debian linux (high 7.5)
- [CVE-2018-1000097](https://insights.sbomify.com/CVE-2018-1000097/): Memory corruption in canonical:ubuntu linux (high 7.8)
- [CVE-2018-1000096](https://insights.sbomify.com/CVE-2018-1000096/): tiny-json-http missing SSL certificate validation (high 8.1)
- [CVE-2018-1000095](https://insights.sbomify.com/CVE-2018-1000095/): Cross-site scripting in redhat:ovirt-engine (medium 4.8)
- [CVE-2018-1000094](https://insights.sbomify.com/CVE-2018-1000094/): File upload in cmsmadesimple:cms made simple (high 7.2)
- [CVE-2018-1000093](https://insights.sbomify.com/CVE-2018-1000093/): Missing authorization in cryptonote:cryptonote (high 8.8)
- [CVE-2018-1000092](https://insights.sbomify.com/CVE-2018-1000092/): Cross-site request forgery in cmsmadesimple:cms made simple (high 8.8)
- [CVE-2018-1000091](https://insights.sbomify.com/CVE-2018-1000091/): Memory corruption in kadnode project:kadnode (high 8.8)
- [CVE-2018-1000090](https://insights.sbomify.com/CVE-2018-1000090/): XML external entity in textpattern:textpattern (high 7.5)
- [CVE-2018-1000089](https://insights.sbomify.com/CVE-2018-1000089/): django-anymail Includes Sensitive Information in Log Files (high 7.4)
- [CVE-2018-1000088](https://insights.sbomify.com/CVE-2018-1000088/): Doorkeeper is vulnerable to stored XSS and code execution (medium 6.1)
- [CVE-2018-1000087](https://insights.sbomify.com/CVE-2018-1000087/): Cross-site scripting in wolfcms:wolf cms (medium 4.8)
- [CVE-2018-1000086](https://insights.sbomify.com/CVE-2018-1000086/): pym.js CSRF Vulnerability (high 8.8)
- [CVE-2018-1000085](https://insights.sbomify.com/CVE-2018-1000085/): Memory corruption in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-1000084](https://insights.sbomify.com/CVE-2018-1000084/): Cross-site scripting in wolfcms:wolf cms (medium 5.4)
- [CVE-2018-1000083](https://insights.sbomify.com/CVE-2018-1000083/): Information disclosure in ajenti:ajenti (medium 5.3)
- [CVE-2018-1000082](https://insights.sbomify.com/CVE-2018-1000082/): Cross-site request forgery in ajenti:ajenti (high 8.8)
- [CVE-2018-1000081](https://insights.sbomify.com/CVE-2018-1000081/): Denial of service in ajenti:ajenti (high 7.5)
- [CVE-2018-1000080](https://insights.sbomify.com/CVE-2018-1000080/): Missing authorization in ajenti:ajenti (medium 6.5)
- [CVE-2018-1000079](https://insights.sbomify.com/CVE-2018-1000079/): RubyGems Path Traversal vulnerability (medium 5.5)
- [CVE-2018-1000078](https://insights.sbomify.com/CVE-2018-1000078/): RubyGems Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2018-1000077](https://insights.sbomify.com/CVE-2018-1000077/): RubyGems Improper Input Validation vulnerability (medium 5.3)
- [CVE-2018-1000076](https://insights.sbomify.com/CVE-2018-1000076/): RubyGems Improper Verification of Cryptographic Signature vulnerability (critical 9.8)
- [CVE-2018-1000075](https://insights.sbomify.com/CVE-2018-1000075/): RubyGems Infinite Loop vulnerability (high 7.5)
- [CVE-2018-1000074](https://insights.sbomify.com/CVE-2018-1000074/): RubyGems Deserialization of Untrusted Data vulnerability (high 7.8)
- [CVE-2018-1000073](https://insights.sbomify.com/CVE-2018-1000073/): RubyGems Link Following vulnerability (high 7.5)
- [CVE-2018-1000072](https://insights.sbomify.com/CVE-2018-1000072/): Misconfiguration in iredmail:iredmail (high 7.5)
- [CVE-2018-1000071](https://insights.sbomify.com/CVE-2018-1000071/): Misconfiguration in roundcube:webmail (high 7.5)
- [CVE-2018-1000070](https://insights.sbomify.com/CVE-2018-1000070/): Code injection in bitmessage:pybitmessage (high 8.8)
- [CVE-2018-1000069](https://insights.sbomify.com/CVE-2018-1000069/): XML external entity in debian:debian linux (medium 5.5)
- [CVE-2018-1000068](https://insights.sbomify.com/CVE-2018-1000068/): Exposure of Sensitive Information to an Unauthorized Actor in Jenkins (medium 5.3)
- [CVE-2018-1000067](https://insights.sbomify.com/CVE-2018-1000067/): Server-Side Request Forgery in Jenkins (medium 5.3)
- [CVE-2018-1000062](https://insights.sbomify.com/CVE-2018-1000062/): Cross-site scripting in wondercms:wondercms (medium 4.4)
- [CVE-2018-1000060](https://insights.sbomify.com/CVE-2018-1000060/): Information disclosure in sensu:sensu core (critical 9.8)
- [CVE-2018-1000059](https://insights.sbomify.com/CVE-2018-1000059/): Deserialization in validformbuilder:validform builder (critical 9.8)
- [CVE-2018-1000058](https://insights.sbomify.com/CVE-2018-1000058/): Arbitrary code execution due to incomplete sandbox protection in Pipeline: Supporting APIs Plugin (high 8.8)
- [CVE-2018-1000057](https://insights.sbomify.com/CVE-2018-1000057/): Jenkins Credentials Binding Plugin has Insufficiently Protected Credentials (medium 4.3)
- [CVE-2018-1000056](https://insights.sbomify.com/CVE-2018-1000056/): Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin (high 8.3)
- [CVE-2018-1000055](https://insights.sbomify.com/CVE-2018-1000055/): XXE vulnerability in Jenkins Android Lint Plugin (high 8.3)
- [CVE-2018-1000054](https://insights.sbomify.com/CVE-2018-1000054/): Jenkins CCM Plugin vulnerable to Improper Restriction of XML External Entity Reference (high 8.3)
- [CVE-2018-1000053](https://insights.sbomify.com/CVE-2018-1000053/): Cross-site request forgery in limesurvey:limesurvey (high 8.8)
- [CVE-2018-1000052](https://insights.sbomify.com/CVE-2018-1000052/): Memory corruption in fmt:fmt (high 7.5)
- [CVE-2018-1000051](https://insights.sbomify.com/CVE-2018-1000051/): Use after free in artifex:mupdf (high 7.8)
- [CVE-2018-1000050](https://insights.sbomify.com/CVE-2018-1000050/): Memory corruption in stb vorbis project:stb vorbis (high 8.8)
- [CVE-2018-1000049](https://insights.sbomify.com/CVE-2018-1000049/): Code injection in nanopool:claymore dual miner (high 7.5)
- [CVE-2018-1000048](https://insights.sbomify.com/CVE-2018-1000048/): Deserialization in nasa:rtretrievalframework (high 8.8)
- [CVE-2018-1000047](https://insights.sbomify.com/CVE-2018-1000047/): Deserialization in nasa:kodiak (high 8.8)
- [CVE-2018-1000046](https://insights.sbomify.com/CVE-2018-1000046/): Deserialization in nasa:pyblock (high 7.8)
- [CVE-2018-1000045](https://insights.sbomify.com/CVE-2018-1000045/): Deserialization in nasa:singledop (high 7.8)
- [CVE-2018-1000044](https://insights.sbomify.com/CVE-2018-1000044/): SQL injection in securityonion:squert (critical 9.8)
- [CVE-2018-1000043](https://insights.sbomify.com/CVE-2018-1000043/): Command injection in securityonion:squert (critical 9.8)
- [CVE-2018-1000042](https://insights.sbomify.com/CVE-2018-1000042/): Command injection in securityonion:squert (critical 9.8)
- [CVE-2018-1000041](https://insights.sbomify.com/CVE-2018-1000041/): Information disclosure in debian:debian linux (high 8.8)
- [CVE-2018-1000040](https://insights.sbomify.com/CVE-2018-1000040/): Memory corruption in artifex:mupdf (medium 5.5)
- [CVE-2018-1000039](https://insights.sbomify.com/CVE-2018-1000039/): Use after free in artifex:mupdf (medium 6.3)
- [CVE-2018-1000038](https://insights.sbomify.com/CVE-2018-1000038/): Memory corruption in artifex:mupdf (high 7.8)
- [CVE-2018-1000037](https://insights.sbomify.com/CVE-2018-1000037/): Denial of service in artifex:mupdf (medium 5.5)
- [CVE-2018-1000036](https://insights.sbomify.com/CVE-2018-1000036/): Denial of service in artifex:mupdf (medium 5.5)
- [CVE-2018-1000035](https://insights.sbomify.com/CVE-2018-1000035/): Memory corruption in unzip project:unzip (high 7.8)
- [CVE-2018-1000034](https://insights.sbomify.com/CVE-2018-1000034/): Memory corruption in info-zip:unzip (critical 9.1)
- [CVE-2018-1000033](https://insights.sbomify.com/CVE-2018-1000033/): Memory corruption in info-zip:unzip (critical 9.1)
- [CVE-2018-1000032](https://insights.sbomify.com/CVE-2018-1000032/): Memory corruption in info-zip:unzip (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/153/