# Vulnerabilities published in 2018 - [CVE-2018-7832](https://insights.sbomify.com/CVE-2018-7832/): Code injection in Pro-Face GP-Pro EX v4.08 and previous versions (high 8.8) - [CVE-2018-7831](https://insights.sbomify.com/CVE-2018-7831/): Cross-site scripting in Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 (high 8.8) - [CVE-2018-7830](https://insights.sbomify.com/CVE-2018-7830/): Other in Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 (high 7.5) - [CVE-2018-7829](https://insights.sbomify.com/CVE-2018-7829/): Command injection in Pelco Sarix Enhanced and Spectra Enhanced, Pelco Sarix Enhanced 1st generation and Spectra Enhanced PTZ (high 8.8) - [CVE-2018-7828](https://insights.sbomify.com/CVE-2018-7828/): Cross-site request forgery in Pelco Sarix Enhanced and Spectra Enhanced, Pelco Sarix Enhanced 1st generation and Spectra Enhanced PTZ (high 8.8) - [CVE-2018-7827](https://insights.sbomify.com/CVE-2018-7827/): Cross-site scripting in Pelco Sarix Enhanced and Spectra Enhanced, Pelco Sarix Enhanced 1st generation and Spectra Enhanced PTZ (medium 5.4) - [CVE-2018-7826](https://insights.sbomify.com/CVE-2018-7826/): Command injection in Pelco Sarix Enhanced and Spectra Enhanced, Pelco Sarix Enhanced 1st generation and Spectra Enhanced PTZ (high 8.8) - [CVE-2018-7825](https://insights.sbomify.com/CVE-2018-7825/): Command injection in Pelco Sarix Enhanced and Spectra Enhanced, Pelco Sarix Enhanced 1st generation and Spectra Enhanced PTZ (high 8.8) - [CVE-2018-7824](https://insights.sbomify.com/CVE-2018-7824/): Path traversal in Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 and prior , For 32-bit Windows OS:V2.17 IE 27 and prior, and as part of the Driver Suite version:V14.12 and prior) (medium 4.9) - [CVE-2018-7823](https://insights.sbomify.com/CVE-2018-7823/): Other in SoMachine Basic and Modicon M221, SoMachine Basic, all versions Modicon M221, all references, all versions prior to firmware V1.10.0.0 (medium 5.3) - [CVE-2018-7822](https://insights.sbomify.com/CVE-2018-7822/): Misconfiguration in SoMachine Basic and Modicon M221, SoMachine Basic, all versions Modicon M221, all references, all versions prior to firmware V1.10.0.0 (medium 5.5) - [CVE-2018-7821](https://insights.sbomify.com/CVE-2018-7821/): Denial of service in SoMachine Basic and Modicon M221, SoMachine Basic, all versions Modicon M221, all references, all versions prior to firmware V1.10.0.0 (high 7.5) - [CVE-2018-7820](https://insights.sbomify.com/CVE-2018-7820/): Information disclosure in APC UPS Network Management Card 2 AOS (critical 9.8) - [CVE-2018-7817](https://insights.sbomify.com/CVE-2018-7817/): Use after free in Zelio Soft 2 v5.1 and prior versions (high 7.8) - [CVE-2018-7816](https://insights.sbomify.com/CVE-2018-7816/): Missing authorization in Pelco Sarix Enhanced and Spectra Enhanced, Pelco Sarix Enhanced 1st generation and Spectra Enhanced PTZ (medium 6.5) - [CVE-2018-7815](https://insights.sbomify.com/CVE-2018-7815/): Memory corruption in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) (high 7.8) - [CVE-2018-7814](https://insights.sbomify.com/CVE-2018-7814/): Memory corruption in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) (high 7.8) - [CVE-2018-7813](https://insights.sbomify.com/CVE-2018-7813/): Memory corruption in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) (high 7.8) - [CVE-2018-7812](https://insights.sbomify.com/CVE-2018-7812/): Information disclosure in Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 (high 7.5) - [CVE-2018-7811](https://insights.sbomify.com/CVE-2018-7811/): Auth bypass in Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 (critical 9.8) - [CVE-2018-7810](https://insights.sbomify.com/CVE-2018-7810/): Cross-site scripting in Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 (medium 6.1) - [CVE-2018-7809](https://insights.sbomify.com/CVE-2018-7809/): Auth bypass in Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 (critical 9.8) - [CVE-2018-7807](https://insights.sbomify.com/CVE-2018-7807/): Path traversal in Data Center Expert versions 7.5.0 and earlier (high 8.8) - [CVE-2018-7806](https://insights.sbomify.com/CVE-2018-7806/): Path traversal in Data Center Operation all versions (high 8.8) - [CVE-2018-7804](https://insights.sbomify.com/CVE-2018-7804/): Open redirect in Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 (medium 6.1) - [CVE-2018-7803](https://insights.sbomify.com/CVE-2018-7803/): Denial of service in Triconex TriStation Emulator V1.2.0 (medium 5.9) - [CVE-2018-7802](https://insights.sbomify.com/CVE-2018-7802/): SQL injection in EVLink Parking v3.2.0-12 v1 and earlier (high 8.8) - [CVE-2018-7801](https://insights.sbomify.com/CVE-2018-7801/): Code injection in EVLink Parking v3.2.0-12 v1 and earlier (high 8.8) - [CVE-2018-7800](https://insights.sbomify.com/CVE-2018-7800/): Hardcoded credentials in EVLink Parking v3.2.0-12 v1 and earlier (critical 9.8) - [CVE-2018-7799](https://insights.sbomify.com/CVE-2018-7799/): Code injection in Schneider Electric Software Update (SESU), all versions prior to V2.2.0 (high 7.8) - [CVE-2018-7798](https://insights.sbomify.com/CVE-2018-7798/): Missing authorization in Modicon M221, All Versions (high 8.2) - [CVE-2018-7797](https://insights.sbomify.com/CVE-2018-7797/): Open redirect in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxureª Power Monitoring Expert (PME) v8.2 (all editions), EcoStruxureª Energy Expert 1.3 (formerly Power Manager), EcoStruxureª Power SCADA Operation (PSO) 8.2 Advanced Reports and Dashboards Module, EcoStruxureª Power Monitoring Expert (PME) v9.0, EcoStruxureª Energy Expert v2.0, and EcoStruxureªPower SCADA Operation (PSO) 9.0 Advanced Reports and Dashboards Module (medium 6.1) - [CVE-2018-7796](https://insights.sbomify.com/CVE-2018-7796/): Memory corruption in PowerSuite 2, All released versions (VW3A8104 & Patches) (medium 6.3) - [CVE-2018-7795](https://insights.sbomify.com/CVE-2018-7795/): Cross-site scripting in PowerLogic - PM5560 prior to FW version 2.5.4 (medium 5.4) - [CVE-2018-7794](https://insights.sbomify.com/CVE-2018-7794/): Denial of service in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions) (high 7.5) - [CVE-2018-7793](https://insights.sbomify.com/CVE-2018-7793/): Missing authorization in FoxView HMI SCADA (All Foxboro DCS, Foxboro Evo, and IA Series versions prior to Foxboro DCS Control Core Services 9.4 (CCS 9.4) and FoxView 10.5.) (high 8.7) - [CVE-2018-7792](https://insights.sbomify.com/CVE-2018-7792/): Weak cryptography in Modicon M221, all references, all versions prior to firmware V1.6.2.0 (high 7.5) - [CVE-2018-7791](https://insights.sbomify.com/CVE-2018-7791/): Auth bypass in Modicon M221, all references, all versions prior to firmware V1.6.2.0 (critical 9.8) - [CVE-2018-7790](https://insights.sbomify.com/CVE-2018-7790/): Auth bypass in Modicon M221, all references, all versions prior to firmware V1.6.2.0 (critical 9.8) - [CVE-2018-7789](https://insights.sbomify.com/CVE-2018-7789/): Denial of service in Modicon M221, all references, all versions prior to firmware V1.6.2.0 (medium 4.8) - [CVE-2018-7788](https://insights.sbomify.com/CVE-2018-7788/): Denial of service in Modicon Quantum with firmware versions prior to V2.40. (medium 6.5) - [CVE-2018-7787](https://insights.sbomify.com/CVE-2018-7787/): Other in U.motion Builder (medium 5.3) - [CVE-2018-7786](https://insights.sbomify.com/CVE-2018-7786/): Cross-site scripting in U.motion Builder (medium 6.1) - [CVE-2018-7785](https://insights.sbomify.com/CVE-2018-7785/): Command injection in U.motion Builder (critical 9.8) - [CVE-2018-7784](https://insights.sbomify.com/CVE-2018-7784/): Code injection in U.motion Builder (critical 9.8) - [CVE-2018-7783](https://insights.sbomify.com/CVE-2018-7783/): XML external entity in SoMachine Basic (high 7.5) - [CVE-2018-7782](https://insights.sbomify.com/CVE-2018-7782/): Information disclosure in Pelco Sarix Professional V1 (high 8.8) - [CVE-2018-7781](https://insights.sbomify.com/CVE-2018-7781/): Information disclosure in Pelco Sarix Professional V1 (high 8.8) - [CVE-2018-7780](https://insights.sbomify.com/CVE-2018-7780/): Memory corruption in Pelco Sarix Professional V1 (critical 9.8) - [CVE-2018-7779](https://insights.sbomify.com/CVE-2018-7779/): Auth bypass in Wiser for KNX (high 7.5) - [CVE-2018-7778](https://insights.sbomify.com/CVE-2018-7778/): Auth bypass in Evlink Charging Station (critical 9.8) - [CVE-2018-7777](https://insights.sbomify.com/CVE-2018-7777/): Path traversal in U.Motion (high 8.8) - [CVE-2018-7776](https://insights.sbomify.com/CVE-2018-7776/): Information disclosure in U.Motion (medium 4.3) - [CVE-2018-7774](https://insights.sbomify.com/CVE-2018-7774/): SQL injection in U.Motion (high 8.8) - [CVE-2018-7773](https://insights.sbomify.com/CVE-2018-7773/): SQL injection in U.Motion (high 8.8) - [CVE-2018-7772](https://insights.sbomify.com/CVE-2018-7772/): SQL injection in U.Motion (high 8.8) - [CVE-2018-7771](https://insights.sbomify.com/CVE-2018-7771/): Path traversal in U.Motion (high 8.0) - [CVE-2018-7770](https://insights.sbomify.com/CVE-2018-7770/): Path traversal in U.Motion (medium 6.5) - [CVE-2018-7769](https://insights.sbomify.com/CVE-2018-7769/): SQL injection in U.Motion (high 8.8) - [CVE-2018-7768](https://insights.sbomify.com/CVE-2018-7768/): SQL injection in U.Motion (high 8.8) - [CVE-2018-7767](https://insights.sbomify.com/CVE-2018-7767/): SQL injection in U.Motion (high 8.8) - [CVE-2018-7766](https://insights.sbomify.com/CVE-2018-7766/): SQL injection in U.Motion (high 8.8) - [CVE-2018-7765](https://insights.sbomify.com/CVE-2018-7765/): SQL injection in U.Motion (high 8.8) - [CVE-2018-7764](https://insights.sbomify.com/CVE-2018-7764/): Path traversal in U.Motion (medium 4.3) - [CVE-2018-7763](https://insights.sbomify.com/CVE-2018-7763/): Path traversal in U.Motion (medium 4.3) - [CVE-2018-7762](https://insights.sbomify.com/CVE-2018-7762/): Memory corruption in Modicon M340, Modicon Premium, Modicon Quantum, BMXNOR0203 (high 7.5) - [CVE-2018-7761](https://insights.sbomify.com/CVE-2018-7761/): Code injection in Modicon M340, Modicon Premium, Modicon Quantum, BMXNOR0202 (critical 9.8) - [CVE-2018-7760](https://insights.sbomify.com/CVE-2018-7760/): Auth bypass in Modicon M340, Modicon Premium, Modicon Quantum, BMXNOR0201 (critical 9.8) - [CVE-2018-7759](https://insights.sbomify.com/CVE-2018-7759/): Memory corruption in Modicon M340, Modicon Premium, Modicon Quantum, BMXNOR0200 (high 7.5) - [CVE-2018-7758](https://insights.sbomify.com/CVE-2018-7758/): Denial of service in MiCOM P540D Range with Legacy Ethernet Board (medium 6.5) - [CVE-2018-7757](https://insights.sbomify.com/CVE-2018-7757/): Denial of service in n/a (medium 5.5) - [CVE-2018-7756](https://insights.sbomify.com/CVE-2018-7756/): RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TCP port 1999, which al (critical 9.8) - [CVE-2018-7755](https://insights.sbomify.com/CVE-2018-7755/): Information disclosure in n/a (medium 5.5) - [CVE-2018-7754](https://insights.sbomify.com/CVE-2018-7754/): Information disclosure in n/a (medium 5.5) - [CVE-2018-7753](https://insights.sbomify.com/CVE-2018-7753/): Bleach URI Scheme Restriction Bypass (critical 9.8) - [CVE-2018-7752](https://insights.sbomify.com/CVE-2018-7752/): Memory corruption in n/a (high 7.8) - [CVE-2018-7751](https://insights.sbomify.com/CVE-2018-7751/): Denial of service in n/a (medium 6.5) - [CVE-2018-7750](https://insights.sbomify.com/CVE-2018-7750/): Paramiko not properly checking authentication before processing other requests (critical 9.8) - [CVE-2018-7749](https://insights.sbomify.com/CVE-2018-7749/): AsyncSSH SSH Server Authentication Bypass (critical 9.8) - [CVE-2018-7748](https://insights.sbomify.com/CVE-2018-7748/): Code injection in n/a (high 8.8) - [CVE-2018-7747](https://insights.sbomify.com/CVE-2018-7747/): Cross-site scripting in n/a (medium 4.8) - [CVE-2018-7746](https://insights.sbomify.com/CVE-2018-7746/): Cross-site scripting in n/a (high 8.8) - [CVE-2018-7745](https://insights.sbomify.com/CVE-2018-7745/): Auth bypass in n/a (high 7.5) - [CVE-2018-7741](https://insights.sbomify.com/CVE-2018-7741/): Cross-site scripting in n/a (medium 6.1) - [CVE-2018-7740](https://insights.sbomify.com/CVE-2018-7740/): Denial of service in n/a (medium 5.5) - [CVE-2018-7739](https://insights.sbomify.com/CVE-2018-7739/): Auth bypass in n/a (critical 9.8) - [CVE-2018-7738](https://insights.sbomify.com/CVE-2018-7738/): Command injection in n/a (high 7.8) - [CVE-2018-7737](https://insights.sbomify.com/CVE-2018-7737/): Information disclosure in n/a (medium 5.3) - [CVE-2018-7736](https://insights.sbomify.com/CVE-2018-7736/): Cross-site scripting in n/a (medium 6.1) - [CVE-2018-7735](https://insights.sbomify.com/CVE-2018-7735/): SQL injection in n/a (high 7.2) - [CVE-2018-7734](https://insights.sbomify.com/CVE-2018-7734/): SQL injection in n/a (high 7.2) - [CVE-2018-7733](https://insights.sbomify.com/CVE-2018-7733/): Cross-site request forgery in n/a (high 8.8) - [CVE-2018-7732](https://insights.sbomify.com/CVE-2018-7732/): SQL injection in n/a (critical 9.8) - [CVE-2018-7731](https://insights.sbomify.com/CVE-2018-7731/): Null dereference in n/a (medium 5.5) - [CVE-2018-7730](https://insights.sbomify.com/CVE-2018-7730/): Memory corruption in n/a (medium 5.5) - [CVE-2018-7729](https://insights.sbomify.com/CVE-2018-7729/): Memory corruption in n/a (medium 5.5) - [CVE-2018-7728](https://insights.sbomify.com/CVE-2018-7728/): Memory corruption in n/a (medium 5.5) - [CVE-2018-7727](https://insights.sbomify.com/CVE-2018-7727/): Denial of service in n/a (medium 6.5) - [CVE-2018-7726](https://insights.sbomify.com/CVE-2018-7726/): Denial of service in n/a (medium 6.5) - [CVE-2018-7725](https://insights.sbomify.com/CVE-2018-7725/): Null dereference in n/a (medium 6.5) --- From sbomify Insights: https://insights.sbomify.com/years/2018/page/16/