# Vulnerabilities published in 2018


- [CVE-2018-7113](https://insights.sbomify.com/CVE-2018-7113/): Security feature bypass in HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers (medium 6.6)
- [CVE-2018-7112](https://insights.sbomify.com/CVE-2018-7112/): Information disclosure in Windows firmware installer for Gen9, Gen8, G7,and G6 HPE servers (medium 5.5)
- [CVE-2018-7111](https://insights.sbomify.com/CVE-2018-7111/): Missing authorization in HPE UIoT (medium 5.3)
- [CVE-2018-7110](https://insights.sbomify.com/CVE-2018-7110/): Race condition in HPE Service Governance Framework (SGF) (medium 5.9)
- [CVE-2018-7109](https://insights.sbomify.com/CVE-2018-7109/): Path traversal in HPE enhanced Internet Usage Manager (eIUM) (medium 6.5)
- [CVE-2018-7108](https://insights.sbomify.com/CVE-2018-7108/): Auth bypass in HPE StorageWorks XP7 Automation Director (AutoDir) (medium 5.9)
- [CVE-2018-7107](https://insights.sbomify.com/CVE-2018-7107/): SQL injection in HPE Device Entitlement Gateway (DEG) (high 8.8)
- [CVE-2018-7105](https://insights.sbomify.com/CVE-2018-7105/): Code injection in HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers, HPE Integrated Lights-Out 4 (iLO 4), HPE Integrated Lights-Out 3 (iLO 3) (high 7.2)
- [CVE-2018-7104](https://insights.sbomify.com/CVE-2018-7104/): Code injection in HPE Intelligent Management Center (iMC) Wireless Services Manager Software (critical 9.8)
- [CVE-2018-7103](https://insights.sbomify.com/CVE-2018-7103/): Code injection in HPE Intelligent Management Center (iMC) Wireless Services Manager Software (critical 9.8)
- [CVE-2018-7102](https://insights.sbomify.com/CVE-2018-7102/): Path traversal in HPE Intelligent Management Center (iMC) PLAT (high 7.5)
- [CVE-2018-7101](https://insights.sbomify.com/CVE-2018-7101/): Denial of service in HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers, HPE Integrated Lights-Out 4 (iLO 4) (high 7.5)
- [CVE-2018-7100](https://insights.sbomify.com/CVE-2018-7100/): Information disclosure in HP 1810-24G, HP 1810-48G, HP 1810-8 v2 Switches (medium 5.5)
- [CVE-2018-7099](https://insights.sbomify.com/CVE-2018-7099/): Information disclosure in HPE 3PAR Service Processors (medium 5.5)
- [CVE-2018-7098](https://insights.sbomify.com/CVE-2018-7098/): Path traversal in HPE 3PAR Service Processors (high 8.4)
- [CVE-2018-7097](https://insights.sbomify.com/CVE-2018-7097/): Cross-site request forgery in HPE 3PAR Service Processors (high 8.8)
- [CVE-2018-7096](https://insights.sbomify.com/CVE-2018-7096/): Code injection in HPE 3PAR Service Processors (critical 9.8)
- [CVE-2018-7095](https://insights.sbomify.com/CVE-2018-7095/): Auth bypass in HPE 3PAR Service Processors (critical 9.8)
- [CVE-2018-7094](https://insights.sbomify.com/CVE-2018-7094/): Information disclosure in HPE 3PAR Service Processors (medium 5.5)
- [CVE-2018-7093](https://insights.sbomify.com/CVE-2018-7093/): Denial of service in iLO 5 for HPE Gen10 Servers, iLO 4, iLO 3, Moonshot Chassis Management Firmware, Moonshot Component Packs for HPE ProLiant m510 and m710x server cartridges (high 8.6)
- [CVE-2018-7092](https://insights.sbomify.com/CVE-2018-7092/): Path traversal in HPE Intelligent Management Center Platform (IMC Plat) (high 7.5)
- [CVE-2018-7091](https://insights.sbomify.com/CVE-2018-7091/): Open redirect in HPE XP P9000 Command View Advanced Edition Software (CVAE) (medium 6.1)
- [CVE-2018-7090](https://insights.sbomify.com/CVE-2018-7090/): Cross-site scripting in HPE XP P9000 Command View Advanced Edition Software (CVAE) versions 7.0.0-00 to earlier than 8.60-00 (medium 6.1)
- [CVE-2018-7084](https://insights.sbomify.com/CVE-2018-7084/): Command injection in Aruba Instant (IAP) (critical 9.8)
- [CVE-2018-7083](https://insights.sbomify.com/CVE-2018-7083/): Information disclosure in Aruba Instant (IAP) (high 7.5)
- [CVE-2018-7082](https://insights.sbomify.com/CVE-2018-7082/): Command injection in Aruba Instant (IAP) (high 7.2)
- [CVE-2018-7081](https://insights.sbomify.com/CVE-2018-7081/): Command injection in Aruba Mobility Controllers (critical 9.8)
- [CVE-2018-7080](https://insights.sbomify.com/CVE-2018-7080/): Privilege escalation in Aruba Access Points (high 7.5)
- [CVE-2018-7079](https://insights.sbomify.com/CVE-2018-7079/): Missing authorization in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2018-7078](https://insights.sbomify.com/CVE-2018-7078/): Code injection in HPE Integrated Lights-Out 4 (iLO 4), HPE Integrated Lights-Out 5 (iLO 5) (high 7.2)
- [CVE-2018-7077](https://insights.sbomify.com/CVE-2018-7077/): Information disclosure in HPE XP P9000 Command View Advanced Edition (CVAE) (high 7.5)
- [CVE-2018-7076](https://insights.sbomify.com/CVE-2018-7076/): Auth bypass in HPE intelligence Management Center (iMC) PLAT (critical 9.8)
- [CVE-2018-7075](https://insights.sbomify.com/CVE-2018-7075/): Cross-site scripting in HPE Intelligent Management Center (IMC) (medium 6.1)
- [CVE-2018-7074](https://insights.sbomify.com/CVE-2018-7074/): Code injection in HPE Intelligent Management Center (IMC) (critical 9.8)
- [CVE-2018-7073](https://insights.sbomify.com/CVE-2018-7073/): Path traversal in HPE Moonshot Provisioning Manager (medium 5.5)
- [CVE-2018-7072](https://insights.sbomify.com/CVE-2018-7072/): A remote bypass of security restrictions vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24. (critical 9.8)
- [CVE-2018-7071](https://insights.sbomify.com/CVE-2018-7071/): Information disclosure in HPE Network Function Virtualization Director (NFVD) (medium 4.3)
- [CVE-2018-7070](https://insights.sbomify.com/CVE-2018-7070/): Information disclosure in HPE CentralView Fraud Risk Management (medium 5.3)
- [CVE-2018-7069](https://insights.sbomify.com/CVE-2018-7069/): Auth bypass in HPE CentralView Fraud Risk Management (high 7.5)
- [CVE-2018-7068](https://insights.sbomify.com/CVE-2018-7068/): Other in HPE CentralView Fraud Risk Management (medium 6.1)
- [CVE-2018-7067](https://insights.sbomify.com/CVE-2018-7067/): Auth bypass in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2018-7066](https://insights.sbomify.com/CVE-2018-7066/): Command injection in Aruba ClearPass Policy Manager (critical 9.0)
- [CVE-2018-7065](https://insights.sbomify.com/CVE-2018-7065/): SQL injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2018-7064](https://insights.sbomify.com/CVE-2018-7064/): Cross-site scripting in Aruba Instant (IAP) (medium 6.1)
- [CVE-2018-7063](https://insights.sbomify.com/CVE-2018-7063/): Auth bypass in Aruba ClearPass Policy Manager (high 8.1)
- [CVE-2018-7060](https://insights.sbomify.com/CVE-2018-7060/): Cross-site request forgery in Aruba ClearPass (high 8.8)
- [CVE-2018-7059](https://insights.sbomify.com/CVE-2018-7059/): Information disclosure in n/a (high 8.8)
- [CVE-2018-7058](https://insights.sbomify.com/CVE-2018-7058/): Auth bypass in Aruba ClearPass (critical 9.8)
- [CVE-2018-7057](https://insights.sbomify.com/CVE-2018-7057/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2018-7056](https://insights.sbomify.com/CVE-2018-7056/): RoomWizard before 4.4.x allows remote attackers to obtain potentially sensitive information about IP addresses via /getGroupTimeLineJSON.action. (medium 5.3)
- [CVE-2018-7055](https://insights.sbomify.com/CVE-2018-7055/): Server-side request forgery in n/a (high 7.5)
- [CVE-2018-7054](https://insights.sbomify.com/CVE-2018-7054/): Use after free in n/a (critical 9.8)
- [CVE-2018-7053](https://insights.sbomify.com/CVE-2018-7053/): Use after free in n/a (critical 9.8)
- [CVE-2018-7052](https://insights.sbomify.com/CVE-2018-7052/): Null dereference in n/a (high 7.5)
- [CVE-2018-7051](https://insights.sbomify.com/CVE-2018-7051/): Memory corruption in n/a (high 7.5)
- [CVE-2018-7050](https://insights.sbomify.com/CVE-2018-7050/): Null dereference in n/a (high 7.5)
- [CVE-2018-7049](https://insights.sbomify.com/CVE-2018-7049/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2018-7048](https://insights.sbomify.com/CVE-2018-7048/): Denial of service in n/a (high 7.5)
- [CVE-2018-7047](https://insights.sbomify.com/CVE-2018-7047/): Hardcoded credentials in n/a (critical 9.8)
- [CVE-2018-7046](https://insights.sbomify.com/CVE-2018-7046/): Code injection in n/a (high 7.2)
- [CVE-2018-7039](https://insights.sbomify.com/CVE-2018-7039/): Integer overflow in n/a (critical 9.8)
- [CVE-2018-7035](https://insights.sbomify.com/CVE-2018-7035/): Gleez CMS Stored XSS (medium 5.4)
- [CVE-2018-7034](https://insights.sbomify.com/CVE-2018-7034/): Auth bypass in n/a (high 7.5)
- [CVE-2018-7033](https://insights.sbomify.com/CVE-2018-7033/): SQL injection in n/a (critical 9.8)
- [CVE-2018-7032](https://insights.sbomify.com/CVE-2018-7032/): Command injection in n/a (high 7.5)
- [CVE-2018-6983](https://insights.sbomify.com/CVE-2018-6983/): Integer overflow in VMware Workstation and Fusion (high 8.8)
- [CVE-2018-6982](https://insights.sbomify.com/CVE-2018-6982/): Information disclosure in VMware ESXi (medium 6.5)
- [CVE-2018-6981](https://insights.sbomify.com/CVE-2018-6981/): Memory corruption in VMware ESXi, VMware Workstation, and VMware Fusion (high 8.8)
- [CVE-2018-6980](https://insights.sbomify.com/CVE-2018-6980/): Missing authorization in VMware vRealize Log Insight (high 7.2)
- [CVE-2018-6979](https://insights.sbomify.com/CVE-2018-6979/): Auth bypass in VMware Workspace ONE Unified Endpoint Management Console (AirWatch Console) (high 7.4)
- [CVE-2018-6978](https://insights.sbomify.com/CVE-2018-6978/): Privilege escalation in n/a (medium 6.7)
- [CVE-2018-6977](https://insights.sbomify.com/CVE-2018-6977/): Denial of service in ESXi (medium 6.5)
- [CVE-2018-6976](https://insights.sbomify.com/CVE-2018-6976/): Information disclosure in Content Locker for iOS (medium 5.3)
- [CVE-2018-6975](https://insights.sbomify.com/CVE-2018-6975/): Information disclosure in AirWatch Agent for iOS prior to 5.8.1 (medium 5.5)
- [CVE-2018-6974](https://insights.sbomify.com/CVE-2018-6974/): Memory corruption in ESXi (high 8.8)
- [CVE-2018-6973](https://insights.sbomify.com/CVE-2018-6973/): Memory corruption in Fusion (high 8.8)
- [CVE-2018-6972](https://insights.sbomify.com/CVE-2018-6972/): Null dereference in ESXi (medium 6.5)
- [CVE-2018-6971](https://insights.sbomify.com/CVE-2018-6971/): Information disclosure in Horizon View Agent (high 7.8)
- [CVE-2018-6970](https://insights.sbomify.com/CVE-2018-6970/): Information disclosure in VMware Horizon 6, Horizon 7, and Horizon Client (medium 6.5)
- [CVE-2018-6969](https://insights.sbomify.com/CVE-2018-6969/): Information disclosure in VMware Tools (high 7.0)
- [CVE-2018-6968](https://insights.sbomify.com/CVE-2018-6968/): Code injection in AirWatch Agent (critical 10.0)
- [CVE-2018-6967](https://insights.sbomify.com/CVE-2018-6967/): Information disclosure in VMware ESXi, Workstation, and Fusion (high 8.1)
- [CVE-2018-6966](https://insights.sbomify.com/CVE-2018-6966/): Information disclosure in VMware ESXi, Workstation, and Fusion (high 8.1)
- [CVE-2018-6965](https://insights.sbomify.com/CVE-2018-6965/): Information disclosure in VMware ESXi, Workstation, and Fusion (high 8.1)
- [CVE-2018-6964](https://insights.sbomify.com/CVE-2018-6964/): Privilege escalation in Horizon Client for Linux (high 7.8)
- [CVE-2018-6963](https://insights.sbomify.com/CVE-2018-6963/): Null dereference in Fusion (medium 5.5)
- [CVE-2018-6962](https://insights.sbomify.com/CVE-2018-6962/): VMware Fusion (10.x before 10.1.2) contains a signature bypass vulnerability which may lead to a local privilege escalation. (high 7.8)
- [CVE-2018-6961](https://insights.sbomify.com/CVE-2018-6961/): VMware SD-WAN Edge by VeloCloud Command Injection (high 8.1, exploited in the wild)
- [CVE-2018-6960](https://insights.sbomify.com/CVE-2018-6960/): Auth bypass in Horizon DaaS (high 8.8)
- [CVE-2018-6959](https://insights.sbomify.com/CVE-2018-6959/): Auth bypass in vRealize Automation (critical 9.8)
- [CVE-2018-6958](https://insights.sbomify.com/CVE-2018-6958/): Cross-site scripting in vRealize Automation (medium 6.1)
- [CVE-2018-6957](https://insights.sbomify.com/CVE-2018-6957/): Denial of service in Fusion (medium 5.3)
- [CVE-2018-6954](https://insights.sbomify.com/CVE-2018-6954/): Path traversal in n/a (high 7.8)
- [CVE-2018-6953](https://insights.sbomify.com/CVE-2018-6953/): Memory corruption in n/a (critical 9.8)
- [CVE-2018-6952](https://insights.sbomify.com/CVE-2018-6952/): Use after free in n/a (high 7.5)
- [CVE-2018-6951](https://insights.sbomify.com/CVE-2018-6951/): Null dereference in n/a (high 7.5)
- [CVE-2018-6948](https://insights.sbomify.com/CVE-2018-6948/): Memory corruption in n/a (critical 9.8)
- [CVE-2018-6947](https://insights.sbomify.com/CVE-2018-6947/): Privilege escalation in n/a (high 7.8)
- [CVE-2018-6944](https://insights.sbomify.com/CVE-2018-6944/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2018-6943](https://insights.sbomify.com/CVE-2018-6943/): Cross-site scripting in n/a (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/21/