# Vulnerabilities published in 2018


- [CVE-2018-5459](https://insights.sbomify.com/CVE-2018-5459/): Auth bypass in WAGO PFC200 Series (critical 9.8)
- [CVE-2018-5458](https://insights.sbomify.com/CVE-2018-5458/): Weak cryptography in Philips IntelliSpace Portal (high 7.5)
- [CVE-2018-5457](https://insights.sbomify.com/CVE-2018-5457/): Other in Vyaire Medical CareFusion Upgrade Utility Vulnerability (high 7.0)
- [CVE-2018-5455](https://insights.sbomify.com/CVE-2018-5455/): Auth bypass in Moxa OnCell G3100-HSPA Series (critical 9.8)
- [CVE-2018-5454](https://insights.sbomify.com/CVE-2018-5454/): Security feature bypass in Philips IntelliSpace Portal (high 8.1)
- [CVE-2018-5453](https://insights.sbomify.com/CVE-2018-5453/): Denial of service in Moxa OnCell G3100-HSPA Series (high 7.5)
- [CVE-2018-5452](https://insights.sbomify.com/CVE-2018-5452/): Memory corruption in Emerson ControlWave Micro Process Automation Controller (high 7.5)
- [CVE-2018-5451](https://insights.sbomify.com/CVE-2018-5451/): Auth bypass in Philips Alice 6 System (critical 9.8)
- [CVE-2018-5449](https://insights.sbomify.com/CVE-2018-5449/): Null dereference in Moxa OnCell G3100-HSPA Series (medium 6.5)
- [CVE-2018-5448](https://insights.sbomify.com/CVE-2018-5448/): Medtronic 2090 Carelink Programmer Relative Path Traversal (medium 4.8)
- [CVE-2018-5447](https://insights.sbomify.com/CVE-2018-5447/): Information disclosure in Nari PCS-9611 (critical 9.8)
- [CVE-2018-5446](https://insights.sbomify.com/CVE-2018-5446/): Medtronic 2090 Carelink Programmer Storing Passwords in a Recoverable Format (medium 4.9)
- [CVE-2018-5445](https://insights.sbomify.com/CVE-2018-5445/): Path traversal in Advantech WebAccess/SCADA (medium 5.3)
- [CVE-2018-5443](https://insights.sbomify.com/CVE-2018-5443/): SQL injection in Advantech WebAccess/SCADA (medium 5.3)
- [CVE-2018-5442](https://insights.sbomify.com/CVE-2018-5442/): Memory corruption in Fuji Electric V-Server VPR (critical 9.8)
- [CVE-2018-5441](https://insights.sbomify.com/CVE-2018-5441/): Other in PHOENIX CONTACT mGuard (high 7.8)
- [CVE-2018-5440](https://insights.sbomify.com/CVE-2018-5440/): Memory corruption in 3S-Smart Software Solutions GmbH CODESYS Web Server (critical 9.8)
- [CVE-2018-5439](https://insights.sbomify.com/CVE-2018-5439/): Command injection in Nortek Linear eMerge E3 Series (critical 9.8)
- [CVE-2018-5438](https://insights.sbomify.com/CVE-2018-5438/): Auth bypass in n/a (medium 6.3)
- [CVE-2018-5437](https://insights.sbomify.com/CVE-2018-5437/): TIBCO Spotfire Product Family Information Disclosure Vulnerability (medium 6.8)
- [CVE-2018-5436](https://insights.sbomify.com/CVE-2018-5436/): TIBCO Spotfire Server information disclosure vulnerabilities (medium 6.5)
- [CVE-2018-5435](https://insights.sbomify.com/CVE-2018-5435/): TIBCO Spotfire Product Family Remote Code Execution Vulnerability (critical 9.6)
- [CVE-2018-5434](https://insights.sbomify.com/CVE-2018-5434/): XML eXternal Entity Expansion Vulnerabilities with TIBCO Runtime Agent (medium 5.8)
- [CVE-2018-5433](https://insights.sbomify.com/CVE-2018-5433/): XML eXternal Entity Expansion Vulnerabilities with TIBCO Administrator (medium 6.5)
- [CVE-2018-5432](https://insights.sbomify.com/CVE-2018-5432/): TIBCO Administrator - Enterprise Edition Cross-Site Scripting Vulnerability (high 8.0)
- [CVE-2018-5431](https://insights.sbomify.com/CVE-2018-5431/): TIBCO JasperReports Server Cross Site Scripting Vulnerability (medium 6.3)
- [CVE-2018-5430](https://insights.sbomify.com/CVE-2018-5430/): TIBCO JasperReports Server Information Disclosure (high 7.7, exploited in the wild)
- [CVE-2018-5429](https://insights.sbomify.com/CVE-2018-5429/): TIBCO JasperReports Library Code Sandboxing Problem (high 8.8)
- [CVE-2018-5428](https://insights.sbomify.com/CVE-2018-5428/): TIBCO Data Virtualization Command Injection Vulnerability (high 8.8)
- [CVE-2018-5413](https://insights.sbomify.com/CVE-2018-5413/): Privilege escalation in SecureSphere (high 8.8)
- [CVE-2018-5412](https://insights.sbomify.com/CVE-2018-5412/): Command injection in SecureSphere (high 7.8)
- [CVE-2018-5411](https://insights.sbomify.com/CVE-2018-5411/): Pixar's Tractor software, versions 2.2 and earlier, contains a stored cross-site scripting vulnerability (medium 5.4)
- [CVE-2018-5410](https://insights.sbomify.com/CVE-2018-5410/): Dokan file system driver contains a stack-based buffer overflow (high 7.8)
- [CVE-2018-5409](https://insights.sbomify.com/CVE-2018-5409/): PrinterLogic Print Management Software updates and executes the code without origin and code verification (critical 9.8)
- [CVE-2018-5408](https://insights.sbomify.com/CVE-2018-5408/): PrinterLogic Print Management Software fails to validate the management portal SSL certificates (high 7.4)
- [CVE-2018-5407](https://insights.sbomify.com/CVE-2018-5407/): Information disclosure in Processors supporting Simultaneous Multi-Threading (medium 4.7)
- [CVE-2018-5406](https://insights.sbomify.com/CVE-2018-5406/): The Quest Kace K1000 Appliance misconfigures the Cross-Origin Resource Sharing (CORS) mechanism. (high 8.8)
- [CVE-2018-5405](https://insights.sbomify.com/CVE-2018-5405/): The Quest Kace K1000 Appliance is vulnerable to JavaScript injection. (medium 5.4)
- [CVE-2018-5404](https://insights.sbomify.com/CVE-2018-5404/): The Quest Kace K1000 Appliance is vulnerable to multiple Blind SQL Injections. (medium 6.5)
- [CVE-2018-5403](https://insights.sbomify.com/CVE-2018-5403/): Command injection in SecureSphere (high 8.1)
- [CVE-2018-5402](https://insights.sbomify.com/CVE-2018-5402/): Weak cryptography in DCU-210E (critical 9.1)
- [CVE-2018-5401](https://insights.sbomify.com/CVE-2018-5401/): Information disclosure in DCU-210E (critical 9.1)
- [CVE-2018-5400](https://insights.sbomify.com/CVE-2018-5400/): Missing authorization in DCU-210E (critical 9.1)
- [CVE-2018-5399](https://insights.sbomify.com/CVE-2018-5399/): Hardcoded credentials in DCU-210E (critical 9.4)
- [CVE-2018-5393](https://insights.sbomify.com/CVE-2018-5393/): TP-Link EAP Controller versions 2.5.3 and earlier lack RMI authentication (critical 9.8)
- [CVE-2018-5392](https://insights.sbomify.com/CVE-2018-5392/): mingw-w64 version 5.0.4 by default produces executables that opt in to ASLR, but are not compatible with ASLR (high 7.5)
- [CVE-2018-5391](https://insights.sbomify.com/CVE-2018-5391/): Denial of service in Kernel (high 7.5)
- [CVE-2018-5390](https://insights.sbomify.com/CVE-2018-5390/): Denial of service in Linux Kernel (high 7.5)
- [CVE-2018-5389](https://insights.sbomify.com/CVE-2018-5389/): CVE-2018-5389 (medium 5.9)
- [CVE-2018-5388](https://insights.sbomify.com/CVE-2018-5388/): Denial of service in strongSwan (medium 6.5)
- [CVE-2018-5387](https://insights.sbomify.com/CVE-2018-5387/): Wizkunde SAMLBase SAML Bypass (high 7.5)
- [CVE-2018-5386](https://insights.sbomify.com/CVE-2018-5386/): Auth bypass in Infinity (high 7.5)
- [CVE-2018-5385](https://insights.sbomify.com/CVE-2018-5385/): Navarino Infinity web interface up to version 2.2 is prone to session fixation attacks (high 8.8)
- [CVE-2018-5384](https://insights.sbomify.com/CVE-2018-5384/): SQL injection in Infinity (critical 9.8)
- [CVE-2018-5383](https://insights.sbomify.com/CVE-2018-5383/): Bluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchange (high 8.0)
- [CVE-2018-5382](https://insights.sbomify.com/CVE-2018-5382/): Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisions (medium 4.4)
- [CVE-2018-5381](https://insights.sbomify.com/CVE-2018-5381/): Denial of service in bgpd (medium 6.5)
- [CVE-2018-5380](https://insights.sbomify.com/CVE-2018-5380/): Memory corruption in bgpd (medium 4.3)
- [CVE-2018-5379](https://insights.sbomify.com/CVE-2018-5379/): Use after free in bgpd (high 7.5)
- [CVE-2018-5378](https://insights.sbomify.com/CVE-2018-5378/): Information disclosure in bgpd (high 7.1)
- [CVE-2018-5377](https://insights.sbomify.com/CVE-2018-5377/): Missing authorization in n/a (critical 9.8)
- [CVE-2018-5376](https://insights.sbomify.com/CVE-2018-5376/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2018-5375](https://insights.sbomify.com/CVE-2018-5375/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2018-5374](https://insights.sbomify.com/CVE-2018-5374/): SQL injection in n/a (high 8.8)
- [CVE-2018-5373](https://insights.sbomify.com/CVE-2018-5373/): SQL injection in n/a (high 8.8)
- [CVE-2018-5372](https://insights.sbomify.com/CVE-2018-5372/): SQL injection in n/a (high 8.8)
- [CVE-2018-5371](https://insights.sbomify.com/CVE-2018-5371/): Command injection in n/a (high 8.8)
- [CVE-2018-5370](https://insights.sbomify.com/CVE-2018-5370/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2018-5369](https://insights.sbomify.com/CVE-2018-5369/): Cross-site scripting in n/a (medium 4.8)
- [CVE-2018-5368](https://insights.sbomify.com/CVE-2018-5368/): Cross-site request forgery in n/a (high 8.8)
- [CVE-2018-5367](https://insights.sbomify.com/CVE-2018-5367/): WPGlobus plugin Stored XSS & CSRF security vulnerability (medium 4.8)
- [CVE-2018-5366](https://insights.sbomify.com/CVE-2018-5366/): WPGlobus plugin Stored XSS & CSRF security vulnerability (medium 4.8)
- [CVE-2018-5365](https://insights.sbomify.com/CVE-2018-5365/): WPGlobus plugin Stored XSS & CSRF security vulnerability (medium 4.8)
- [CVE-2018-5364](https://insights.sbomify.com/CVE-2018-5364/): WPGlobus plugin Stored XSS & CSRF security vulnerability (medium 4.8)
- [CVE-2018-5363](https://insights.sbomify.com/CVE-2018-5363/): WPGlobus plugin Stored XSS & CSRF security vulnerability (medium 4.8)
- [CVE-2018-5362](https://insights.sbomify.com/CVE-2018-5362/): WPGlobus plugin Stored XSS & CSRF security vulnerability (medium 4.8)
- [CVE-2018-5361](https://insights.sbomify.com/CVE-2018-5361/): WPGlobus plugin Stored XSS & CSRF security vulnerability (high 8.8)
- [CVE-2018-5360](https://insights.sbomify.com/CVE-2018-5360/): Memory corruption in n/a (high 8.8)
- [CVE-2018-5359](https://insights.sbomify.com/CVE-2018-5359/): Memory corruption in n/a (high 8.1)
- [CVE-2018-5358](https://insights.sbomify.com/CVE-2018-5358/): Denial of service in n/a (medium 6.5)
- [CVE-2018-5357](https://insights.sbomify.com/CVE-2018-5357/): Denial of service in n/a (medium 6.5)
- [CVE-2018-5354](https://insights.sbomify.com/CVE-2018-5354/): Security feature bypass in n/a (high 8.8)
- [CVE-2018-5353](https://insights.sbomify.com/CVE-2018-5353/): Auth bypass in n/a (critical 9.8)
- [CVE-2018-5349](https://insights.sbomify.com/CVE-2018-5349/): Privilege escalation in n/a (high 7.8)
- [CVE-2018-5347](https://insights.sbomify.com/CVE-2018-5347/): Command injection in n/a (critical 9.8)
- [CVE-2018-5345](https://insights.sbomify.com/CVE-2018-5345/): Memory corruption in n/a (high 7.8)
- [CVE-2018-5344](https://insights.sbomify.com/CVE-2018-5344/): Use after free in n/a (high 7.8)
- [CVE-2018-5342](https://insights.sbomify.com/CVE-2018-5342/): Privilege escalation in n/a (high 7.2)
- [CVE-2018-5341](https://insights.sbomify.com/CVE-2018-5341/): File upload in n/a (critical 9.8)
- [CVE-2018-5340](https://insights.sbomify.com/CVE-2018-5340/): Privilege escalation in n/a (high 7.2)
- [CVE-2018-5339](https://insights.sbomify.com/CVE-2018-5339/): Missing authorization in n/a (critical 9.8)
- [CVE-2018-5338](https://insights.sbomify.com/CVE-2018-5338/): Missing authorization in n/a (critical 9.8)
- [CVE-2018-5337](https://insights.sbomify.com/CVE-2018-5337/): Path traversal in n/a (critical 9.8)
- [CVE-2018-5336](https://insights.sbomify.com/CVE-2018-5336/): Denial of service in n/a (high 7.5)
- [CVE-2018-5335](https://insights.sbomify.com/CVE-2018-5335/): Denial of service in n/a (medium 6.5)
- [CVE-2018-5334](https://insights.sbomify.com/CVE-2018-5334/): Denial of service in n/a (medium 6.5)
- [CVE-2018-5333](https://insights.sbomify.com/CVE-2018-5333/): Null dereference in n/a (medium 5.5)
- [CVE-2018-5332](https://insights.sbomify.com/CVE-2018-5332/): Memory corruption in n/a (high 7.8)
- [CVE-2018-5331](https://insights.sbomify.com/CVE-2018-5331/): Cross-site scripting in n/a (medium 5.4)
- [CVE-2018-5330](https://insights.sbomify.com/CVE-2018-5330/): Denial of service in n/a (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/33/