# Vulnerabilities published in 2018


- [CVE-2018-25331](https://insights.sbomify.com/CVE-2018-25331/): Zenar Content Management System Cross-Site Scripting via ajax.php (medium 5.1)
- [CVE-2018-25330](https://insights.sbomify.com/CVE-2018-25330/): Joomla! EkRishta 2.10 Persistent XSS and SQL Injection (high 8.8)
- [CVE-2018-25329](https://insights.sbomify.com/CVE-2018-25329/): WordPress Plugin WP with Spritz 1.0 Remote File Inclusion (high 8.7)
- [CVE-2018-25328](https://insights.sbomify.com/CVE-2018-25328/): VX Search 10.6.18 Local Buffer Overflow via Directory Field (high 8.6)
- [CVE-2018-25327](https://insights.sbomify.com/CVE-2018-25327/): Joomla! Component Js Jobs 1.2.0 Cross-Site Request Forgery (medium 6.9)
- [CVE-2018-25326](https://insights.sbomify.com/CVE-2018-25326/): Google Drive for WordPress 2.2 Path Traversal RCE via gdrive-ajaxs.php (high 8.7)
- [CVE-2018-25325](https://insights.sbomify.com/CVE-2018-25325/): Woocommerce CSV Importer 3.3.6 Path Traversal File Deletion (high 8.7)
- [CVE-2018-25324](https://insights.sbomify.com/CVE-2018-25324/): Simple Fields 0.2-0.3.5 Local File Inclusion via wp_abspath (medium 6.9)
- [CVE-2018-25323](https://insights.sbomify.com/CVE-2018-25323/): Allok AVI DivX MPEG to DVD Converter 2.6.1217 Buffer Overflow SEH (high 8.6)
- [CVE-2018-25322](https://insights.sbomify.com/CVE-2018-25322/): Allok Fast AVI MPEG Splitter 1.2 Stack Based Buffer Overflow (high 8.6)
- [CVE-2018-25321](https://insights.sbomify.com/CVE-2018-25321/): TP-Link TL-WR720N CSRF via Administrative Interfaces (firmware V1_130719) (medium 5.3)
- [CVE-2018-25320](https://insights.sbomify.com/CVE-2018-25320/): ACL Analytics 11.x - 13.0.0.579 Arbitrary Code Execution (critical 9.3)
- [CVE-2018-25319](https://insights.sbomify.com/CVE-2018-25319/): Redaxo CMS Addon MyEvents 2.2.1 SQL Injection via event_add.php (high 7.1)
- [CVE-2018-25318](https://insights.sbomify.com/CVE-2018-25318/): Tenda FH303/A300 V5.07.68_EN Cookie Session Weakness DNS Change (critical 9.3)
- [CVE-2018-25317](https://insights.sbomify.com/CVE-2018-25317/): Tenda W3002R/A302/W309R V5.07.64_en Cookie Session Weakness DNS Change (critical 9.3)
- [CVE-2018-25316](https://insights.sbomify.com/CVE-2018-25316/): Tenda W308R v2 V5.07.48 Cookie Session Weakness DNS Change (critical 9.3)
- [CVE-2018-25315](https://insights.sbomify.com/CVE-2018-25315/): Alloksoft Video joiner 4.6.1217 Buffer Overflow via License Name (high 8.6)
- [CVE-2018-25314](https://insights.sbomify.com/CVE-2018-25314/): Allok soft WMV to AVI MPEG DVD WMV Converter 4.6.1217 Buffer Overflow (high 8.6)
- [CVE-2018-25313](https://insights.sbomify.com/CVE-2018-25313/): SysGauge 4.5.18 Local Denial of Service via Proxy Configuration (medium 6.9)
- [CVE-2018-25312](https://insights.sbomify.com/CVE-2018-25312/): LifeSize ClearSea 3.1.4 Directory Traversal Remote Code Execution (high 7.1)
- [CVE-2018-25311](https://insights.sbomify.com/CVE-2018-25311/): VideoFlow Digital Video Protection DVP 2.10 Authenticated Directory Traversal (high 7.1)
- [CVE-2018-25310](https://insights.sbomify.com/CVE-2018-25310/): VideoFlow Digital Video Protection DVP 2.10 - Authenticated Remote Code Execution (medium 5.3)
- [CVE-2018-25309](https://insights.sbomify.com/CVE-2018-25309/): MyBB Recent threads 17.0 Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2018-25308](https://insights.sbomify.com/CVE-2018-25308/): BuddyPress Xprofile Custom Fields Type 2.6.3 Arbitrary File Deletion (high 8.7)
- [CVE-2018-25307](https://insights.sbomify.com/CVE-2018-25307/): SysGauge Pro 4.6.12 Local Buffer Overflow SEH (high 8.6)
- [CVE-2018-25306](https://insights.sbomify.com/CVE-2018-25306/): PDFunite 0.41.0 Buffer Overflow via Malformed PDF (medium 6.9)
- [CVE-2018-25305](https://insights.sbomify.com/CVE-2018-25305/): librsvg2-bin 2.40.13 Buffer Overflow via Malformed SVG (medium 6.9)
- [CVE-2018-25304](https://insights.sbomify.com/CVE-2018-25304/): Free Download Manager 2.0 Build 417 Local Buffer Overflow SEH (high 8.6)
- [CVE-2018-25303](https://insights.sbomify.com/CVE-2018-25303/): Allok Video to DVD Burner 2.6.1217 Buffer Overflow SEH (high 8.6)
- [CVE-2018-25302](https://insights.sbomify.com/CVE-2018-25302/): Allok AVI to DVD SVCD VCD Converter 4.0.1217 Buffer Overflow SEH (high 8.5)
- [CVE-2018-25301](https://insights.sbomify.com/CVE-2018-25301/): Easy MPEG to DVD Burner 1.7.11 SEH Local Buffer Overflow (high 8.6)
- [CVE-2018-25300](https://insights.sbomify.com/CVE-2018-25300/): XATABoost CMS 1.0.0 SQL Injection via news.php (high 8.8)
- [CVE-2018-25299](https://insights.sbomify.com/CVE-2018-25299/): Prime95 29.4b8 Local Buffer Overflow via SEH (high 8.6)
- [CVE-2018-25298](https://insights.sbomify.com/CVE-2018-25298/): Merge PACS 7.0 Cross-Site Request Forgery via merge-viewer (medium 6.9)
- [CVE-2018-25297](https://insights.sbomify.com/CVE-2018-25297/): Wansview 1.0.2 Denial of Service via Buffer Overflow (medium 6.9)
- [CVE-2018-25296](https://insights.sbomify.com/CVE-2018-25296/): P10 Central Management Software 1.4.13 Denial of Service (medium 6.8)
- [CVE-2018-25295](https://insights.sbomify.com/CVE-2018-25295/): ObserverIP Scan Tool 1.4.0.1 Denial of Service via IP Field (medium 6.9)
- [CVE-2018-25294](https://insights.sbomify.com/CVE-2018-25294/): CEWE Photoshow 6.3.4 Buffer Overflow Denial of Service (high 8.7)
- [CVE-2018-25293](https://insights.sbomify.com/CVE-2018-25293/): Prime95 29.4b7 Denial of Service via Proxy Password Field (medium 6.9)
- [CVE-2018-25292](https://insights.sbomify.com/CVE-2018-25292/): Bome Restorator 1793 Denial of Service via Buffer Overflow (medium 6.9)
- [CVE-2018-25291](https://insights.sbomify.com/CVE-2018-25291/): Project64 2.3.2 Denial of Service via Plugin Directory (medium 6.9)
- [CVE-2018-25290](https://insights.sbomify.com/CVE-2018-25290/): Easyboot 6.6.0 Buffer Overflow Denial of Service (medium 6.9)
- [CVE-2018-25289](https://insights.sbomify.com/CVE-2018-25289/): Softdisk 3.0.3 Buffer Overflow Denial of Service (medium 6.9)
- [CVE-2018-25288](https://insights.sbomify.com/CVE-2018-25288/): StyleWriter 1.0 Denial of Service via Pattern Input (medium 6.9)
- [CVE-2018-25287](https://insights.sbomify.com/CVE-2018-25287/): Drive Power Manager 1.10 Denial of Service via Name Field (medium 6.8)
- [CVE-2018-25286](https://insights.sbomify.com/CVE-2018-25286/): Easy PhotoResQ 1.0 Buffer Overflow Denial of Service (medium 6.9)
- [CVE-2018-25285](https://insights.sbomify.com/CVE-2018-25285/): Fathom 2.4 Denial of Service via Authorization Code Buffer Overflow (medium 6.8)
- [CVE-2018-25284](https://insights.sbomify.com/CVE-2018-25284/): HD Tune Pro 5.70 Denial of Service via Options Dialog (medium 6.9)
- [CVE-2018-25283](https://insights.sbomify.com/CVE-2018-25283/): iSmartViewPro 1.5 Buffer Overflow via SavePath Parameter (high 8.6)
- [CVE-2018-25282](https://insights.sbomify.com/CVE-2018-25282/): Nmap 7.70 Denial of Service via XML Entity Expansion (medium 6.9)
- [CVE-2018-25281](https://insights.sbomify.com/CVE-2018-25281/): iCash 7.6.5 Denial of Service via Connect to Server (medium 6.8)
- [CVE-2018-25280](https://insights.sbomify.com/CVE-2018-25280/): Infiltrator Network Security Scanner 4.6 Denial of Service (medium 6.8)
- [CVE-2018-25279](https://insights.sbomify.com/CVE-2018-25279/): jiNa OCR Image to Text 1.0 Denial of Service via PNG (medium 6.9)
- [CVE-2018-25278](https://insights.sbomify.com/CVE-2018-25278/): PicaJet FX 2.6.5 Denial of Service via Registration Fields (medium 6.9)
- [CVE-2018-25277](https://insights.sbomify.com/CVE-2018-25277/): PixGPS 1.1.8 Buffer Overflow Denial of Service (medium 6.9)
- [CVE-2018-25276](https://insights.sbomify.com/CVE-2018-25276/): RoboImport 1.2.0.72 Denial of Service via Registration Fields (medium 6.8)
- [CVE-2018-25275](https://insights.sbomify.com/CVE-2018-25275/): Faleemi Plus 1.0.2 Denial of Service via Buffer Overflow (medium 6.9)
- [CVE-2018-25274](https://insights.sbomify.com/CVE-2018-25274/): InfraRecorder 0.53 Denial of Service via txt File Import (medium 6.9)
- [CVE-2018-25273](https://insights.sbomify.com/CVE-2018-25273/): CrossFont 7.5 Denial of Service via License Key Field (medium 6.9)
- [CVE-2018-25272](https://insights.sbomify.com/CVE-2018-25272/): ELBA5 5.8.0 Remote Code Execution via Database Access (critical 9.3)
- [CVE-2018-25271](https://insights.sbomify.com/CVE-2018-25271/): Textpad 8.1.2 Denial of Service via Run Command (medium 6.9)
- [CVE-2018-25270](https://insights.sbomify.com/CVE-2018-25270/): ThinkPHP 5.0.23 Remote Code Execution via invokefunction (critical 9.3)
- [CVE-2018-25269](https://insights.sbomify.com/CVE-2018-25269/): ICEWARP 11.0.0.0 Cross-Site Scripting via Email HTML Injection (medium 5.1)
- [CVE-2018-25268](https://insights.sbomify.com/CVE-2018-25268/): LanSpy 2.0.1.159 Local Buffer Overflow via Scan Field (high 8.6)
- [CVE-2018-25267](https://insights.sbomify.com/CVE-2018-25267/): UltraISO 9.7.1.3519 Buffer Overflow via Output FileName (medium 6.9)
- [CVE-2018-25266](https://insights.sbomify.com/CVE-2018-25266/): Angry IP Scanner 3.5.3 Denial of Service via Preferences Buffer Overflow (medium 6.9)
- [CVE-2018-25265](https://insights.sbomify.com/CVE-2018-25265/): LanSpy 2.0.1.159 Local Buffer Overflow (high 8.6)
- [CVE-2018-25264](https://insights.sbomify.com/CVE-2018-25264/): TransMac 12.2 Denial of Service via License Key Field (medium 6.9)
- [CVE-2018-25263](https://insights.sbomify.com/CVE-2018-25263/): Faleemi Desktop Software 1.8.2 Local Buffer Overflow SEH (high 8.6)
- [CVE-2018-25262](https://insights.sbomify.com/CVE-2018-25262/): Angry IP Scanner for Linux 3.5.3 Denial of Service (medium 6.9)
- [CVE-2018-25261](https://insights.sbomify.com/CVE-2018-25261/): Iperius Backup 5.8.1 Local Buffer Overflow SEH (high 8.6)
- [CVE-2018-25260](https://insights.sbomify.com/CVE-2018-25260/): MAGIX Music Editor 3.1 Buffer Overflow via SEH (high 8.6)
- [CVE-2018-25259](https://insights.sbomify.com/CVE-2018-25259/): Terminal Services Manager 3.1 Buffer Overflow SEH (high 8.6)
- [CVE-2018-25258](https://insights.sbomify.com/CVE-2018-25258/): RGui 3.5.0 Local Buffer Overflow SEH DEP Bypass (high 8.6)
- [CVE-2018-25257](https://insights.sbomify.com/CVE-2018-25257/): Adianti Framework 5.5.0 and 5.6.0 SQL Injection via Profile (high 7.1)
- [CVE-2018-25256](https://insights.sbomify.com/CVE-2018-25256/): IP TOOLS 2.50 Local Buffer Overflow Denial of Service (medium 6.8)
- [CVE-2018-25255](https://insights.sbomify.com/CVE-2018-25255/): 10-Strike LANState 8.8 Local Buffer Overflow SEH (high 8.6)
- [CVE-2018-25254](https://insights.sbomify.com/CVE-2018-25254/): NICO-FTP 3.0.1.19 Buffer Overflow SEH (critical 9.3)
- [CVE-2018-25253](https://insights.sbomify.com/CVE-2018-25253/): Termite 3.4 Denial of Service via Settings Buffer Overflow (medium 6.9)
- [CVE-2018-25252](https://insights.sbomify.com/CVE-2018-25252/): FTP Voyager 16.2.0 Denial of Service via Malformed Site Profile (medium 6.9)
- [CVE-2018-25251](https://insights.sbomify.com/CVE-2018-25251/): Snes9K 0.0.9z Buffer Overflow SEH via Netplay Socket (high 8.6)
- [CVE-2018-25250](https://insights.sbomify.com/CVE-2018-25250/): MyBB Last User's Threads in Profile Plugin 1.2 Persistent XSS (medium 5.1)
- [CVE-2018-25249](https://insights.sbomify.com/CVE-2018-25249/): MyBB My Arcade Plugin 1.3 Persistent XSS via Comment (medium 5.1)
- [CVE-2018-25248](https://insights.sbomify.com/CVE-2018-25248/): MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php (medium 5.1)
- [CVE-2018-25247](https://insights.sbomify.com/CVE-2018-25247/): MyBB Like Plugin 3.0.0 Cross-Site Scripting via User Profiles (medium 5.1)
- [CVE-2018-25246](https://insights.sbomify.com/CVE-2018-25246/): Wikipedia 12.0 Denial of Service via Search (high 8.7)
- [CVE-2018-25245](https://insights.sbomify.com/CVE-2018-25245/): 7 Tik 1.0.1.0 Denial of Service via Search (high 8.7)
- [CVE-2018-25244](https://insights.sbomify.com/CVE-2018-25244/): Eco Search 1.0.2.0 Denial of Service (medium 6.9)
- [CVE-2018-25243](https://insights.sbomify.com/CVE-2018-25243/): FastTube 1.0.1.0 Denial of Service via Search (medium 6.9)
- [CVE-2018-25242](https://insights.sbomify.com/CVE-2018-25242/): One Search 1.1.0.0 Denial of Service (medium 6.9)
- [CVE-2018-25241](https://insights.sbomify.com/CVE-2018-25241/): VPN Browser+ 1.1.0.0 Denial of Service (high 8.7)
- [CVE-2018-25240](https://insights.sbomify.com/CVE-2018-25240/): Watchr 1.1.0.0 Denial of Service via Search (medium 6.9)
- [CVE-2018-25239](https://insights.sbomify.com/CVE-2018-25239/): Smart VPN 1.1.3.0 Denial of Service via Search (medium 6.9)
- [CVE-2018-25238](https://insights.sbomify.com/CVE-2018-25238/): VSCO 1.1.1.0 Denial of Service via Search (medium 6.9)
- [CVE-2018-25237](https://insights.sbomify.com/CVE-2018-25237/): Hirschmann HiSecOS Buffer Overflow via HTTPS Login (critical 9.3)
- [CVE-2018-25236](https://insights.sbomify.com/CVE-2018-25236/): Hirschmann HiOS HiSecOS Authentication Bypass via HTTP Management (critical 9.3)
- [CVE-2018-25235](https://insights.sbomify.com/CVE-2018-25235/): NetworkActiv Web Server 4.0 Username Field Buffer Overflow DoS (medium 6.9)
- [CVE-2018-25234](https://insights.sbomify.com/CVE-2018-25234/): SmartFTP Client 9.0.2615.0 Denial of Service via Host Field (medium 6.9)
- [CVE-2018-25233](https://insights.sbomify.com/CVE-2018-25233/): WebDrive 18.00.5057 Denial of Service via Secure WebDAV (medium 6.9)
- [CVE-2018-25232](https://insights.sbomify.com/CVE-2018-25232/): Softros LAN Messenger 9.2 Denial of Service via Log Files Location (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/55/