# Vulnerabilities published in 2018


- [CVE-2018-25130](https://insights.sbomify.com/CVE-2018-25130/): Beward Intercom 2.3.1 Local Credentials Disclosure via Unencrypted Database (medium 6.8)
- [CVE-2018-25129](https://insights.sbomify.com/CVE-2018-25129/): SOCA Access Control System 180612 Information Disclosure via Multiple Endpoints (high 7.1)
- [CVE-2018-25128](https://insights.sbomify.com/CVE-2018-25128/): SOCA Access Control System 180612 SQL Injection and Authentication Bypass (critical 9.3)
- [CVE-2018-25127](https://insights.sbomify.com/CVE-2018-25127/): SOCA Access Control System 180612 Cross-Site Request Forgery via Admin Interface (medium 5.1)
- [CVE-2018-25126](https://insights.sbomify.com/CVE-2018-25126/): TVT NVMS-9000 Hard-coded API Credentials & Command Injection (critical 9.3)
- [CVE-2018-25125](https://insights.sbomify.com/CVE-2018-25125/): Netis DL4322D RTK 2.1.1 FTP Service DoS (high 8.7)
- [CVE-2018-25124](https://insights.sbomify.com/CVE-2018-25124/): PacsOne Server 6.6.2 DICOM Web Viewer Directory Traversal LFI (high 8.7)
- [CVE-2018-25123](https://insights.sbomify.com/CVE-2018-25123/): Nagios XI < 5.5.7 Privilege Escalation via MRTG Graphing Component (high 8.5)
- [CVE-2018-25122](https://insights.sbomify.com/CVE-2018-25122/): Nagios XI < 5.4.13 Component Download Page RCE (high 8.7)
- [CVE-2018-25121](https://insights.sbomify.com/CVE-2018-25121/): Nagios XI < 5.4.13 XSS via Views Page (medium 5.1)
- [CVE-2018-25120](https://insights.sbomify.com/CVE-2018-25120/): D-Link DNS-343 ShareCenter <= 1.05 Command Injection via /goform/Mail_Test (critical 9.3)
- [CVE-2018-25119](https://insights.sbomify.com/CVE-2018-25119/): Nagios Fusion < 4.1.5 XSS via fusionwindow Parameter (medium 5.1)
- [CVE-2018-25118](https://insights.sbomify.com/CVE-2018-25118/): GeoVision Command Injection RCE via /PictureCatch.cgi (critical 10.0)
- [CVE-2018-25117](https://insights.sbomify.com/CVE-2018-25117/): VestaCP Debian Installer Malicious Backdoor Supply Chain Compromise (critical 9.3)
- [CVE-2018-25116](https://insights.sbomify.com/CVE-2018-25116/): MyBB Thread Redirect Plugin 0.2.1 - Cross-Site Scripting (medium 5.1)
- [CVE-2018-25115](https://insights.sbomify.com/CVE-2018-25115/): D-Link DIR-110/412/600/615/645/815 RCE via service.cgi (critical 10.0)
- [CVE-2018-25114](https://insights.sbomify.com/CVE-2018-25114/): osCommerce 2.3.4.1 Installer Unauthenticated Configuration File Injection PHP Code Execution (critical 9.3)
- [CVE-2018-25113](https://insights.sbomify.com/CVE-2018-25113/): Dicoogle PACS Web Server 2.5.0 Unauthenticated Path Traversal (high 8.7)
- [CVE-2018-25112](https://insights.sbomify.com/CVE-2018-25112/): PHOENIX CONTACT: ILC 1x1 ETH Denial of Service (high 7.5)
- [CVE-2018-25111](https://insights.sbomify.com/CVE-2018-25111/): django-helpdesk Allows Sensitive Data Exposure (medium 5.1)
- [CVE-2018-25110](https://insights.sbomify.com/CVE-2018-25110/): Regular Expression Denial of Service (ReDoS) in markedjs/marked (medium 6.9)
- [CVE-2018-25109](https://insights.sbomify.com/CVE-2018-25109/): Nintendo Animal Crossing Letter Trigram ac-exploit-gc memory corruption (medium 5.4)
- [CVE-2018-25108](https://insights.sbomify.com/CVE-2018-25108/): WAGO: Denial of service in 750-8xx controller due to uncontrolled resource consumption (high 7.5)
- [CVE-2018-25107](https://insights.sbomify.com/CVE-2018-25107/): The Crypt::Random::Source package before 0.13 for Perl has a fallback to the built-in rand() function, which is not a secure source of random bits. (high 7.5)
- [CVE-2018-25106](https://insights.sbomify.com/CVE-2018-25106/): webuidesigning NebulaX Theme Legacy.php nebula_send_to_hubspot sql injection (medium 5.3)
- [CVE-2018-25105](https://insights.sbomify.com/CVE-2018-25105/): File Manager <= 3.0 - Unauthenticated Arbitrary File Upload/Download (critical 9.8)
- [CVE-2018-25104](https://insights.sbomify.com/CVE-2018-25104/): CoinGate Plugin Payment callback.php postProcess logic error (medium 5.3)
- [CVE-2018-25103](https://insights.sbomify.com/CVE-2018-25103/): Use-after-free vulnerabilities in lighttpd <= 1.4.50 (medium 5.3)
- [CVE-2018-25101](https://insights.sbomify.com/CVE-2018-25101/): l2c2technologies Koha opac-MARCdetail.pl cross site scripting (low 3.5)
- [CVE-2018-25100](https://insights.sbomify.com/CVE-2018-25100/): The Mojolicious module before 7.66 for Perl may leak cookies in certain situations related to multiple similar cookies for the same domain. (medium 5.3)
- [CVE-2018-25099](https://insights.sbomify.com/CVE-2018-25099/): In the CryptX module before 0.062 for Perl, gcm_decrypt_verify() and chacha20poly1305_decrypt_verify() do not verify the tag. (critical 9.8)
- [CVE-2018-25098](https://insights.sbomify.com/CVE-2018-25098/): blockmason credit-protocol UCAC CreditProtocol.sol executeUcacTx denial of service (medium 4.3)
- [CVE-2018-25097](https://insights.sbomify.com/CVE-2018-25097/): Acumos Design Studio cross site scripting (low 3.5)
- [CVE-2018-25096](https://insights.sbomify.com/CVE-2018-25096/): MdAlAmin-aol Own Health Record logout.php cross-site request forgery (medium 4.3)
- [CVE-2018-25095](https://insights.sbomify.com/CVE-2018-25095/): Duplicator < 1.3.0 - Unauthenticated RCE (critical 9.8)
- [CVE-2018-25094](https://insights.sbomify.com/CVE-2018-25094/): ระบบบัญชีออนไลน์ Online Accounting System image.php path traversal (low 3.5)
- [CVE-2018-25093](https://insights.sbomify.com/CVE-2018-25093/): Vaerys-Dawn DiscordSailv2 Tag access control (medium 5.5)
- [CVE-2018-25092](https://insights.sbomify.com/CVE-2018-25092/): Vaerys-Dawn DiscordSailv2 Command Mention access control (medium 5.5)
- [CVE-2018-25091](https://insights.sbomify.com/CVE-2018-25091/): Authorization Header forwarded on redirect (medium 6.1)
- [CVE-2018-25090](https://insights.sbomify.com/CVE-2018-25090/): Wago: Improper Neutralization of Input During Web Page Generation in multiple devices (medium 5.4)
- [CVE-2018-25089](https://insights.sbomify.com/CVE-2018-25089/): glb Meetup Tag Extension Link Attribute reverse tabnabbing (low 3.5)
- [CVE-2018-25088](https://insights.sbomify.com/CVE-2018-25088/): Blue Yonder postgraas_server PostgreSQL Backend postgres_cluster_driver.py create_postgres_db sql injection (medium 5.5)
- [CVE-2018-25087](https://insights.sbomify.com/CVE-2018-25087/): Arborator Server project.cgi start denial of service (low 3.5)
- [CVE-2018-25086](https://insights.sbomify.com/CVE-2018-25086/): sea75300 FanPress CM Template Preview templatepreview.php getArticlesPreview cross site scripting (low 3.5)
- [CVE-2018-25085](https://insights.sbomify.com/CVE-2018-25085/): Responsive Menus Configuration Setting responsive_menus.module responsive_menus_admin_form_submit cross site scripting (low 2.4)
- [CVE-2018-25084](https://insights.sbomify.com/CVE-2018-25084/): Ping Identity Self-Service Account Manager SSAMController.java cross site scripting (low 3.5)
- [CVE-2018-25083](https://insights.sbomify.com/CVE-2018-25083/): pullit vulnerable to command injection (critical 9.8)
- [CVE-2018-25082](https://insights.sbomify.com/CVE-2018-25082/): zwczou WeChat SDK Python to_xml xml external entity reference (medium 6.3)
- [CVE-2018-25081](https://insights.sbomify.com/CVE-2018-25081/): Information disclosure in bitwarden:bitwarden (high 7.5)
- [CVE-2018-25080](https://insights.sbomify.com/CVE-2018-25080/): MobileDetect Example session_example.php initLayoutType cross site scripting (low 3.5)
- [CVE-2018-25079](https://insights.sbomify.com/CVE-2018-25079/): Segmentio is-url index.js redos (medium 4.3)
- [CVE-2018-25078](https://insights.sbomify.com/CVE-2018-25078/): Privilege escalation in man-db project:man-db (high 7.8)
- [CVE-2018-25077](https://insights.sbomify.com/CVE-2018-25077/): melnaron mel-spintax spintax.js redos (low 3.5)
- [CVE-2018-25076](https://insights.sbomify.com/CVE-2018-25076/): Events Extension events.php searchResults sql injection (medium 5.5)
- [CVE-2018-25075](https://insights.sbomify.com/CVE-2018-25075/): karsany OBridge ProcedureDao.java getAllStandaloneProcedureAndFunction sql injection (medium 4.6)
- [CVE-2018-25074](https://insights.sbomify.com/CVE-2018-25074/): Prestaul skeemas base.js redos (low 3.5)
- [CVE-2018-25073](https://insights.sbomify.com/CVE-2018-25073/): Newcomer1989 TSN-Ranksystem bot.php getlog cross site scripting (low 3.5)
- [CVE-2018-25072](https://insights.sbomify.com/CVE-2018-25072/): lojban jbovlaste listing.html sql injection (medium 6.3)
- [CVE-2018-25071](https://insights.sbomify.com/CVE-2018-25071/): roxlukas LMeve proxy.php insert_log sql injection (medium 5.5)
- [CVE-2018-25070](https://insights.sbomify.com/CVE-2018-25070/): polterguy Phosphorus Five CSV Import NonQuery.cs csv.Read sql injection (medium 5.5)
- [CVE-2018-25069](https://insights.sbomify.com/CVE-2018-25069/): Netis Netcore Router hard-coded password (high 7.3)
- [CVE-2018-25068](https://insights.sbomify.com/CVE-2018-25068/): devent globalpom-utils FileResourceManagerProvider.java createTmpDir temp file (medium 6.3)
- [CVE-2018-25067](https://insights.sbomify.com/CVE-2018-25067/): JoomGallery Image Sort default.php sql injection (medium 5.5)
- [CVE-2018-25066](https://insights.sbomify.com/CVE-2018-25066/): PeterMu nodebatis sql injection (medium 5.5)
- [CVE-2018-25065](https://insights.sbomify.com/CVE-2018-25065/): Wikimedia mediawiki-extensions-I18nTags Unlike Parser I18nTags_body.php cross site scripting (low 3.5)
- [CVE-2018-25064](https://insights.sbomify.com/CVE-2018-25064/): OSM Lab show-me-the-way site.js cross site scripting (low 3.5)
- [CVE-2018-25063](https://insights.sbomify.com/CVE-2018-25063/): Zenoss Dashboard defaultportlets.js cross site scripting (low 3.5)
- [CVE-2018-25062](https://insights.sbomify.com/CVE-2018-25062/): flar2 ElementalX ipsec xfrm_user.c xfrm_dump_policy_done denial of service (low 3.5)
- [CVE-2018-25061](https://insights.sbomify.com/CVE-2018-25061/): rgb2hex redos (medium 4.3)
- [CVE-2018-25060](https://insights.sbomify.com/CVE-2018-25060/): Macaron csrf csrf.go missing secure attribute (low 3.7)
- [CVE-2018-25059](https://insights.sbomify.com/CVE-2018-25059/): pastebinit server.go pasteHandler path traversal (low 3.5)
- [CVE-2018-25058](https://insights.sbomify.com/CVE-2018-25058/): Twitter-Post-Fetcher Link Target twitterFetcher.js reverse tabnabbing (medium 4.2)
- [CVE-2018-25057](https://insights.sbomify.com/CVE-2018-25057/): simple_php_link_shortener index.php sql injection (medium 5.5)
- [CVE-2018-25056](https://insights.sbomify.com/CVE-2018-25056/): yolapi metadata.py render_description cross site scripting (low 3.5)
- [CVE-2018-25055](https://insights.sbomify.com/CVE-2018-25055/): FarCry Solr Pro Plugin Search solrProSearch.cfc cross site scripting (low 3.5)
- [CVE-2018-25054](https://insights.sbomify.com/CVE-2018-25054/): shred cilla Search search.jsp cross site scripting (low 3.5)
- [CVE-2018-25053](https://insights.sbomify.com/CVE-2018-25053/): moappi Json2html json2html.js cross site scripting (medium 4.3)
- [CVE-2018-25052](https://insights.sbomify.com/CVE-2018-25052/): Catalyst-Plugin-Session Session ID Session.pm _load_sessionid cross site scripting (low 3.5)
- [CVE-2018-25051](https://insights.sbomify.com/CVE-2018-25051/): JmPotato Pomash editor.html cross site scripting (low 2.4)
- [CVE-2018-25050](https://insights.sbomify.com/CVE-2018-25050/): Harvest Chosen abstract-chosen.coffee AbstractChosen cross site scripting (low 3.5)
- [CVE-2018-2505](https://insights.sbomify.com/CVE-2018-2505/): Cross-site scripting in SAP Commerce (SAP Hybris Commerce) (medium 6.1)
- [CVE-2018-25049](https://insights.sbomify.com/CVE-2018-25049/): email-existence index.js redos (low 3.0)
- [CVE-2018-25048](https://insights.sbomify.com/CVE-2018-25048/): Codesys Runtime Improper Limitation of a Pathname (high 8.8)
- [CVE-2018-25047](https://insights.sbomify.com/CVE-2018-25047/): Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailto (medium 5.4)
- [CVE-2018-25046](https://insights.sbomify.com/CVE-2018-25046/): Path traversal in code.cloudfoundry.org/archiver (critical 9.1)
- [CVE-2018-25045](https://insights.sbomify.com/CVE-2018-25045/): Django REST framework XSS Vulnerability (medium 6.1)
- [CVE-2018-25044](https://insights.sbomify.com/CVE-2018-25044/): uTorrent Guest Account privileges management (medium 6.3)
- [CVE-2018-25043](https://insights.sbomify.com/CVE-2018-25043/): uTorrent PRNG improper authentication (medium 5.0)
- [CVE-2018-25042](https://insights.sbomify.com/CVE-2018-25042/): uTorrent memory corruption (medium 5.0)
- [CVE-2018-25041](https://insights.sbomify.com/CVE-2018-25041/): uTorrent JSON RPC Server privileges management (medium 6.3)
- [CVE-2018-25040](https://insights.sbomify.com/CVE-2018-25040/): uTorrent Web HTTP RPC Server privileges management (medium 6.3)
- [CVE-2018-2504](https://insights.sbomify.com/CVE-2018-2504/): Cross-site scripting in SAP NetWeaver AS Java (ServerCore) (medium 6.1)
- [CVE-2018-25039](https://insights.sbomify.com/CVE-2018-25039/): Thomson TCW710 RgUrlBlock.asp Persistent cross site scriting (low 3.5)
- [CVE-2018-25038](https://insights.sbomify.com/CVE-2018-25038/): Thomson TCW710 RgDhcp Persistent cross site scriting (low 3.5)
- [CVE-2018-25037](https://insights.sbomify.com/CVE-2018-25037/): Thomson TCW710 RgDdns Persistent cross site scriting (low 3.5)
- [CVE-2018-25036](https://insights.sbomify.com/CVE-2018-25036/): Thomson TCW710 RgTime Persistent cross site scriting (low 3.5)
- [CVE-2018-25035](https://insights.sbomify.com/CVE-2018-25035/): Thomson TCW710 RGFirewallEL Persistent cross site scriting (low 3.5)
- [CVE-2018-25034](https://insights.sbomify.com/CVE-2018-25034/): Thomson TCW710 wlanPrimaryNetwork Persistent cross site scripting (low 3.5)
- [CVE-2018-25033](https://insights.sbomify.com/CVE-2018-25033/): Out-of-bounds read in admesh (high 8.1)
- [CVE-2018-25032](https://insights.sbomify.com/CVE-2018-25032/): Nokogiri affected by zlib's Out-of-bounds Write vulnerability (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/57/