# Vulnerabilities published in 2018


- [CVE-2018-25031](https://insights.sbomify.com/CVE-2018-25031/): Spoofing attack in swagger-ui (medium 4.3)
- [CVE-2018-25030](https://insights.sbomify.com/CVE-2018-25030/): Mirmay Secure Private Browser / File Manager Auto Lock improper authentication (low 3.3)
- [CVE-2018-2503](https://insights.sbomify.com/CVE-2018-2503/): Missing authorization in SAP NetWeaver AS Java (ServerCore) (high 7.4)
- [CVE-2018-25029](https://insights.sbomify.com/CVE-2018-25029/): Security feature bypass in Z-Wave (high 8.1)
- [CVE-2018-25028](https://insights.sbomify.com/CVE-2018-25028/): Use after free in libpulse-binding project:libpulse-binding (high 7.5)
- [CVE-2018-25027](https://insights.sbomify.com/CVE-2018-25027/): Use after free in libpulse-binding project:libpulse-binding (high 7.5)
- [CVE-2018-25026](https://insights.sbomify.com/CVE-2018-25026/): Out-of-bounds Write in actix-web (critical 9.8)
- [CVE-2018-25025](https://insights.sbomify.com/CVE-2018-25025/): Out-of-bounds Write in actix-web (critical 9.8)
- [CVE-2018-25024](https://insights.sbomify.com/CVE-2018-25024/): Out-of-bounds Write in actix-web (critical 9.8)
- [CVE-2018-25023](https://insights.sbomify.com/CVE-2018-25023/): Use of Uninitialized Resource in smallvec (high 7.5)
- [CVE-2018-25022](https://insights.sbomify.com/CVE-2018-25022/): Information disclosure in toktok:toxcore (low 3.1)
- [CVE-2018-25021](https://insights.sbomify.com/CVE-2018-25021/): Denial of service in toktok:toxcore (high 7.5)
- [CVE-2018-25020](https://insights.sbomify.com/CVE-2018-25020/): Integer overflow in linux:linux kernel (high 7.8)
- [CVE-2018-2502](https://insights.sbomify.com/CVE-2018-2502/): Misconfiguration in SAP Business One Service Layer (B1 ON HANA) (medium 6.1)
- [CVE-2018-25019](https://insights.sbomify.com/CVE-2018-25019/): LearnDash < 2.5.4 - Unauthenticated Arbitrary File Upload (high 7.5)
- [CVE-2018-25018](https://insights.sbomify.com/CVE-2018-25018/): Memory corruption in rarlab:unrar (high 7.8)
- [CVE-2018-25017](https://insights.sbomify.com/CVE-2018-25017/): Memory corruption in rawspeed:rawspeed (critical 9.8)
- [CVE-2018-25016](https://insights.sbomify.com/CVE-2018-25016/): Other in greenbone:greenbone os (critical 9.8)
- [CVE-2018-25015](https://insights.sbomify.com/CVE-2018-25015/): Use after free in linux:linux kernel (high 7.8)
- [CVE-2018-25014](https://insights.sbomify.com/CVE-2018-25014/): Memory corruption in libwebp (critical 9.8)
- [CVE-2018-25013](https://insights.sbomify.com/CVE-2018-25013/): Memory corruption in libwebp (critical 9.1)
- [CVE-2018-25012](https://insights.sbomify.com/CVE-2018-25012/): Memory corruption in libwebp (critical 9.1)
- [CVE-2018-25011](https://insights.sbomify.com/CVE-2018-25011/): Memory corruption in libwebp (critical 9.8)
- [CVE-2018-25010](https://insights.sbomify.com/CVE-2018-25010/): Memory corruption in libwebp (critical 9.1)
- [CVE-2018-25009](https://insights.sbomify.com/CVE-2018-25009/): Memory corruption in libwebp (critical 9.1)
- [CVE-2018-25008](https://insights.sbomify.com/CVE-2018-25008/): Race condition in rust-lang:rust (medium 5.9)
- [CVE-2018-25007](https://insights.sbomify.com/CVE-2018-25007/): Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11 (low 2.6)
- [CVE-2018-25004](https://insights.sbomify.com/CVE-2018-25004/): Invariant failure when explaining a find with a UUID (medium 4.9)
- [CVE-2018-25002](https://insights.sbomify.com/CVE-2018-25002/): Other in sunhater:kcfinder (high 8.8)
- [CVE-2018-25001](https://insights.sbomify.com/CVE-2018-25001/): Duplicate Advisory: Use after free in libpulse-binding (medium 6.5)
- [CVE-2018-2500](https://insights.sbomify.com/CVE-2018-2500/): Information disclosure in SAP Mobile Secure for Android (medium 4.7)
- [CVE-2018-2499](https://insights.sbomify.com/CVE-2018-2499/): Information disclosure in SAP Financial Consolidation Cube Designer (BOBJ EADES) (high 7.5)
- [CVE-2018-2497](https://insights.sbomify.com/CVE-2018-2497/): Other in SAP HANA (low 2.7)
- [CVE-2018-2494](https://insights.sbomify.com/CVE-2018-2494/): Privilege escalation in SAP Basis (ABAP Platform) (high 8.0)
- [CVE-2018-2492](https://insights.sbomify.com/CVE-2018-2492/): XML external entity in SAP NetWeaver Application Server (Java Library) (high 7.1)
- [CVE-2018-2491](https://insights.sbomify.com/CVE-2018-2491/): Cross-site scripting in SAP Fiori Client (high 7.8)
- [CVE-2018-2490](https://insights.sbomify.com/CVE-2018-2490/): Missing authorization in SAP Fiori Client (high 7.8)
- [CVE-2018-2489](https://insights.sbomify.com/CVE-2018-2489/): Missing authorization in SAP Fiori Client (high 7.8)
- [CVE-2018-2488](https://insights.sbomify.com/CVE-2018-2488/): Denial of service in SAP Fiori Client (high 7.8)
- [CVE-2018-2487](https://insights.sbomify.com/CVE-2018-2487/): Path traversal in SAP Disclosure Management (high 8.3)
- [CVE-2018-2486](https://insights.sbomify.com/CVE-2018-2486/): Cross-site scripting in SAP Marketing (SAPSCORE) (medium 5.4)
- [CVE-2018-2485](https://insights.sbomify.com/CVE-2018-2485/): Cross-site scripting in SAP Fiori Client (high 7.7)
- [CVE-2018-2484](https://insights.sbomify.com/CVE-2018-2484/): Missing authorization in SAP Enterprise Financial Services (Bank/CFM) (high 8.8)
- [CVE-2018-2483](https://insights.sbomify.com/CVE-2018-2483/): Auth bypass in SAP BusinessObjects Business Intelligence Platform (medium 4.3)
- [CVE-2018-2482](https://insights.sbomify.com/CVE-2018-2482/): Denial of service in SAP Mobile Secure Android Application (high 7.5)
- [CVE-2018-2481](https://insights.sbomify.com/CVE-2018-2481/): Privilege escalation in SAP ABA (high 7.2)
- [CVE-2018-2479](https://insights.sbomify.com/CVE-2018-2479/): Cross-site scripting in SAP BusinessObjects Business Intelligence Platform (BIWorkspace) (medium 6.1)
- [CVE-2018-2478](https://insights.sbomify.com/CVE-2018-2478/): Command injection in SAP Basis (TREX / BWA installation) (high 7.2)
- [CVE-2018-2477](https://insights.sbomify.com/CVE-2018-2477/): XML external entity in Knowledge Management (XMLForms) in SAP NetWeaver (high 8.8)
- [CVE-2018-2476](https://insights.sbomify.com/CVE-2018-2476/): Open redirect in SAP NetWeaver (forums) (medium 6.1)
- [CVE-2018-2475](https://insights.sbomify.com/CVE-2018-2475/): Misconfiguration in project “Gardener” (high 8.5)
- [CVE-2018-2474](https://insights.sbomify.com/CVE-2018-2474/): Cross-site request forgery in SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) (medium 6.5)
- [CVE-2018-2473](https://insights.sbomify.com/CVE-2018-2473/): Denial of service in SAP BusinessObjects Business Intelligence Platform Server (medium 6.5)
- [CVE-2018-2472](https://insights.sbomify.com/CVE-2018-2472/): Cross-site scripting in SAP BusinessObjects Business Intelligence Platform (medium 6.1)
- [CVE-2018-2471](https://insights.sbomify.com/CVE-2018-2471/): Information disclosure in SAP BusinessObjects Business Intelligence Platform (high 7.5)
- [CVE-2018-2470](https://insights.sbomify.com/CVE-2018-2470/): Cross-site scripting in SAP NetWeaver Application Server for ABAP (medium 6.1)
- [CVE-2018-2469](https://insights.sbomify.com/CVE-2018-2469/): Information disclosure in SAP Adaptive Server Enterprise (ASE) (high 7.5)
- [CVE-2018-2468](https://insights.sbomify.com/CVE-2018-2468/): Information disclosure in SAP Adaptive Server Enterprise (ASE) (high 7.5)
- [CVE-2018-2467](https://insights.sbomify.com/CVE-2018-2467/): Information disclosure in SAP BusinessObjects BI Platform Servers (Software Development Kit) (medium 5.3)
- [CVE-2018-2466](https://insights.sbomify.com/CVE-2018-2466/): Cross-site scripting in SAP Data Services (medium 5.4)
- [CVE-2018-2465](https://insights.sbomify.com/CVE-2018-2465/): Denial of service in SAP HANA (high 7.5)
- [CVE-2018-2464](https://insights.sbomify.com/CVE-2018-2464/): Cross-site scripting in SAP WebDynpro (medium 6.1)
- [CVE-2018-2463](https://insights.sbomify.com/CVE-2018-2463/): Server-side request forgery in SAP Hybris Commerce (high 8.6)
- [CVE-2018-2462](https://insights.sbomify.com/CVE-2018-2462/): XML external entity in SAP NetWeaver BI (high 8.8)
- [CVE-2018-2461](https://insights.sbomify.com/CVE-2018-2461/): Missing authorization in GBX01 HR (high 8.8)
- [CVE-2018-2460](https://insights.sbomify.com/CVE-2018-2460/): Security feature bypass in SAP Business One Android application (medium 5.9)
- [CVE-2018-2459](https://insights.sbomify.com/CVE-2018-2459/): Information disclosure in SAP Mobile Platform (high 7.5)
- [CVE-2018-2458](https://insights.sbomify.com/CVE-2018-2458/): Information disclosure in SAP Business One (high 7.5)
- [CVE-2018-2457](https://insights.sbomify.com/CVE-2018-2457/): Information disclosure in SAP Adaptive Server Enterprise (medium 6.5)
- [CVE-2018-2455](https://insights.sbomify.com/CVE-2018-2455/): Missing authorization in SAP Enterprise Financial Services (high 8.8)
- [CVE-2018-2454](https://insights.sbomify.com/CVE-2018-2454/): Missing authorization in SAP Enterprise Financial Services (high 8.8)
- [CVE-2018-2452](https://insights.sbomify.com/CVE-2018-2452/): Cross-site scripting in SAP NetWeaver AS Java (medium 6.1)
- [CVE-2018-2451](https://insights.sbomify.com/CVE-2018-2451/): Auth bypass in SAP HANA Extended Application Services (medium 6.6)
- [CVE-2018-2450](https://insights.sbomify.com/CVE-2018-2450/): SQL injection in SAP MaxDB (liveCache) (high 7.2)
- [CVE-2018-2449](https://insights.sbomify.com/CVE-2018-2449/): Auth bypass in SAP Supplier Relationship Management Master Data Management Catalog (high 8.6)
- [CVE-2018-2448](https://insights.sbomify.com/CVE-2018-2448/): Information disclosure in SAP SRM-MDM CATALOG (medium 5.3)
- [CVE-2018-2447](https://insights.sbomify.com/CVE-2018-2447/): SQL injection in SAP BusinessObjects Business Intelligence (medium 6.5)
- [CVE-2018-2446](https://insights.sbomify.com/CVE-2018-2446/): Information disclosure in SAP BusinessObjects Business Intelligence (high 7.5)
- [CVE-2018-2445](https://insights.sbomify.com/CVE-2018-2445/): Server-side request forgery in SAP BusinessObjects Business Intelligence Platform (critical 9.6)
- [CVE-2018-2444](https://insights.sbomify.com/CVE-2018-2444/): Cross-site scripting in SAP BusinessObjects Financial Consolidation (medium 6.1)
- [CVE-2018-2442](https://insights.sbomify.com/CVE-2018-2442/): Cross-site request forgery in SAP BusinessObjects Business Intelligence (high 8.8)
- [CVE-2018-2441](https://insights.sbomify.com/CVE-2018-2441/): Information disclosure in SAP Change and Transport System (ABAP) (medium 5.5)
- [CVE-2018-2440](https://insights.sbomify.com/CVE-2018-2440/): Information disclosure in SAP Dynamic Authorization Management (DAM) by NextLabs (Java Policy Controller versions) (medium 4.4)
- [CVE-2018-2439](https://insights.sbomify.com/CVE-2018-2439/): Denial of service in SAP Internet Graphics Server (IGS) (medium 5.9)
- [CVE-2018-2438](https://insights.sbomify.com/CVE-2018-2438/): Denial of service in SAP Internet Graphics Server (IGS) (high 7.5)
- [CVE-2018-2437](https://insights.sbomify.com/CVE-2018-2437/): Command injection in SAP Internet Graphics Server (IGS) (critical 9.1)
- [CVE-2018-2436](https://insights.sbomify.com/CVE-2018-2436/): Missing authorization in SAP R/3 Enterprise Retail (high 8.8)
- [CVE-2018-2435](https://insights.sbomify.com/CVE-2018-2435/): Cross-site scripting in SAP NetWeaver Enterprise Portal (medium 6.1)
- [CVE-2018-2434](https://insights.sbomify.com/CVE-2018-2434/): Other in SAP NetWeaver (medium 4.3)
- [CVE-2018-2433](https://insights.sbomify.com/CVE-2018-2433/): Denial of service in SAP Gateway (high 7.5)
- [CVE-2018-2432](https://insights.sbomify.com/CVE-2018-2432/): Cross-site scripting in SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) (medium 5.4)
- [CVE-2018-2431](https://insights.sbomify.com/CVE-2018-2431/): Cross-site scripting in SAP BusinessObjects Business Intelligence Suite (medium 6.1)
- [CVE-2018-2428](https://insights.sbomify.com/CVE-2018-2428/): Information disclosure in SAP Infrastructure (medium 5.3)
- [CVE-2018-2427](https://insights.sbomify.com/CVE-2018-2427/): Code injection in SAP BusinessObjects Business Intelligence Suite (high 8.8)
- [CVE-2018-2425](https://insights.sbomify.com/CVE-2018-2425/): Information disclosure in SAP Business One (high 8.4)
- [CVE-2018-2424](https://insights.sbomify.com/CVE-2018-2424/): Cross-site scripting in SAP HANA Database (critical 9.8)
- [CVE-2018-2423](https://insights.sbomify.com/CVE-2018-2423/): Denial of service in SAP Internet Graphics Server (IGS) (medium 5.3)
- [CVE-2018-2422](https://insights.sbomify.com/CVE-2018-2422/): Denial of service in SAP Internet Graphics Server (IGS) (medium 5.3)
- [CVE-2018-2421](https://insights.sbomify.com/CVE-2018-2421/): Denial of service in SAP Internet Graphics Server (IGS) (medium 5.3)
- [CVE-2018-2420](https://insights.sbomify.com/CVE-2018-2420/): File upload in SAP Internet Graphics Server (IGS) (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/58/