# Vulnerabilities published in 2018


- [CVE-2018-21025](https://insights.sbomify.com/CVE-2018-21025/): Centreon Privilege Escalation (critical 9.8)
- [CVE-2018-21024](https://insights.sbomify.com/CVE-2018-21024/): File upload in centreon:centreon (critical 9.8)
- [CVE-2018-21023](https://insights.sbomify.com/CVE-2018-21023/): Code injection in centreon:centreon web (high 8.8)
- [CVE-2018-21022](https://insights.sbomify.com/CVE-2018-21022/): SQL injection in centreon:centreon web (high 8.8)
- [CVE-2018-21021](https://insights.sbomify.com/CVE-2018-21021/): SQL injection in centreon:centreon web (high 8.8)
- [CVE-2018-21020](https://insights.sbomify.com/CVE-2018-21020/): Auth bypass in centreon:centreon web (high 7.5)
- [CVE-2018-21019](https://insights.sbomify.com/CVE-2018-21019/): Home Assistant information disclosure vulnerability (high 7.5)
- [CVE-2018-21018](https://insights.sbomify.com/CVE-2018-21018/): Other in joinmastodon:mastodon (critical 9.8)
- [CVE-2018-21017](https://insights.sbomify.com/CVE-2018-21017/): Denial of service in gpac:gpac (medium 6.5)
- [CVE-2018-21016](https://insights.sbomify.com/CVE-2018-21016/): Memory corruption in debian:debian linux (medium 6.5)
- [CVE-2018-21015](https://insights.sbomify.com/CVE-2018-21015/): Null dereference in debian:debian linux (medium 6.5)
- [CVE-2018-21014](https://insights.sbomify.com/CVE-2018-21014/): Cross-site scripting in buddyboss:buddymoss media (medium 5.4)
- [CVE-2018-21013](https://insights.sbomify.com/CVE-2018-21013/): Privilege escalation in upperthemes:swape (critical 9.8)
- [CVE-2018-21012](https://insights.sbomify.com/CVE-2018-21012/): Cross-site scripting in vsourz:cf7 invisible recaptcha (medium 6.1)
- [CVE-2018-21011](https://insights.sbomify.com/CVE-2018-21011/): Missing authorization in wpcharitable:charitable (high 7.5)
- [CVE-2018-21010](https://insights.sbomify.com/CVE-2018-21010/): Memory corruption in debian:debian linux (high 8.8)
- [CVE-2018-21009](https://insights.sbomify.com/CVE-2018-21009/): Integer overflow in freedesktop:poppler (high 8.8)
- [CVE-2018-21008](https://insights.sbomify.com/CVE-2018-21008/): Use after free in linux:linux kernel (medium 5.5)
- [CVE-2018-21007](https://insights.sbomify.com/CVE-2018-21007/): Missing authorization in wisetr:user email verification for woocommerce (critical 9.8)
- [CVE-2018-21006](https://insights.sbomify.com/CVE-2018-21006/): Cross-site request forgery in bbpress move topics project:bbpress move topics (high 8.8)
- [CVE-2018-21005](https://insights.sbomify.com/CVE-2018-21005/): Code injection in bbpress move topics project:bbpress move topics (critical 9.8)
- [CVE-2018-21004](https://insights.sbomify.com/CVE-2018-21004/): SQL injection in carrcommunications:rsvpmaker (critical 9.8)
- [CVE-2018-21003](https://insights.sbomify.com/CVE-2018-21003/): SQL injection in themekraft:buddyforms (critical 9.8)
- [CVE-2018-21002](https://insights.sbomify.com/CVE-2018-21002/): Cross-site request forgery in joomsky:js help desk (high 8.8)
- [CVE-2018-21001](https://insights.sbomify.com/CVE-2018-21001/): Cross-site scripting in bologer:anycomment (medium 6.1)
- [CVE-2018-21000](https://insights.sbomify.com/CVE-2018-21000/): Heap overflow or corruption in safe-transmute (critical 9.8)
- [CVE-2018-20999](https://insights.sbomify.com/CVE-2018-20999/): Flaw in streaming state in orion (high 7.5)
- [CVE-2018-20998](https://insights.sbomify.com/CVE-2018-20998/): Potential memory corruption in arrayfire (critical 9.8)
- [CVE-2018-20997](https://insights.sbomify.com/CVE-2018-20997/): Use after free in openssl (critical 9.8)
- [CVE-2018-20996](https://insights.sbomify.com/CVE-2018-20996/): Double free in crossbeam (critical 9.8)
- [CVE-2018-20995](https://insights.sbomify.com/CVE-2018-20995/): Memory corruption slice-deque (critical 9.8)
- [CVE-2018-20994](https://insights.sbomify.com/CVE-2018-20994/): Uncontrolled recursion in trust-dns-proto (high 7.5)
- [CVE-2018-20993](https://insights.sbomify.com/CVE-2018-20993/): Uncontrolled recursion in rust-yaml (high 7.5)
- [CVE-2018-20992](https://insights.sbomify.com/CVE-2018-20992/): Uninitialized memory exposure in claxon (medium 6.5)
- [CVE-2018-20991](https://insights.sbomify.com/CVE-2018-20991/): Double free in smallvec (critical 9.8)
- [CVE-2018-20990](https://insights.sbomify.com/CVE-2018-20990/): Arbitrary file overwrite in tar-rs (high 7.5)
- [CVE-2018-20989](https://insights.sbomify.com/CVE-2018-20989/): Integer underflow in untrusted (high 7.5)
- [CVE-2018-20988](https://insights.sbomify.com/CVE-2018-20988/): Code injection in google forms project:google forms (high 7.5)
- [CVE-2018-20987](https://insights.sbomify.com/CVE-2018-20987/): Deserialization in tribulant:newsletters (critical 9.8)
- [CVE-2018-20986](https://insights.sbomify.com/CVE-2018-20986/): Cross-site scripting in advancedcustomfields:advanced custom fields (medium 5.4)
- [CVE-2018-20985](https://insights.sbomify.com/CVE-2018-20985/): Path traversal in payeezy:wp payeezy pay (critical 9.8)
- [CVE-2018-20984](https://insights.sbomify.com/CVE-2018-20984/): Deserialization in patreon:patreon wordpress (critical 9.8)
- [CVE-2018-20983](https://insights.sbomify.com/CVE-2018-20983/): Cross-site scripting in meowapps:wp retina 2x (medium 6.1)
- [CVE-2018-20982](https://insights.sbomify.com/CVE-2018-20982/): Cross-site scripting in davidlingren:media library assistant (medium 6.1)
- [CVE-2018-20981](https://insights.sbomify.com/CVE-2018-20981/): Information disclosure in ninjaforms:ninja forms (critical 9.1)
- [CVE-2018-20980](https://insights.sbomify.com/CVE-2018-20980/): Other in ninjaforms:ninja forms (high 7.5)
- [CVE-2018-20979](https://insights.sbomify.com/CVE-2018-20979/): Privilege escalation in rocklobster:contact form 7 (critical 9.8)
- [CVE-2018-20978](https://insights.sbomify.com/CVE-2018-20978/): Cross-site scripting in soflyy:wp all import (medium 6.1)
- [CVE-2018-20977](https://insights.sbomify.com/CVE-2018-20977/): Cross-site scripting in brainstormforce:schema (medium 6.1)
- [CVE-2018-20976](https://insights.sbomify.com/CVE-2018-20976/): Use after free in linux:linux kernel (high 7.8)
- [CVE-2018-20975](https://insights.sbomify.com/CVE-2018-20975/): Cross-site scripting in fat_free_crm (medium 6.1)
- [CVE-2018-20974](https://insights.sbomify.com/CVE-2018-20974/): Cross-site request forgery in joomsky:js job manager (high 8.8)
- [CVE-2018-20973](https://insights.sbomify.com/CVE-2018-20973/): Path traversal in codeermeneer:companion auto update (critical 9.8)
- [CVE-2018-20972](https://insights.sbomify.com/CVE-2018-20972/): Cross-site request forgery in codeermeneer:companion auto update (high 8.8)
- [CVE-2018-20971](https://insights.sbomify.com/CVE-2018-20971/): Cross-site request forgery in churchadminplugin:church admin (high 8.8)
- [CVE-2018-20970](https://insights.sbomify.com/CVE-2018-20970/): Cross-site scripting in bestwebsoft:pdf \& print (medium 6.1)
- [CVE-2018-20969](https://insights.sbomify.com/CVE-2018-20969/): Command injection in gnu:patch (high 7.8)
- [CVE-2018-20968](https://insights.sbomify.com/CVE-2018-20968/): Cross-site request forgery in smackcoders:ultimate exporter (high 8.8)
- [CVE-2018-20967](https://insights.sbomify.com/CVE-2018-20967/): Cross-site request forgery in smackcoders:import all pages\, post types\, products\, orders\, and users as xml \& csv (high 8.8)
- [CVE-2018-20966](https://insights.sbomify.com/CVE-2018-20966/): Cross-site scripting in booster:booster for woocommerce (medium 6.1)
- [CVE-2018-20965](https://insights.sbomify.com/CVE-2018-20965/): Cross-site scripting in ultimatemember:ultimate member (medium 6.1)
- [CVE-2018-20964](https://insights.sbomify.com/CVE-2018-20964/): Cross-site request forgery in codepeople:contact form email (high 8.8)
- [CVE-2018-20963](https://insights.sbomify.com/CVE-2018-20963/): Cross-site scripting in codepeople:contact form email (medium 6.1)
- [CVE-2018-20962](https://insights.sbomify.com/CVE-2018-20962/): Backpack\CRUD for Laravel XSS Vulnerability (medium 6.1)
- [CVE-2018-20961](https://insights.sbomify.com/CVE-2018-20961/): Memory corruption in linux:linux kernel (critical 9.8)
- [CVE-2018-20960](https://insights.sbomify.com/CVE-2018-20960/): Security feature bypass in nespresso:prodigo firmware (high 8.1)
- [CVE-2018-20959](https://insights.sbomify.com/CVE-2018-20959/): Security feature bypass in jura:e8 firmware (high 8.1)
- [CVE-2018-20958](https://insights.sbomify.com/CVE-2018-20958/): Weak cryptography in tapplock:tapplock firmware (medium 6.5)
- [CVE-2018-20957](https://insights.sbomify.com/CVE-2018-20957/): Auth bypass in tapplock:one\+ firmware (high 8.8)
- [CVE-2018-20956](https://insights.sbomify.com/CVE-2018-20956/): Information disclosure in swann:swwhd-intcam-hd firmware (medium 5.5)
- [CVE-2018-20955](https://insights.sbomify.com/CVE-2018-20955/): Hardcoded credentials in swann:swwhd-intcam-hd firmware (critical 9.8)
- [CVE-2018-20954](https://insights.sbomify.com/CVE-2018-20954/): Weak cryptography in mailpile:mailpile (high 7.5)
- [CVE-2018-20953](https://insights.sbomify.com/CVE-2018-20953/): Cross-site scripting in cpanel:cpanel (medium 6.1)
- [CVE-2018-20952](https://insights.sbomify.com/CVE-2018-20952/): Information disclosure in cpanel:cpanel (medium 6.5)
- [CVE-2018-20951](https://insights.sbomify.com/CVE-2018-20951/): Cross-site scripting in cpanel:cpanel (medium 6.1)
- [CVE-2018-20950](https://insights.sbomify.com/CVE-2018-20950/): Cross-site scripting in cpanel:cpanel (medium 6.1)
- [CVE-2018-20949](https://insights.sbomify.com/CVE-2018-20949/): Cross-site scripting in cpanel:cpanel (medium 6.1)
- [CVE-2018-20948](https://insights.sbomify.com/CVE-2018-20948/): Cross-site scripting in cpanel:cpanel (medium 6.1)
- [CVE-2018-20947](https://insights.sbomify.com/CVE-2018-20947/): Other in cpanel:cpanel (medium 5.5)
- [CVE-2018-20946](https://insights.sbomify.com/CVE-2018-20946/): Information disclosure in cpanel:cpanel (low 3.3)
- [CVE-2018-20945](https://insights.sbomify.com/CVE-2018-20945/): Other in cpanel:cpanel (medium 5.7)
- [CVE-2018-20944](https://insights.sbomify.com/CVE-2018-20944/): Information disclosure in cpanel:cpanel (low 3.3)
- [CVE-2018-20943](https://insights.sbomify.com/CVE-2018-20943/): Race condition in cpanel:cpanel (low 2.5)
- [CVE-2018-20942](https://insights.sbomify.com/CVE-2018-20942/): Race condition in cpanel:cpanel (low 2.5)
- [CVE-2018-20941](https://insights.sbomify.com/CVE-2018-20941/): Path traversal in cpanel:cpanel (medium 5.6)
- [CVE-2018-20940](https://insights.sbomify.com/CVE-2018-20940/): Race condition in cpanel:cpanel (low 3.3)
- [CVE-2018-20939](https://insights.sbomify.com/CVE-2018-20939/): Information disclosure in cpanel:cpanel (low 3.3)
- [CVE-2018-20938](https://insights.sbomify.com/CVE-2018-20938/): Missing authorization in cpanel:cpanel (low 2.7)
- [CVE-2018-20937](https://insights.sbomify.com/CVE-2018-20937/): Other in cpanel:cpanel (medium 4.3)
- [CVE-2018-20936](https://insights.sbomify.com/CVE-2018-20936/): Information disclosure in cpanel:cpanel (low 3.3)
- [CVE-2018-20935](https://insights.sbomify.com/CVE-2018-20935/): Cross-site scripting in cpanel:cpanel (medium 5.4)
- [CVE-2018-20934](https://insights.sbomify.com/CVE-2018-20934/): Missing authorization in cpanel:cpanel (medium 6.5)
- [CVE-2018-20933](https://insights.sbomify.com/CVE-2018-20933/): Cross-site scripting in cpanel:cpanel (medium 5.4)
- [CVE-2018-20932](https://insights.sbomify.com/CVE-2018-20932/): Information disclosure in cpanel:cpanel (low 2.7)
- [CVE-2018-20931](https://insights.sbomify.com/CVE-2018-20931/): Code injection in cpanel:cpanel (medium 6.3)
- [CVE-2018-20930](https://insights.sbomify.com/CVE-2018-20930/): Security feature bypass in cpanel:cpanel (medium 6.5)
- [CVE-2018-20929](https://insights.sbomify.com/CVE-2018-20929/): Open redirect in cpanel:cpanel (medium 6.1)
- [CVE-2018-20928](https://insights.sbomify.com/CVE-2018-20928/): Cross-site scripting in cpanel:cpanel (medium 6.1)
- [CVE-2018-20927](https://insights.sbomify.com/CVE-2018-20927/): Security feature bypass in cpanel:cpanel (low 3.8)
- [CVE-2018-20926](https://insights.sbomify.com/CVE-2018-20926/): File upload in cpanel:cpanel (medium 6.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/62/