# Vulnerabilities published in 2018


- [CVE-2018-20330](https://insights.sbomify.com/CVE-2018-20330/): Integer overflow in libjpeg-turbo:libjpeg-turbo (high 8.8)
- [CVE-2018-20329](https://insights.sbomify.com/CVE-2018-20329/): SQL injection in chamilo:chamilo lms (high 8.1)
- [CVE-2018-20328](https://insights.sbomify.com/CVE-2018-20328/): Cross-site scripting in chamilo:chamilo lms (medium 5.4)
- [CVE-2018-20327](https://insights.sbomify.com/CVE-2018-20327/): Cross-site scripting in chamilo:chamilo lms (medium 5.4)
- [CVE-2018-20326](https://insights.sbomify.com/CVE-2018-20326/): Cross-site scripting in chinamobile:gpn2.4p21-c-cn firmware (medium 6.1)
- [CVE-2018-20325](https://insights.sbomify.com/CVE-2018-20325/): Code injection in Danijar Definitions (critical 9.8)
- [CVE-2018-20323](https://insights.sbomify.com/CVE-2018-20323/): Command injection in mailcleaner:mailcleaner (high 8.8)
- [CVE-2018-20322](https://insights.sbomify.com/CVE-2018-20322/): Cross-site scripting in limesurvey:limesurvey (medium 6.1)
- [CVE-2018-20321](https://insights.sbomify.com/CVE-2018-20321/): Access Control Bypass (high 8.8)
- [CVE-2018-20318](https://insights.sbomify.com/CVE-2018-20318/): XML external entity in wxjava project:wxjava (critical 9.8)
- [CVE-2018-20316](https://insights.sbomify.com/CVE-2018-20316/): Race condition in foxitsoftware:phantompdf (high 8.1)
- [CVE-2018-20315](https://insights.sbomify.com/CVE-2018-20315/): Race condition in foxitsoftware:phantompdf (high 8.1)
- [CVE-2018-20314](https://insights.sbomify.com/CVE-2018-20314/): Race condition in foxitsoftware:phantompdf (high 8.1)
- [CVE-2018-20313](https://insights.sbomify.com/CVE-2018-20313/): Race condition in foxitsoftware:phantompdf (high 8.1)
- [CVE-2018-20312](https://insights.sbomify.com/CVE-2018-20312/): Race condition in foxitsoftware:phantompdf (high 8.1)
- [CVE-2018-20311](https://insights.sbomify.com/CVE-2018-20311/): Race condition in foxitsoftware:phantompdf (high 8.1)
- [CVE-2018-20310](https://insights.sbomify.com/CVE-2018-20310/): Race condition in foxitsoftware:phantompdf (high 8.1)
- [CVE-2018-20309](https://insights.sbomify.com/CVE-2018-20309/): Race condition in foxitsoftware:phantompdf (high 8.1)
- [CVE-2018-20307](https://insights.sbomify.com/CVE-2018-20307/): Information disclosure in pulsesecure:virtual traffic manager (medium 4.3)
- [CVE-2018-20306](https://insights.sbomify.com/CVE-2018-20306/): Cross-site scripting in pulsesecure:virtual traffic manager (medium 5.4)
- [CVE-2018-20305](https://insights.sbomify.com/CVE-2018-20305/): Memory corruption in d-link:dir-816 a2 firmware (critical 9.8)
- [CVE-2018-20304](https://insights.sbomify.com/CVE-2018-20304/): Memory corruption in libexcel project:libexcel (medium 6.5)
- [CVE-2018-20303](https://insights.sbomify.com/CVE-2018-20303/): Gogs Directory Traversal (high 7.5)
- [CVE-2018-20302](https://insights.sbomify.com/CVE-2018-20302/): Cross-site Scripting in xain (medium 6.1)
- [CVE-2018-20301](https://insights.sbomify.com/CVE-2018-20301/): Permissive parameters and privilege escalation (medium 6.5)
- [CVE-2018-20300](https://insights.sbomify.com/CVE-2018-20300/): Code injection in phome:empirecms (critical 9.8)
- [CVE-2018-20299](https://insights.sbomify.com/CVE-2018-20299/): Memory corruption in bosch:360-indoor camera firmware (critical 9.8)
- [CVE-2018-20298](https://insights.sbomify.com/CVE-2018-20298/): XML external entity in s3browser:s3 browser (medium 6.5)
- [CVE-2018-2028](https://insights.sbomify.com/CVE-2018-2028/): Open redirect in Maximo Asset Management (medium 6.5)
- [CVE-2018-2026](https://insights.sbomify.com/CVE-2018-2026/): Information disclosure in Financial Transaction Manager (medium 4.3)
- [CVE-2018-20253](https://insights.sbomify.com/CVE-2018-20253/): Memory corruption in WinRAR (high 7.8)
- [CVE-2018-20252](https://insights.sbomify.com/CVE-2018-20252/): Memory corruption in WinRAR (high 7.8)
- [CVE-2018-20251](https://insights.sbomify.com/CVE-2018-20251/): Path traversal in WinRAR (medium 5.5)
- [CVE-2018-20250](https://insights.sbomify.com/CVE-2018-20250/): WinRAR Absolute Path Traversal (high 7.8, exploited in the wild)
- [CVE-2018-2025](https://insights.sbomify.com/CVE-2018-2025/): Misconfiguration in Spectrum Protect Backup-Archive Client (medium 5.1)
- [CVE-2018-20249](https://insights.sbomify.com/CVE-2018-20249/): Memory corruption in Foxit Quick PDF Library (high 8.8)
- [CVE-2018-20248](https://insights.sbomify.com/CVE-2018-20248/): Memory corruption in Foxit Quick PDF Library (critical 9.8)
- [CVE-2018-20247](https://insights.sbomify.com/CVE-2018-20247/): Memory corruption in Foxit Quick PDF Library (high 7.8)
- [CVE-2018-20245](https://insights.sbomify.com/CVE-2018-20245/): Improper Certificate Validation in Apache Airflow (high 7.5)
- [CVE-2018-20244](https://insights.sbomify.com/CVE-2018-20244/): Apache Airflow vulnerable to Stored XSS (medium 5.5)
- [CVE-2018-20243](https://insights.sbomify.com/CVE-2018-20243/): Information disclosure in Apache Fineract (high 7.5)
- [CVE-2018-20242](https://insights.sbomify.com/CVE-2018-20242/): Cross-site Scripting in jspwiki-war (medium 6.1)
- [CVE-2018-20241](https://insights.sbomify.com/CVE-2018-20241/): Cross-site scripting in Fisheye and Crucible (medium 5.4)
- [CVE-2018-20240](https://insights.sbomify.com/CVE-2018-20240/): Cross-site scripting in Fisheye and Crucible (medium 4.8)
- [CVE-2018-2024](https://insights.sbomify.com/CVE-2018-2024/): Misconfiguration in QRadar SIEM (medium 4.2)
- [CVE-2018-20239](https://insights.sbomify.com/CVE-2018-20239/): Cross-site scripting in Atlassian Application Links (medium 5.4)
- [CVE-2018-20238](https://insights.sbomify.com/CVE-2018-20238/): Auth bypass in Crowd (high 8.1)
- [CVE-2018-20237](https://insights.sbomify.com/CVE-2018-20237/): Missing authorization in Confluence Data Center (medium 6.5)
- [CVE-2018-20236](https://insights.sbomify.com/CVE-2018-20236/): Command injection in Sourcetree for Windows (high 8.8)
- [CVE-2018-20235](https://insights.sbomify.com/CVE-2018-20235/): Command injection in Sourcetree for Windows (high 8.8)
- [CVE-2018-20234](https://insights.sbomify.com/CVE-2018-20234/): Command injection in Sourcetree for macOS (high 8.8)
- [CVE-2018-20233](https://insights.sbomify.com/CVE-2018-20233/): XML external entity in Universal Plugin Manager (medium 6.5)
- [CVE-2018-20232](https://insights.sbomify.com/CVE-2018-20232/): Cross-site scripting in Jira (medium 5.4)
- [CVE-2018-20231](https://insights.sbomify.com/CVE-2018-20231/): Cross-site request forgery in simbahosting:two-factor-authentication (high 8.8)
- [CVE-2018-20230](https://insights.sbomify.com/CVE-2018-20230/): Memory corruption in gnu:pspp (high 7.8)
- [CVE-2018-20229](https://insights.sbomify.com/CVE-2018-20229/): Path traversal in gitlab:gitlab (high 7.5)
- [CVE-2018-20228](https://insights.sbomify.com/CVE-2018-20228/): Cross-site request forgery in subsonic:subsonic (high 8.0)
- [CVE-2018-20227](https://insights.sbomify.com/CVE-2018-20227/): RDF4J vulnerable to zip slip (high 7.5)
- [CVE-2018-20226](https://insights.sbomify.com/CVE-2018-20226/): Privilege escalation in thehive-project:cortex (high 7.2)
- [CVE-2018-20225](https://insights.sbomify.com/CVE-2018-20225/): Security feature bypass in pypa:pip (high 7.8)
- [CVE-2018-20222](https://insights.sbomify.com/CVE-2018-20222/): XML external entity in airsonic project:airsonic (critical 9.8)
- [CVE-2018-20221](https://insights.sbomify.com/CVE-2018-20221/): Deserialization in deltek:ajera (high 8.8)
- [CVE-2018-20220](https://insights.sbomify.com/CVE-2018-20220/): Missing authorization in teracue:enc-400 hdmi2 firmware (high 7.5)
- [CVE-2018-2022](https://insights.sbomify.com/CVE-2018-2022/): Information disclosure in QRadar SIEM (medium 5.3)
- [CVE-2018-20219](https://insights.sbomify.com/CVE-2018-20219/): Hardcoded credentials in teracue:enc-400 hdmi2 firmware (high 8.1)
- [CVE-2018-20218](https://insights.sbomify.com/CVE-2018-20218/): Command injection in teracue:enc-400 hdmi2 firmware (critical 9.8)
- [CVE-2018-20217](https://insights.sbomify.com/CVE-2018-20217/): Denial of service in debian:debian linux (medium 5.3)
- [CVE-2018-20216](https://insights.sbomify.com/CVE-2018-20216/): Denial of service in canonical:ubuntu linux (high 7.5)
- [CVE-2018-20213](https://insights.sbomify.com/CVE-2018-20213/): Memory corruption in libexcel project:libexcel (high 7.5)
- [CVE-2018-20212](https://insights.sbomify.com/CVE-2018-20212/): Cross-site scripting in twiki:twiki (medium 6.1)
- [CVE-2018-20211](https://insights.sbomify.com/CVE-2018-20211/): Privilege escalation in exiftool project:exiftool (high 7.8)
- [CVE-2018-2021](https://insights.sbomify.com/CVE-2018-2021/): Cross-site scripting in QRadar SIEM (medium 6.1)
- [CVE-2018-20201](https://insights.sbomify.com/CVE-2018-20201/): Memory corruption in pur3:espruino (high 7.8)
- [CVE-2018-20200](https://insights.sbomify.com/CVE-2018-20200/): Security feature bypass in squareup:okhttp (medium 5.9)
- [CVE-2018-20199](https://insights.sbomify.com/CVE-2018-20199/): Null dereference in audiocoding:freeware advanced audio decoder 2 (medium 5.5)
- [CVE-2018-20198](https://insights.sbomify.com/CVE-2018-20198/): Null dereference in audiocoding:freeware advanced audio decoder 2 (medium 5.5)
- [CVE-2018-20197](https://insights.sbomify.com/CVE-2018-20197/): Memory corruption in audiocoding:freeware advanced audio decoder 2 (high 7.8)
- [CVE-2018-20196](https://insights.sbomify.com/CVE-2018-20196/): Memory corruption in audiocoding:freeware advanced audio decoder 2 (high 7.8)
- [CVE-2018-20195](https://insights.sbomify.com/CVE-2018-20195/): Null dereference in audiocoding:freeware advanced audio decoder 2 (medium 5.5)
- [CVE-2018-20194](https://insights.sbomify.com/CVE-2018-20194/): Memory corruption in audiocoding:freeware advanced audio decoder 2 (high 7.8)
- [CVE-2018-20193](https://insights.sbomify.com/CVE-2018-20193/): Privilege escalation in pulsesecure:secure access series ssl vpn sa-4000 (high 8.8)
- [CVE-2018-20191](https://insights.sbomify.com/CVE-2018-20191/): Null dereference in canonical:ubuntu linux (high 7.5)
- [CVE-2018-20190](https://insights.sbomify.com/CVE-2018-20190/): Null dereference in sass-lang:libsass (medium 6.5)
- [CVE-2018-2019](https://insights.sbomify.com/CVE-2018-2019/): XML external entity in Security Identity Manager (high 7.1)
- [CVE-2018-20189](https://insights.sbomify.com/CVE-2018-20189/): Denial of service in debian:debian linux (medium 6.5)
- [CVE-2018-20188](https://insights.sbomify.com/CVE-2018-20188/): Cross-site request forgery in thedaylightstudio:fuel cms (high 8.8)
- [CVE-2018-20187](https://insights.sbomify.com/CVE-2018-20187/): Weak cryptography in botan project:botan (medium 5.9)
- [CVE-2018-20186](https://insights.sbomify.com/CVE-2018-20186/): Denial of service in axiosys:bento4 (medium 6.5)
- [CVE-2018-20185](https://insights.sbomify.com/CVE-2018-20185/): Memory corruption in canonical:ubuntu linux (medium 5.3)
- [CVE-2018-20184](https://insights.sbomify.com/CVE-2018-20184/): Memory corruption in debian:debian linux (medium 6.5)
- [CVE-2018-20182](https://insights.sbomify.com/CVE-2018-20182/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2018-20181](https://insights.sbomify.com/CVE-2018-20181/): Integer overflow in debian:debian linux (critical 9.8)
- [CVE-2018-20180](https://insights.sbomify.com/CVE-2018-20180/): Integer overflow in debian:debian linux (critical 9.8)
- [CVE-2018-20179](https://insights.sbomify.com/CVE-2018-20179/): Integer overflow in rdesktop:rdesktop (critical 9.8)
- [CVE-2018-20178](https://insights.sbomify.com/CVE-2018-20178/): Memory corruption in debian:debian linux (high 7.5)
- [CVE-2018-20177](https://insights.sbomify.com/CVE-2018-20177/): Integer overflow in debian:debian linux (critical 9.8)
- [CVE-2018-20176](https://insights.sbomify.com/CVE-2018-20176/): Memory corruption in rdesktop:rdesktop (high 7.5)
- [CVE-2018-20175](https://insights.sbomify.com/CVE-2018-20175/): Integer overflow in debian:debian linux (high 7.5)
- [CVE-2018-20174](https://insights.sbomify.com/CVE-2018-20174/): Memory corruption in rdesktop:rdesktop (high 7.5)
- [CVE-2018-20173](https://insights.sbomify.com/CVE-2018-20173/): SQL injection in zohocorp:manageengine opmanager (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/68/