# Vulnerabilities published in 2018


- [CVE-2018-20172](https://insights.sbomify.com/CVE-2018-20172/): Cross-site scripting in nagios:nagios xi (medium 6.1)
- [CVE-2018-20171](https://insights.sbomify.com/CVE-2018-20171/): Cross-site scripting in nagios:nagios xi (medium 6.1)
- [CVE-2018-20170](https://insights.sbomify.com/CVE-2018-20170/): Information disclosure in openstack:keystone (medium 5.3)
- [CVE-2018-20169](https://insights.sbomify.com/CVE-2018-20169/): Memory corruption in canonical:ubuntu linux (medium 6.8)
- [CVE-2018-20168](https://insights.sbomify.com/CVE-2018-20168/): Denial of service in google:gvisor (medium 5.5)
- [CVE-2018-20167](https://insights.sbomify.com/CVE-2018-20167/): Command injection in enlightenment:terminology (high 7.8)
- [CVE-2018-20166](https://insights.sbomify.com/CVE-2018-20166/): File upload in rukovoditel:rukovoditel (high 8.8)
- [CVE-2018-20165](https://insights.sbomify.com/CVE-2018-20165/): Cross-site scripting in opentext:opentext portal (medium 6.1)
- [CVE-2018-20164](https://insights.sbomify.com/CVE-2018-20164/): uap-core Regular Expression Denial of Service issue (medium 5.3)
- [CVE-2018-20162](https://insights.sbomify.com/CVE-2018-20162/): Command injection in digi:transport lr54 firmware (critical 9.9)
- [CVE-2018-20161](https://insights.sbomify.com/CVE-2018-20161/): Denial of service in blinkforhome:sync module (medium 6.5)
- [CVE-2018-20160](https://insights.sbomify.com/CVE-2018-20160/): XML external entity in synacor:zimbra collaboration suite (critical 9.8)
- [CVE-2018-20159](https://insights.sbomify.com/CVE-2018-20159/): File upload in i-doit:i-doit (high 7.2)
- [CVE-2018-20157](https://insights.sbomify.com/CVE-2018-20157/): XML external entity in openrefine:openrefine (high 7.5)
- [CVE-2018-20156](https://insights.sbomify.com/CVE-2018-20156/): Code injection in designmodo:wp maintenance mode (high 7.2)
- [CVE-2018-20155](https://insights.sbomify.com/CVE-2018-20155/): Missing authorization in designmodo:wp maintenance mode (medium 4.3)
- [CVE-2018-20154](https://insights.sbomify.com/CVE-2018-20154/): Information disclosure in designmodo:wp maintenance mode (medium 4.3)
- [CVE-2018-20153](https://insights.sbomify.com/CVE-2018-20153/): Cross-site scripting in debian:debian linux (medium 5.4)
- [CVE-2018-20152](https://insights.sbomify.com/CVE-2018-20152/): Security feature bypass in debian:debian linux (medium 6.5)
- [CVE-2018-20151](https://insights.sbomify.com/CVE-2018-20151/): Information disclosure in debian:debian linux (high 7.5)
- [CVE-2018-20150](https://insights.sbomify.com/CVE-2018-20150/): Cross-site scripting in debian:debian linux (medium 6.1)
- [CVE-2018-2015](https://insights.sbomify.com/CVE-2018-2015/): Other in API Connect (medium 6.4)
- [CVE-2018-20149](https://insights.sbomify.com/CVE-2018-20149/): Cross-site scripting in debian:debian linux (medium 5.4)
- [CVE-2018-20148](https://insights.sbomify.com/CVE-2018-20148/): Deserialization in debian:debian linux (critical 9.8)
- [CVE-2018-20147](https://insights.sbomify.com/CVE-2018-20147/): Missing authorization in debian:debian linux (medium 6.5)
- [CVE-2018-20146](https://insights.sbomify.com/CVE-2018-20146/): Privilege escalation in liquidware:flexapp (high 7.8)
- [CVE-2018-20145](https://insights.sbomify.com/CVE-2018-20145/): Security feature bypass in eclipse:mosquitto (high 7.5)
- [CVE-2018-20144](https://insights.sbomify.com/CVE-2018-20144/): Path traversal in gitlab:gitlab (high 7.5)
- [CVE-2018-20141](https://insights.sbomify.com/CVE-2018-20141/): Cross-site scripting in abantecart:abantecart (medium 6.1)
- [CVE-2018-20140](https://insights.sbomify.com/CVE-2018-20140/): Cross-site scripting in zenphoto:zenphoto (medium 6.1)
- [CVE-2018-20138](https://insights.sbomify.com/CVE-2018-20138/): Cross-site scripting in readymadeb2bscript:entrepreneur b2b script (medium 5.4)
- [CVE-2018-20137](https://insights.sbomify.com/CVE-2018-20137/): Cross-site scripting in thedaylightstudio:fuel cms (medium 4.8)
- [CVE-2018-20136](https://insights.sbomify.com/CVE-2018-20136/): Cross-site scripting in thedaylightstudio:fuel cms (medium 4.8)
- [CVE-2018-20135](https://insights.sbomify.com/CVE-2018-20135/): Security feature bypass in samsung:galaxy apps (high 8.1)
- [CVE-2018-20133](https://insights.sbomify.com/CVE-2018-20133/): Code injection in ymlref (critical 9.8)
- [CVE-2018-20131](https://insights.sbomify.com/CVE-2018-20131/): Misconfiguration in code42:code42 (high 7.8)
- [CVE-2018-2013](https://insights.sbomify.com/CVE-2018-2013/): Information disclosure in API Connect (medium 5.3)
- [CVE-2018-20129](https://insights.sbomify.com/CVE-2018-20129/): File upload in dedecms:dedecms (high 8.8)
- [CVE-2018-20128](https://insights.sbomify.com/CVE-2018-20128/): Path traversal in usualtool:usualtoolcms (high 7.5)
- [CVE-2018-20127](https://insights.sbomify.com/CVE-2018-20127/): File upload in zzzcms:zzzphp (high 7.5)
- [CVE-2018-20126](https://insights.sbomify.com/CVE-2018-20126/): Denial of service in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-20125](https://insights.sbomify.com/CVE-2018-20125/): Null dereference in canonical:ubuntu linux (high 7.5)
- [CVE-2018-20124](https://insights.sbomify.com/CVE-2018-20124/): Memory corruption in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-20123](https://insights.sbomify.com/CVE-2018-20123/): Denial of service in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-20122](https://insights.sbomify.com/CVE-2018-20122/): Command injection in fastweb:fastgate firmware (critical 9.8)
- [CVE-2018-20121](https://insights.sbomify.com/CVE-2018-20121/): Cross-site scripting in podcastgenerator:podcast generator (medium 6.1)
- [CVE-2018-20114](https://insights.sbomify.com/CVE-2018-20114/): Command injection in dlink:dir-818lw firmware (critical 9.8)
- [CVE-2018-2011](https://insights.sbomify.com/CVE-2018-2011/): Information disclosure in API Connect (medium 5.3)
- [CVE-2018-20106](https://insights.sbomify.com/CVE-2018-20106/): SMB printer settings don't escape characters in passwords properly (medium 6.5)
- [CVE-2018-20105](https://insights.sbomify.com/CVE-2018-20105/): yast2-rmt exposes CA private key passhrase in log-file (medium 4.0)
- [CVE-2018-20103](https://insights.sbomify.com/CVE-2018-20103/): Denial of service in canonical:ubuntu linux (high 7.5)
- [CVE-2018-20102](https://insights.sbomify.com/CVE-2018-20102/): Memory corruption in canonical:ubuntu linux (high 7.5)
- [CVE-2018-20101](https://insights.sbomify.com/CVE-2018-20101/): Cross-site scripting in codection:import users from csv with meta (medium 6.1)
- [CVE-2018-20100](https://insights.sbomify.com/CVE-2018-20100/): Weak cryptography in august:august connect (critical 9.8)
- [CVE-2018-20099](https://insights.sbomify.com/CVE-2018-20099/): Denial of service in exiv2:exiv2 (medium 6.5)
- [CVE-2018-20098](https://insights.sbomify.com/CVE-2018-20098/): Memory corruption in exiv2:exiv2 (medium 6.5)
- [CVE-2018-20097](https://insights.sbomify.com/CVE-2018-20097/): Memory corruption in debian:debian linux (medium 6.5)
- [CVE-2018-20096](https://insights.sbomify.com/CVE-2018-20096/): Memory corruption in exiv2:exiv2 (medium 6.5)
- [CVE-2018-20095](https://insights.sbomify.com/CVE-2018-20095/): Denial of service in axiosys:bento4 (medium 6.5)
- [CVE-2018-20094](https://insights.sbomify.com/CVE-2018-20094/): XXL-CONF Path Traversal vulnerability (high 7.5)
- [CVE-2018-20092](https://insights.sbomify.com/CVE-2018-20092/): Path traversal in ptc:thingworx platform (high 7.5)
- [CVE-2018-20091](https://insights.sbomify.com/CVE-2018-20091/): SQL injection in cloudera:data science workbench (critical 9.9)
- [CVE-2018-20090](https://insights.sbomify.com/CVE-2018-20090/): Missing authorization in cloudera:data science workbench (high 8.3)
- [CVE-2018-2009](https://insights.sbomify.com/CVE-2018-2009/): Information disclosure in API Connect (medium 6.5)
- [CVE-2018-2008](https://insights.sbomify.com/CVE-2018-2008/): Information disclosure in TRIRIGA Application Platform (medium 4.3)
- [CVE-2018-20073](https://insights.sbomify.com/CVE-2018-20073/): Information disclosure in Chrome (medium 5.5)
- [CVE-2018-20072](https://insights.sbomify.com/CVE-2018-20072/): Memory corruption in Chrome (high 7.8)
- [CVE-2018-20071](https://insights.sbomify.com/CVE-2018-20071/): Cross-site scripting in Chrome (medium 6.1)
- [CVE-2018-20070](https://insights.sbomify.com/CVE-2018-20070/): Other in Chrome (medium 6.5)
- [CVE-2018-2007](https://insights.sbomify.com/CVE-2018-2007/): Weak cryptography in API Connect (medium 5.9)
- [CVE-2018-20069](https://insights.sbomify.com/CVE-2018-20069/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2018-20068](https://insights.sbomify.com/CVE-2018-20068/): Other in Chrome (medium 4.3)
- [CVE-2018-20067](https://insights.sbomify.com/CVE-2018-20067/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2018-20066](https://insights.sbomify.com/CVE-2018-20066/): Use after free in Chrome (high 8.8)
- [CVE-2018-20065](https://insights.sbomify.com/CVE-2018-20065/): Security feature bypass in Chrome (high 8.8)
- [CVE-2018-20064](https://insights.sbomify.com/CVE-2018-20064/): Path traversal in doorgets:doorgets (high 7.5)
- [CVE-2018-20063](https://insights.sbomify.com/CVE-2018-20063/): File upload in gurock:testrail (high 8.8)
- [CVE-2018-20062](https://insights.sbomify.com/CVE-2018-20062/): ThinkPHP "noneCms" Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2018-20061](https://insights.sbomify.com/CVE-2018-20061/): SQL injection in frappe:erpnext (high 7.5)
- [CVE-2018-20060](https://insights.sbomify.com/CVE-2018-20060/): Exposure of Sensitive Information to an Unauthorized Actor in urllib3 (critical 9.8)
- [CVE-2018-2006](https://insights.sbomify.com/CVE-2018-2006/): Path traversal in Robotic Process Automation with Automation Anywhere (medium 4.9)
- [CVE-2018-20059](https://insights.sbomify.com/CVE-2018-20059/): Improper Restriction of XML External Entity Reference in pippo-core (critical 9.8)
- [CVE-2018-20058](https://insights.sbomify.com/CVE-2018-20058/): Path traversal in evernote:evernote (high 7.5)
- [CVE-2018-20057](https://insights.sbomify.com/CVE-2018-20057/): Command injection in d-link:dir-605l firmware (high 8.8)
- [CVE-2018-20056](https://insights.sbomify.com/CVE-2018-20056/): Memory corruption in d-link:dir-605l firmware (critical 9.8)
- [CVE-2018-20053](https://insights.sbomify.com/CVE-2018-20053/): Command injection in cerner:connectivity engine 4 firmware (critical 9.8)
- [CVE-2018-20052](https://insights.sbomify.com/CVE-2018-20052/): Privilege escalation in cerner:connectivity engine 4 firmware (high 7.8)
- [CVE-2018-20051](https://insights.sbomify.com/CVE-2018-20051/): Denial of service in qacctv:jooan ja-q1h wi-fi camera firmware (high 7.5)
- [CVE-2018-20050](https://insights.sbomify.com/CVE-2018-20050/): Denial of service in qacctv:jooan ja-q1h wi-fi camera firmware (high 7.5)
- [CVE-2018-2005](https://insights.sbomify.com/CVE-2018-2005/): Information disclosure in BigFix Platform (low 3.3)
- [CVE-2018-2004](https://insights.sbomify.com/CVE-2018-2004/): Cross-site scripting in Jazz Reporting Service (medium 5.4)
- [CVE-2018-20034](https://insights.sbomify.com/CVE-2018-20034/): Denial of service in FlexNet Publisher (high 7.5)
- [CVE-2018-20033](https://insights.sbomify.com/CVE-2018-20033/): Denial of service in FlexNet Publisher (critical 9.8)
- [CVE-2018-20032](https://insights.sbomify.com/CVE-2018-20032/): Denial of service in FlexNet Publisher (high 7.5)
- [CVE-2018-20031](https://insights.sbomify.com/CVE-2018-20031/): Denial of service in FlexNet Publisher (high 7.5)
- [CVE-2018-20030](https://insights.sbomify.com/CVE-2018-20030/): Denial of service in libexif (high 7.5)
- [CVE-2018-20029](https://insights.sbomify.com/CVE-2018-20029/): Memory corruption in dokan-dev:dokany (medium 5.5)
- [CVE-2018-20028](https://insights.sbomify.com/CVE-2018-20028/): Contao Information Disclosure via Access Control Flaws (medium 6.5)
- [CVE-2018-20027](https://insights.sbomify.com/CVE-2018-20027/): Code injection in lisa-lab:pylearn2 (critical 9.8)
- [CVE-2018-20026](https://insights.sbomify.com/CVE-2018-20026/): Misconfiguration in CODESYS V3 products (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/69/