# Vulnerabilities published in 2018 - [CVE-2018-20025](https://insights.sbomify.com/CVE-2018-20025/): Weak cryptography in CODESYS V3 products (high 7.5) - [CVE-2018-20024](https://insights.sbomify.com/CVE-2018-20024/): Null dereference in LibVNC (high 7.5) - [CVE-2018-20023](https://insights.sbomify.com/CVE-2018-20023/): Information disclosure in LibVNC (high 7.5) - [CVE-2018-20022](https://insights.sbomify.com/CVE-2018-20022/): Information disclosure in LibVNC (high 7.5) - [CVE-2018-20021](https://insights.sbomify.com/CVE-2018-20021/): Denial of service in LibVNC (high 7.5) - [CVE-2018-20020](https://insights.sbomify.com/CVE-2018-20020/): Memory corruption in LibVNC (critical 9.8) - [CVE-2018-20019](https://insights.sbomify.com/CVE-2018-20019/): Memory corruption in LibVNC (critical 9.8) - [CVE-2018-20018](https://insights.sbomify.com/CVE-2018-20018/): SQL injection in s-cms:s-cms (high 7.5) - [CVE-2018-20017](https://insights.sbomify.com/CVE-2018-20017/): Cross-site scripting in sem-cms:semcms (medium 4.8) - [CVE-2018-20015](https://insights.sbomify.com/CVE-2018-20015/): Cross-site request forgery in yzmcms:yzmcms (high 8.8) - [CVE-2018-20014](https://insights.sbomify.com/CVE-2018-20014/): Null dereference in urbackup:urbackup (high 7.5) - [CVE-2018-20013](https://insights.sbomify.com/CVE-2018-20013/): Denial of service in urbackup:urbackup (high 7.5) - [CVE-2018-20012](https://insights.sbomify.com/CVE-2018-20012/): Cross-site scripting in phpcmf:phpcmf (medium 4.8) - [CVE-2018-20011](https://insights.sbomify.com/CVE-2018-20011/): Cross-site scripting in domainmod:domainmod (medium 4.8) - [CVE-2018-20010](https://insights.sbomify.com/CVE-2018-20010/): Cross-site scripting in domainmod:domainmod (medium 4.8) - [CVE-2018-2001](https://insights.sbomify.com/CVE-2018-2001/): Cross-site request forgery in Cram Social Program Management (medium 4.3) - [CVE-2018-20009](https://insights.sbomify.com/CVE-2018-20009/): Cross-site scripting in domainmod:domainmod (medium 4.8) - [CVE-2018-20008](https://insights.sbomify.com/CVE-2018-20008/): Information disclosure in iball:ib-wrb302n firmware (medium 6.8) - [CVE-2018-20007](https://insights.sbomify.com/CVE-2018-20007/): Misconfiguration in yeelight:smart ai speaker firmware (medium 6.8) - [CVE-2018-20006](https://insights.sbomify.com/CVE-2018-20006/): Cross-site scripting in phpok:phpok (medium 6.1) - [CVE-2018-20005](https://insights.sbomify.com/CVE-2018-20005/): Use after free in fedoraproject:fedora (medium 5.5) - [CVE-2018-20004](https://insights.sbomify.com/CVE-2018-20004/): Memory corruption in debian:debian linux (high 8.8) - [CVE-2018-20002](https://insights.sbomify.com/CVE-2018-20002/): Denial of service in f5:traffix signaling delivery controller (medium 5.5) - [CVE-2018-20001](https://insights.sbomify.com/CVE-2018-20001/): Denial of service in libav:libav (medium 6.5) - [CVE-2018-20000](https://insights.sbomify.com/CVE-2018-20000/): Improper Restriction of XML External Entity Reference in bedework:bw-webdav (high 7.5) - [CVE-2018-2000](https://insights.sbomify.com/CVE-2018-2000/): Cross-site request forgery in Business Automation Workflow (medium 4.3) - [CVE-2018-19999](https://insights.sbomify.com/CVE-2018-19999/): Auth bypass in solarwinds:serv-u ftp server (high 7.8) - [CVE-2018-19998](https://insights.sbomify.com/CVE-2018-19998/): Dolibarr SQL injection vulnerability in user/card.php (high 8.8) - [CVE-2018-19995](https://insights.sbomify.com/CVE-2018-19995/): Dolibarr stored cross-site scripting (XSS) vulnerability (medium 5.4) - [CVE-2018-19994](https://insights.sbomify.com/CVE-2018-19994/): Dolibarr error-based SQL injection vulnerability in product/card.php (high 8.8) - [CVE-2018-19993](https://insights.sbomify.com/CVE-2018-19993/): Dolibarr reflected cross-site scripting (XSS) vulnerability (medium 6.1) - [CVE-2018-19992](https://insights.sbomify.com/CVE-2018-19992/): Dolibarr stored cross-site scripting (XSS) vulnerability (medium 5.4) - [CVE-2018-19991](https://insights.sbomify.com/CVE-2018-19991/): Security feature bypass in verynginx project:verynginx (critical 9.8) - [CVE-2018-1999047](https://insights.sbomify.com/CVE-2018-1999047/): Incorrect Authorization in Jenkins (medium 6.5) - [CVE-2018-1999046](https://insights.sbomify.com/CVE-2018-1999046/): Exposure of Sensitive Information to an Unauthorized Actor in Jenkins (medium 4.3) - [CVE-2018-1999045](https://insights.sbomify.com/CVE-2018-1999045/): Improper Authentication in Jenkins (medium 5.4) - [CVE-2018-1999044](https://insights.sbomify.com/CVE-2018-1999044/): Infinite Loop in Jenkins Core (medium 6.5) - [CVE-2018-1999043](https://insights.sbomify.com/CVE-2018-1999043/): Missing Release of Resource after Effective Lifetime in Jenkins (high 7.5) - [CVE-2018-1999042](https://insights.sbomify.com/CVE-2018-1999042/): Deserialization of Untrusted Data in Jenkins (medium 5.3) - [CVE-2018-1999041](https://insights.sbomify.com/CVE-2018-1999041/): Exposure of sensitive information vulnerability (medium 5.5) - [CVE-2018-1999040](https://insights.sbomify.com/CVE-2018-1999040/): Exposure of Sensitive Information in Jenkins Kubernetes Plugin (high 8.8) - [CVE-2018-1999039](https://insights.sbomify.com/CVE-2018-1999039/): Server-Side Request Forgery (SSRF) in Jenkins Confluence Publisher Plugin (medium 4.3) - [CVE-2018-1999038](https://insights.sbomify.com/CVE-2018-1999038/): Jenkins Publisher Over CIFS Plugin confused deputy vulnerability (medium 4.2) - [CVE-2018-1999037](https://insights.sbomify.com/CVE-2018-1999037/): Jenkins Resource Disposer Plugin allows attacker to stop tracking specified resource (medium 4.3) - [CVE-2018-1999036](https://insights.sbomify.com/CVE-2018-1999036/): Jenkins SSH Agent Plugin exposes SSH private key password to users with permission to read the build log (medium 6.5) - [CVE-2018-1999035](https://insights.sbomify.com/CVE-2018-1999035/): Jenkins Inedo BuildMaster Plugin globally and unconditionally disabled SSL/TLS certificate validation (high 7.4) - [CVE-2018-1999034](https://insights.sbomify.com/CVE-2018-1999034/): Jenkins Inedo ProGet Plugin globally and unconditionally disabled SSL/TLS certificate validation (high 7.4) - [CVE-2018-1999033](https://insights.sbomify.com/CVE-2018-1999033/): Exposure of sensitive information in Anchore Container Image Scanner Jenkins Plugin (medium 6.5) - [CVE-2018-1999032](https://insights.sbomify.com/CVE-2018-1999032/): Jenkins Agiletestware Pangolin Connector for TestRail Plugin CSRF vulnerability and missing permission checks (medium 6.5) - [CVE-2018-1999031](https://insights.sbomify.com/CVE-2018-1999031/): Jenkins meliora-testlab Plugin allows attackers with file system access to Jenkins master to obtain API key (medium 6.5) - [CVE-2018-1999030](https://insights.sbomify.com/CVE-2018-1999030/): Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin CSRF vulnerability and missing permission checks (medium 5.4) - [CVE-2018-1999029](https://insights.sbomify.com/CVE-2018-1999029/): Stored Cross-Site Scripting Vulnerability in Jenkins Shelve Project Plugin (medium 5.4) - [CVE-2018-1999028](https://insights.sbomify.com/CVE-2018-1999028/): Jenkins Accurev Plugin CSRF vulnerability and missing permission checks (high 8.8) - [CVE-2018-1999027](https://insights.sbomify.com/CVE-2018-1999027/): Jenkins SaltStack Plugin allows attackers to capture credentials with a known credentials ID stored in Jenkins (high 7.5) - [CVE-2018-1999026](https://insights.sbomify.com/CVE-2018-1999026/): Jenkins TraceTronic ECU-TEST Plugin server-side request forgery vulnerability (medium 6.5) - [CVE-2018-1999025](https://insights.sbomify.com/CVE-2018-1999025/): Jenkins TraceTronic ECU-TEST Plugin Man in the middle vulnerability (high 7.4) - [CVE-2018-1999024](https://insights.sbomify.com/CVE-2018-1999024/): Macro in MathJax running untrusted Javascript within a web browser (medium 5.4) - [CVE-2018-1999023](https://insights.sbomify.com/CVE-2018-1999023/): Code injection in wesnoth:the battle for wesnoth (high 8.8) - [CVE-2018-1999022](https://insights.sbomify.com/CVE-2018-1999022/): Code injection in civicrm:civicrm (critical 9.8) - [CVE-2018-1999021](https://insights.sbomify.com/CVE-2018-1999021/): Gleez Cms Cross-site Scripting in Profile Page (medium 5.4) - [CVE-2018-1999020](https://insights.sbomify.com/CVE-2018-1999020/): Path traversal in opennetworking:onos (medium 5.5) - [CVE-2018-1999019](https://insights.sbomify.com/CVE-2018-1999019/): Deserialization in chamilo:chamilo lms (critical 9.8) - [CVE-2018-1999018](https://insights.sbomify.com/CVE-2018-1999018/): Command injection in pydio:pydio (medium 6.6) - [CVE-2018-1999017](https://insights.sbomify.com/CVE-2018-1999017/): Server-side request forgery in pydio:pydio (medium 4.9) - [CVE-2018-1999016](https://insights.sbomify.com/CVE-2018-1999016/): Cross-site scripting in pydio:pydio (medium 6.1) - [CVE-2018-1999015](https://insights.sbomify.com/CVE-2018-1999015/): Memory corruption in ffmpeg:ffmpeg (medium 6.5) - [CVE-2018-1999014](https://insights.sbomify.com/CVE-2018-1999014/): Memory corruption in ffmpeg:ffmpeg (medium 6.5) - [CVE-2018-1999013](https://insights.sbomify.com/CVE-2018-1999013/): Use after free in ffmpeg:ffmpeg (medium 6.5) - [CVE-2018-1999012](https://insights.sbomify.com/CVE-2018-1999012/): Denial of service in ffmpeg:ffmpeg (medium 6.5) - [CVE-2018-1999011](https://insights.sbomify.com/CVE-2018-1999011/): Memory corruption in ffmpeg:ffmpeg (high 8.8) - [CVE-2018-1999010](https://insights.sbomify.com/CVE-2018-1999010/): Memory corruption in debian:debian linux (critical 9.8) - [CVE-2018-1999009](https://insights.sbomify.com/CVE-2018-1999009/): October CMS Local File Inclusion (high 8.1) - [CVE-2018-1999008](https://insights.sbomify.com/CVE-2018-1999008/): Cross-site scripting in octobercms:october (medium 5.4) - [CVE-2018-1999007](https://insights.sbomify.com/CVE-2018-1999007/): Cross-site scripting vulnerability exists in Jenkins and Stapler Plugin (medium 5.4) - [CVE-2018-1999006](https://insights.sbomify.com/CVE-2018-1999006/): Exposure of Sensitive Information to an Unauthorized Actor in Jenkins (medium 4.3) - [CVE-2018-1999005](https://insights.sbomify.com/CVE-2018-1999005/): Improper Neutralization of Input During Web Page Generation in Jenkins (medium 5.4) - [CVE-2018-1999004](https://insights.sbomify.com/CVE-2018-1999004/): Incorrect Authorization in Jenkins (medium 4.3) - [CVE-2018-1999003](https://insights.sbomify.com/CVE-2018-1999003/): Incorrect Authorization in Jenkins (medium 4.3) - [CVE-2018-1999002](https://insights.sbomify.com/CVE-2018-1999002/): Improper Input Validation in Jenkins (high 7.5) - [CVE-2018-1999001](https://insights.sbomify.com/CVE-2018-1999001/): Improper Input Validation in Jenkins (high 8.8) - [CVE-2018-19990](https://insights.sbomify.com/CVE-2018-19990/): Command injection in d-link:dir-822 firmware (critical 9.8) - [CVE-2018-1999](https://insights.sbomify.com/CVE-2018-1999/): Information disclosure in Business Automation Workflow (medium 4.3) - [CVE-2018-19989](https://insights.sbomify.com/CVE-2018-19989/): Command injection in d-link:dir-822 firmware (critical 9.8) - [CVE-2018-19988](https://insights.sbomify.com/CVE-2018-19988/): Command injection in d-link:dir-868l firmware (critical 9.8) - [CVE-2018-19987](https://insights.sbomify.com/CVE-2018-19987/): Command injection in d-link:dir-818lw firmware (critical 9.8) - [CVE-2018-19986](https://insights.sbomify.com/CVE-2018-19986/): Command injection in d-link:dir-818lw firmware (critical 9.8) - [CVE-2018-19985](https://insights.sbomify.com/CVE-2018-19985/): Memory corruption in debian:debian linux (medium 4.6) - [CVE-2018-19983](https://insights.sbomify.com/CVE-2018-19983/): Denial of service in silabs:z-wave s0 firmware (medium 6.5) - [CVE-2018-19982](https://insights.sbomify.com/CVE-2018-19982/): Security feature bypass in powermanager:kt mc01507l z-wave s0 firmware (medium 5.3) - [CVE-2018-19981](https://insights.sbomify.com/CVE-2018-19981/): Information disclosure in amazon:aws software development kit (high 7.2) - [CVE-2018-19980](https://insights.sbomify.com/CVE-2018-19980/): Denial of service in anker:nebula capsule projector (high 7.5) - [CVE-2018-1998](https://insights.sbomify.com/CVE-2018-1998/): Command injection in MQ (high 8.8) - [CVE-2018-19978](https://insights.sbomify.com/CVE-2018-19978/): Memory corruption in auerswald:comfortel 1200 ip firmware (high 8.0) - [CVE-2018-19977](https://insights.sbomify.com/CVE-2018-19977/): Command injection in auerswald:comfortel 1200 ip firmware (high 8.0) - [CVE-2018-19976](https://insights.sbomify.com/CVE-2018-19976/): Information disclosure in virustotal:yara (medium 5.5) - [CVE-2018-19975](https://insights.sbomify.com/CVE-2018-19975/): Memory corruption in virustotal:yara (medium 5.5) - [CVE-2018-19974](https://insights.sbomify.com/CVE-2018-19974/): Information disclosure in virustotal:yara (medium 5.5) - [CVE-2018-19971](https://insights.sbomify.com/CVE-2018-19971/): Missing authorization in jfrog:artifactory (critical 9.8) - [CVE-2018-19970](https://insights.sbomify.com/CVE-2018-19970/): phpMyAdmin Cross-site Scripting (XSS) vulnerability (medium 6.1) - [CVE-2018-1997](https://insights.sbomify.com/CVE-2018-1997/): Denial of service in Business Automation Workflow (medium 4.3) --- From sbomify Insights: https://insights.sbomify.com/years/2018/page/70/