# Vulnerabilities published in 2018


- [CVE-2018-19969](https://insights.sbomify.com/CVE-2018-19969/): phpMyAdmin CSRF Vulnerability (high 8.8)
- [CVE-2018-19968](https://insights.sbomify.com/CVE-2018-19968/): phpMyAdmin Local file inclusion through transformation feature (medium 6.5)
- [CVE-2018-19967](https://insights.sbomify.com/CVE-2018-19967/): Denial of service in debian:debian linux (medium 6.5)
- [CVE-2018-19966](https://insights.sbomify.com/CVE-2018-19966/): Memory corruption in debian:debian linux (high 8.8)
- [CVE-2018-19965](https://insights.sbomify.com/CVE-2018-19965/): Denial of service in citrix:xenserver (medium 5.6)
- [CVE-2018-19964](https://insights.sbomify.com/CVE-2018-19964/): Denial of service in xen:xen (medium 6.5)
- [CVE-2018-19963](https://insights.sbomify.com/CVE-2018-19963/): Denial of service in xen:xen (high 7.8)
- [CVE-2018-19962](https://insights.sbomify.com/CVE-2018-19962/): Privilege escalation in citrix:xenserver (high 7.8)
- [CVE-2018-19961](https://insights.sbomify.com/CVE-2018-19961/): Privilege escalation in citrix:xenserver (high 7.8)
- [CVE-2018-19960](https://insights.sbomify.com/CVE-2018-19960/): Other in onionshare:onionshare (high 7.0)
- [CVE-2018-1996](https://insights.sbomify.com/CVE-2018-1996/): Weak cryptography in WebSphere Application Server (medium 5.3)
- [CVE-2018-19957](https://insights.sbomify.com/CVE-2018-19957/): Insufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloud (medium 6.1)
- [CVE-2018-19956](https://insights.sbomify.com/CVE-2018-19956/): Cross-site scripting in Photo Station (medium 6.1)
- [CVE-2018-19955](https://insights.sbomify.com/CVE-2018-19955/): Cross-site scripting in Photo Station (medium 6.1)
- [CVE-2018-19954](https://insights.sbomify.com/CVE-2018-19954/): Cross-site scripting in Photo Station (medium 6.1)
- [CVE-2018-19953](https://insights.sbomify.com/CVE-2018-19953/): QNAP NAS File Station Cross-Site Scripting (medium 6.1, exploited in the wild)
- [CVE-2018-19952](https://insights.sbomify.com/CVE-2018-19952/): SQL injection in Music Station (high 7.5)
- [CVE-2018-19951](https://insights.sbomify.com/CVE-2018-19951/): Cross-site scripting in Music Station (medium 6.1)
- [CVE-2018-19950](https://insights.sbomify.com/CVE-2018-19950/): Command injection in Music Station (critical 9.8)
- [CVE-2018-19949](https://insights.sbomify.com/CVE-2018-19949/): QNAP NAS File Station Command Injection (critical 9.8, exploited in the wild)
- [CVE-2018-19948](https://insights.sbomify.com/CVE-2018-19948/): Cross-site request forgery in Helpdesk (low 2.0)
- [CVE-2018-19947](https://insights.sbomify.com/CVE-2018-19947/): Information disclosure in Helpdesk (medium 4.3)
- [CVE-2018-19946](https://insights.sbomify.com/CVE-2018-19946/): Security feature bypass in Helpdesk (medium 4.2)
- [CVE-2018-19945](https://insights.sbomify.com/CVE-2018-19945/): Improper Limitation of a Pathname to a Restricted Directory in QTS (critical 9.1)
- [CVE-2018-19944](https://insights.sbomify.com/CVE-2018-19944/): Cleartext Transmission of Sensitive Information in SNMP (high 7.5)
- [CVE-2018-19943](https://insights.sbomify.com/CVE-2018-19943/): QNAP NAS File Station Cross-Site Scripting (high 8.0, exploited in the wild)
- [CVE-2018-19942](https://insights.sbomify.com/CVE-2018-19942/): Cross-site Scripting Vulnerability in File Station (medium 6.1)
- [CVE-2018-19941](https://insights.sbomify.com/CVE-2018-19941/): Cleartext Storage of Sensitive Information in Cookies (high 7.5)
- [CVE-2018-1994](https://insights.sbomify.com/CVE-2018-1994/): SQL injection in InfoSphere Information Server (medium 6.3)
- [CVE-2018-19939](https://insights.sbomify.com/CVE-2018-19939/): Null dereference in mi:mi a2 lite firmware (high 7.5)
- [CVE-2018-19937](https://insights.sbomify.com/CVE-2018-19937/): Auth bypass in videolan:vlc for mobile (medium 6.6)
- [CVE-2018-19936](https://insights.sbomify.com/CVE-2018-19936/): Path traversal in printeron:printeron (medium 6.5)
- [CVE-2018-19935](https://insights.sbomify.com/CVE-2018-19935/): Null dereference in debian:debian linux (high 7.5)
- [CVE-2018-19934](https://insights.sbomify.com/CVE-2018-19934/): Cross-site scripting in solarwinds:serv-u ftp server (medium 4.8)
- [CVE-2018-19933](https://insights.sbomify.com/CVE-2018-19933/): Bolt Cross-site Scripting (XSS) via text input click preview button (medium 6.1)
- [CVE-2018-19932](https://insights.sbomify.com/CVE-2018-19932/): Integer overflow in gnu:binutils (medium 5.5)
- [CVE-2018-19931](https://insights.sbomify.com/CVE-2018-19931/): Memory corruption in canonical:ubuntu linux (high 7.8)
- [CVE-2018-1993](https://insights.sbomify.com/CVE-2018-1993/): Information disclosure in Spectrum Scale (medium 4.0)
- [CVE-2018-19927](https://insights.sbomify.com/CVE-2018-19927/): Cross-site scripting in zenitel:ip-stationweb firmware (medium 4.8)
- [CVE-2018-19926](https://insights.sbomify.com/CVE-2018-19926/): Cross-site scripting in zenitel:ip-stationweb firmware (medium 6.1)
- [CVE-2018-19925](https://insights.sbomify.com/CVE-2018-19925/): SQL injection in sales \& company management system project:sales \& company management system (critical 9.8)
- [CVE-2018-19924](https://insights.sbomify.com/CVE-2018-19924/): Cross-site scripting in sales \& company management system project:sales \& company management system (medium 6.1)
- [CVE-2018-19923](https://insights.sbomify.com/CVE-2018-19923/): Cross-site request forgery in sales \& company management system project:sales \& company management system (high 8.8)
- [CVE-2018-19922](https://insights.sbomify.com/CVE-2018-19922/): Cross-site scripting in actiontec:c1000a firmware (medium 6.1)
- [CVE-2018-19921](https://insights.sbomify.com/CVE-2018-19921/): Cross-site scripting in zohocorp:manageengine opmanager (medium 6.1)
- [CVE-2018-1992](https://insights.sbomify.com/CVE-2018-1992/): Memory corruption in Power 9 Systems (medium 6.4)
- [CVE-2018-19919](https://insights.sbomify.com/CVE-2018-19919/): Cross-site scripting in pixelimity:pixelimity (medium 4.8)
- [CVE-2018-19918](https://insights.sbomify.com/CVE-2018-19918/): Cross-site scripting in cuppacms:cuppacms (medium 5.4)
- [CVE-2018-19917](https://insights.sbomify.com/CVE-2018-19917/): Microweber XSS Vulnerability (medium 6.1)
- [CVE-2018-19915](https://insights.sbomify.com/CVE-2018-19915/): Cross-site scripting in domainmod:domainmod (medium 4.8)
- [CVE-2018-19914](https://insights.sbomify.com/CVE-2018-19914/): Cross-site scripting in domainmod:domainmod (medium 4.8)
- [CVE-2018-19913](https://insights.sbomify.com/CVE-2018-19913/): Cross-site scripting in domainmod:domainmod (medium 4.8)
- [CVE-2018-19911](https://insights.sbomify.com/CVE-2018-19911/): Command injection in freeswitch:freeswitch (high 7.5)
- [CVE-2018-1991](https://insights.sbomify.com/CVE-2018-1991/): Information disclosure in API Connect (low 2.7)
- [CVE-2018-19908](https://insights.sbomify.com/CVE-2018-19908/): Command injection in misp-project:misp (high 8.8)
- [CVE-2018-19907](https://insights.sbomify.com/CVE-2018-19907/): OS Command Injection in craftercms:crafter-studio (high 8.8)
- [CVE-2018-19906](https://insights.sbomify.com/CVE-2018-19906/): Cross-site scripting in razorcms:razorcms (medium 5.4)
- [CVE-2018-19905](https://insights.sbomify.com/CVE-2018-19905/): Cross-site scripting in razorcms:razorcms (medium 5.4)
- [CVE-2018-19904](https://insights.sbomify.com/CVE-2018-19904/): Cross-site scripting in xsltcms.org project:xsltcms.org (medium 6.1)
- [CVE-2018-19903](https://insights.sbomify.com/CVE-2018-19903/): Cross-site scripting in xsltcms.org project:xsltcms.org (medium 6.1)
- [CVE-2018-19902](https://insights.sbomify.com/CVE-2018-19902/): Cross-site scripting in no-cms project:no-cms (medium 4.8)
- [CVE-2018-19901](https://insights.sbomify.com/CVE-2018-19901/): Cross-site scripting in no-cms project:no-cms (medium 4.8)
- [CVE-2018-1990](https://insights.sbomify.com/CVE-2018-1990/): Information disclosure in Cloud App Management (medium 5.3)
- [CVE-2018-19898](https://insights.sbomify.com/CVE-2018-19898/): SQL injection in thinkcmf:thinkcmf (high 8.8)
- [CVE-2018-19897](https://insights.sbomify.com/CVE-2018-19897/): SQL injection in thinkcmf:thinkcmf (high 7.2)
- [CVE-2018-19896](https://insights.sbomify.com/CVE-2018-19896/): SQL injection in thinkcmf:thinkcmf (high 7.2)
- [CVE-2018-19895](https://insights.sbomify.com/CVE-2018-19895/): SQL injection in thinkcmf:thinkcmf (high 7.2)
- [CVE-2018-19894](https://insights.sbomify.com/CVE-2018-19894/): SQL injection in thinkcmf:thinkcmf (high 7.2)
- [CVE-2018-19893](https://insights.sbomify.com/CVE-2018-19893/): SQL injection in pbootcms:pbootcms (critical 9.8)
- [CVE-2018-19892](https://insights.sbomify.com/CVE-2018-19892/): Cross-site scripting in domainmod:domainmod (medium 4.8)
- [CVE-2018-19891](https://insights.sbomify.com/CVE-2018-19891/): Memory corruption in audiocoding:freeware advanced audio coder (medium 5.5)
- [CVE-2018-19890](https://insights.sbomify.com/CVE-2018-19890/): Memory corruption in audiocoding:freeware advanced audio coder (medium 5.5)
- [CVE-2018-19889](https://insights.sbomify.com/CVE-2018-19889/): Memory corruption in audiocoding:freeware advanced audio coder (medium 5.5)
- [CVE-2018-19888](https://insights.sbomify.com/CVE-2018-19888/): Memory corruption in audiocoding:freeware advanced audio coder (medium 5.5)
- [CVE-2018-19887](https://insights.sbomify.com/CVE-2018-19887/): Memory corruption in audiocoding:freeware advanced audio coder (medium 5.5)
- [CVE-2018-19886](https://insights.sbomify.com/CVE-2018-19886/): Memory corruption in audiocoding:freeware advanced audio coder (medium 5.5)
- [CVE-2018-19882](https://insights.sbomify.com/CVE-2018-19882/): Null dereference in artifex:mupdf (medium 5.5)
- [CVE-2018-19881](https://insights.sbomify.com/CVE-2018-19881/): Denial of service in artifex:mupdf (medium 5.5)
- [CVE-2018-19879](https://insights.sbomify.com/CVE-2018-19879/): Auth bypass in teltonika:rut950 firmware (high 7.1)
- [CVE-2018-19878](https://insights.sbomify.com/CVE-2018-19878/): Denial of service in teltonika:rut950 firmware (medium 6.5)
- [CVE-2018-19877](https://insights.sbomify.com/CVE-2018-19877/): Cross-site scripting in adiscon:loganalyzer (medium 6.1)
- [CVE-2018-19876](https://insights.sbomify.com/CVE-2018-19876/): Memory corruption in cairographics:cairo (medium 6.5)
- [CVE-2018-19873](https://insights.sbomify.com/CVE-2018-19873/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2018-19872](https://insights.sbomify.com/CVE-2018-19872/): Denial of service in fedoraproject:fedora (medium 5.5)
- [CVE-2018-19871](https://insights.sbomify.com/CVE-2018-19871/): Denial of service in opensuse:leap (medium 6.5)
- [CVE-2018-19870](https://insights.sbomify.com/CVE-2018-19870/): Null dereference in debian:debian linux (high 8.8)
- [CVE-2018-1987](https://insights.sbomify.com/CVE-2018-1987/): Information disclosure in Spectrum Protect for Enterprise Resource Planning (medium 5.1)
- [CVE-2018-19869](https://insights.sbomify.com/CVE-2018-19869/): Denial of service in opensuse:leap (medium 6.5)
- [CVE-2018-19865](https://insights.sbomify.com/CVE-2018-19865/): Information disclosure in opensuse:leap (high 7.5)
- [CVE-2018-19864](https://insights.sbomify.com/CVE-2018-19864/): Memory corruption in nuuo:nvrmini2 firmware (critical 9.8)
- [CVE-2018-19863](https://insights.sbomify.com/CVE-2018-19863/): Information disclosure in agilebits:1password (medium 5.5)
- [CVE-2018-19862](https://insights.sbomify.com/CVE-2018-19862/): Memory corruption in minishare project:minishare (critical 9.8)
- [CVE-2018-19861](https://insights.sbomify.com/CVE-2018-19861/): Memory corruption in minishare project:minishare (critical 9.8)
- [CVE-2018-19860](https://insights.sbomify.com/CVE-2018-19860/): Memory corruption in broadcom:bcm4335c0 firmware (high 8.8)
- [CVE-2018-19859](https://insights.sbomify.com/CVE-2018-19859/): OpenRefine Directory Traversal (medium 6.5)
- [CVE-2018-19858](https://insights.sbomify.com/CVE-2018-19858/): XML external entity in princexml:princexml (high 8.6)
- [CVE-2018-19857](https://insights.sbomify.com/CVE-2018-19857/): Memory corruption in debian:debian linux (critical 9.1)
- [CVE-2018-19856](https://insights.sbomify.com/CVE-2018-19856/): Path traversal in gitlab:gitlab (high 7.5)
- [CVE-2018-19855](https://insights.sbomify.com/CVE-2018-19855/): Code injection in uipath:orchestrator (medium 5.5)
- [CVE-2018-19854](https://insights.sbomify.com/CVE-2018-19854/): Information disclosure in canonical:ubuntu linux (medium 4.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/71/