# Vulnerabilities published in 2018


- [CVE-2018-19334](https://insights.sbomify.com/CVE-2018-19334/): Cross-site request forgery in google:monorail (medium 5.3)
- [CVE-2018-19333](https://insights.sbomify.com/CVE-2018-19333/): Memory corruption in google:gvisor (critical 9.8)
- [CVE-2018-19332](https://insights.sbomify.com/CVE-2018-19332/): Cross-site request forgery in s-cms:s-cms (high 8.8)
- [CVE-2018-19331](https://insights.sbomify.com/CVE-2018-19331/): SQL injection in s-cms:s-cms (high 7.5)
- [CVE-2018-1933](https://insights.sbomify.com/CVE-2018-1933/): Cross-site scripting in Planning Analytics (medium 5.4)
- [CVE-2018-19329](https://insights.sbomify.com/CVE-2018-19329/): Path traversal in greencms:greencms (medium 4.9)
- [CVE-2018-19328](https://insights.sbomify.com/CVE-2018-19328/): Path traversal in laobancms:laobancms (critical 9.8)
- [CVE-2018-19327](https://insights.sbomify.com/CVE-2018-19327/): Cross-site request forgery in jtbc:jtbc php (high 8.8)
- [CVE-2018-19326](https://insights.sbomify.com/CVE-2018-19326/): Path traversal in zyxel:vmg1312-b10d firmware (high 7.5)
- [CVE-2018-19324](https://insights.sbomify.com/CVE-2018-19324/): Cross-site scripting in kimsq:rb (medium 5.4)
- [CVE-2018-19323](https://insights.sbomify.com/CVE-2018-19323/): GIGABYTE Multiple Products Privilege Escalation (critical 9.8, exploited in the wild)
- [CVE-2018-19322](https://insights.sbomify.com/CVE-2018-19322/): GIGABYTE Multiple Products Code Execution (high 7.8, exploited in the wild)
- [CVE-2018-19321](https://insights.sbomify.com/CVE-2018-19321/): GIGABYTE Multiple Products Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2018-19320](https://insights.sbomify.com/CVE-2018-19320/): GIGABYTE Multiple Products Unspecified (high 7.8, exploited in the wild)
- [CVE-2018-1932](https://insights.sbomify.com/CVE-2018-1932/): Missing authorization in API Connect (medium 4.9)
- [CVE-2018-19319](https://insights.sbomify.com/CVE-2018-19319/): Cross-site request forgery in srcms project:srcms (medium 6.5)
- [CVE-2018-19318](https://insights.sbomify.com/CVE-2018-19318/): Cross-site request forgery in srcms project:srcms (high 8.8)
- [CVE-2018-19312](https://insights.sbomify.com/CVE-2018-19312/): Centreon SQL Injection (high 8.8)
- [CVE-2018-19311](https://insights.sbomify.com/CVE-2018-19311/): Centreon XSS Vulnerability (medium 5.4)
- [CVE-2018-19301](https://insights.sbomify.com/CVE-2018-19301/): Cross-site scripting in tp4a:teleport (medium 6.1)
- [CVE-2018-19300](https://insights.sbomify.com/CVE-2018-19300/): Command injection in d-link:dap-1530 firmware (critical 9.8)
- [CVE-2018-19296](https://insights.sbomify.com/CVE-2018-19296/): Phar object injection in PHPMailer (high 8.8)
- [CVE-2018-19295](https://insights.sbomify.com/CVE-2018-19295/): Sylabs Singularity Improper Input Validation (high 7.8)
- [CVE-2018-19291](https://insights.sbomify.com/CVE-2018-19291/): Cross-site request forgery in dilicms:dilicms (medium 6.5)
- [CVE-2018-19290](https://insights.sbomify.com/CVE-2018-19290/): Command injection in budabot:budabot (critical 9.8)
- [CVE-2018-1929](https://insights.sbomify.com/CVE-2018-1929/): Missing authorization in Rational Engineering Lifecycle Manager (medium 4.3)
- [CVE-2018-19289](https://insights.sbomify.com/CVE-2018-19289/): Valine HTML Injection (medium 6.1)
- [CVE-2018-19288](https://insights.sbomify.com/CVE-2018-19288/): Cross-site scripting in zohocorp:manageengine opmanager (medium 6.1)
- [CVE-2018-19287](https://insights.sbomify.com/CVE-2018-19287/): Cross-site scripting in ninjaforma:ninja forms (medium 6.1)
- [CVE-2018-19286](https://insights.sbomify.com/CVE-2018-19286/): Cross-site scripting in mubu:curtain (medium 6.1)
- [CVE-2018-19282](https://insights.sbomify.com/CVE-2018-19282/): Denial of service in rockwellautomation:powerflex 525 ac drives firmware (critical 9.8)
- [CVE-2018-19281](https://insights.sbomify.com/CVE-2018-19281/): Centreon allows SNMP trap SQL Injection (critical 9.8)
- [CVE-2018-19280](https://insights.sbomify.com/CVE-2018-19280/): Centreon XSS Vulnerability (medium 6.1)
- [CVE-2018-1928](https://insights.sbomify.com/CVE-2018-1928/): Missing authorization in StoredIQ (medium 6.7)
- [CVE-2018-19279](https://insights.sbomify.com/CVE-2018-19279/): Information disclosure in primx:zonecentral (medium 4.3)
- [CVE-2018-19278](https://insights.sbomify.com/CVE-2018-19278/): Memory corruption in digium:asterisk (high 7.5)
- [CVE-2018-19277](https://insights.sbomify.com/CVE-2018-19277/): XXE in PHPSpreadsheet due to encoding issue (high 8.8)
- [CVE-2018-19276](https://insights.sbomify.com/CVE-2018-19276/): Deserialization in openmrs:openmrs (critical 10.0)
- [CVE-2018-19275](https://insights.sbomify.com/CVE-2018-19275/): Hardcoded credentials in mitel:cmg suite (critical 9.8)
- [CVE-2018-19274](https://insights.sbomify.com/CVE-2018-19274/): phpBB Remote Code Execution (high 7.2)
- [CVE-2018-19271](https://insights.sbomify.com/CVE-2018-19271/): Centreon SQL Injection (high 8.8)
- [CVE-2018-1927](https://insights.sbomify.com/CVE-2018-1927/): Cross-site request forgery in StoredIQ (medium 6.5)
- [CVE-2018-1926](https://insights.sbomify.com/CVE-2018-1926/): Cross-site request forgery in WebSphere Application Server (medium 4.3)
- [CVE-2018-1925](https://insights.sbomify.com/CVE-2018-1925/): Weak cryptography in MQ (medium 5.9)
- [CVE-2018-19249](https://insights.sbomify.com/CVE-2018-19249/): Auth bypass in stripe:stripe api (high 7.5)
- [CVE-2018-19248](https://insights.sbomify.com/CVE-2018-19248/): Missing authorization in epson:epson workforce wf-2861 firmware (critical 9.1)
- [CVE-2018-19246](https://insights.sbomify.com/CVE-2018-19246/): LFI in PHP-Proxy 5.1.0 (high 7.5)
- [CVE-2018-19244](https://insights.sbomify.com/CVE-2018-19244/): XML external entity in charlesproxy:charles (high 8.6)
- [CVE-2018-19242](https://insights.sbomify.com/CVE-2018-19242/): Memory corruption in trendnet:tew-632brp firmware (high 8.8)
- [CVE-2018-19241](https://insights.sbomify.com/CVE-2018-19241/): Memory corruption in trendnet:tv-ip110wn firmware (high 7.5)
- [CVE-2018-19240](https://insights.sbomify.com/CVE-2018-19240/): Memory corruption in trendnet:tv-ip110wn firmware (critical 9.8)
- [CVE-2018-19239](https://insights.sbomify.com/CVE-2018-19239/): Command injection in trendnet:tew-673gru firmware (high 7.2)
- [CVE-2018-19234](https://insights.sbomify.com/CVE-2018-19234/): Security feature bypass in comparex:miss marple (high 8.8)
- [CVE-2018-19233](https://insights.sbomify.com/CVE-2018-19233/): Hardcoded credentials in comparex:miss marple (high 7.8)
- [CVE-2018-19232](https://insights.sbomify.com/CVE-2018-19232/): Denial of service in epson:epson workforce wf-2861 firmware (high 7.5)
- [CVE-2018-1923](https://insights.sbomify.com/CVE-2018-1923/): Memory corruption in DB2 for Linux, UNIX and Windows (high 8.4)
- [CVE-2018-19229](https://insights.sbomify.com/CVE-2018-19229/): Cross-site scripting in laobancms:laobancms (medium 5.4)
- [CVE-2018-19228](https://insights.sbomify.com/CVE-2018-19228/): Path traversal in laobancms:laobancms (high 7.5)
- [CVE-2018-19227](https://insights.sbomify.com/CVE-2018-19227/): Cross-site scripting in laobancms:laobancms (medium 5.4)
- [CVE-2018-19226](https://insights.sbomify.com/CVE-2018-19226/): Information disclosure in laobancms:laobancms (medium 5.3)
- [CVE-2018-19225](https://insights.sbomify.com/CVE-2018-19225/): Cross-site request forgery in laobancms:laobancms (high 8.8)
- [CVE-2018-19224](https://insights.sbomify.com/CVE-2018-19224/): Auth bypass in laobancms:laobancms (high 7.5)
- [CVE-2018-19223](https://insights.sbomify.com/CVE-2018-19223/): Cross-site scripting in laobancms:laobancms (medium 4.8)
- [CVE-2018-19222](https://insights.sbomify.com/CVE-2018-19222/): Auth bypass in laobancms:laobancms (critical 9.8)
- [CVE-2018-19221](https://insights.sbomify.com/CVE-2018-19221/): SQL injection in laobancms:laobancms (critical 9.8)
- [CVE-2018-19220](https://insights.sbomify.com/CVE-2018-19220/): Code injection in laobancms:laobancms (critical 9.8)
- [CVE-2018-1922](https://insights.sbomify.com/CVE-2018-1922/): Memory corruption in DB2 for Linux, UNIX and Windows (high 8.4)
- [CVE-2018-19219](https://insights.sbomify.com/CVE-2018-19219/): Memory corruption in sass-lang:libsass (medium 6.5)
- [CVE-2018-19218](https://insights.sbomify.com/CVE-2018-19218/): Memory corruption in sass-lang:libsass (medium 6.5)
- [CVE-2018-19217](https://insights.sbomify.com/CVE-2018-19217/): Null dereference in invisible-island:ncurses (medium 6.5)
- [CVE-2018-19216](https://insights.sbomify.com/CVE-2018-19216/): Use after free in debian:debian linux (high 7.8)
- [CVE-2018-19215](https://insights.sbomify.com/CVE-2018-19215/): Memory corruption in nasm:netwide assembler (high 7.8)
- [CVE-2018-19214](https://insights.sbomify.com/CVE-2018-19214/): Memory corruption in nasm:netwide assembler (high 7.8)
- [CVE-2018-19213](https://insights.sbomify.com/CVE-2018-19213/): Denial of service in nasm:netwide assembler (medium 5.5)
- [CVE-2018-19212](https://insights.sbomify.com/CVE-2018-19212/): Denial of service in webmproject:libwebm (medium 6.5)
- [CVE-2018-19211](https://insights.sbomify.com/CVE-2018-19211/): Null dereference in invisible-island:ncurses (medium 5.5)
- [CVE-2018-19210](https://insights.sbomify.com/CVE-2018-19210/): Null dereference in canonical:ubuntu linux (medium 6.5)
- [CVE-2018-1921](https://insights.sbomify.com/CVE-2018-1921/): Cross-site scripting in Campaign (medium 5.4)
- [CVE-2018-19209](https://insights.sbomify.com/CVE-2018-19209/): Null dereference in nasm:netwide assembler (medium 5.5)
- [CVE-2018-19208](https://insights.sbomify.com/CVE-2018-19208/): Null dereference in libwpd project:libwpd (medium 6.5)
- [CVE-2018-19207](https://insights.sbomify.com/CVE-2018-19207/): Code injection in van-ons:wp-gdpr-compliance (critical 9.8)
- [CVE-2018-19206](https://insights.sbomify.com/CVE-2018-19206/): Cross-site scripting in debian:debian linux (medium 6.1)
- [CVE-2018-19205](https://insights.sbomify.com/CVE-2018-19205/): Information disclosure in roundcube:webmail (high 7.5)
- [CVE-2018-19204](https://insights.sbomify.com/CVE-2018-19204/): Command injection in paessler:prtg network monitor (high 8.8)
- [CVE-2018-19203](https://insights.sbomify.com/CVE-2018-19203/): Denial of service in paessler:prtg network monitor (high 7.5)
- [CVE-2018-19202](https://insights.sbomify.com/CVE-2018-19202/): Cross-site scripting in mybb:mybb (medium 6.1)
- [CVE-2018-19201](https://insights.sbomify.com/CVE-2018-19201/): Cross-site scripting in mybb:mybb (medium 6.1)
- [CVE-2018-19200](https://insights.sbomify.com/CVE-2018-19200/): Null dereference in debian:debian linux (high 7.5)
- [CVE-2018-1920](https://insights.sbomify.com/CVE-2018-1920/): XML external entity in Marketing Platform (high 7.1)
- [CVE-2018-19199](https://insights.sbomify.com/CVE-2018-19199/): Integer overflow in debian:debian linux (critical 9.8)
- [CVE-2018-19198](https://insights.sbomify.com/CVE-2018-19198/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2018-19197](https://insights.sbomify.com/CVE-2018-19197/): Path traversal in xiaocms:xiaocms (medium 4.9)
- [CVE-2018-19196](https://insights.sbomify.com/CVE-2018-19196/): File upload in xiaocms:xiaocms (critical 9.8)
- [CVE-2018-19195](https://insights.sbomify.com/CVE-2018-19195/): Cross-site scripting in xiaocms:xiaocms (medium 6.1)
- [CVE-2018-19194](https://insights.sbomify.com/CVE-2018-19194/): Information disclosure in xiaocms:xiaocms (medium 5.3)
- [CVE-2018-19193](https://insights.sbomify.com/CVE-2018-19193/): Cross-site scripting in xiaocms:xiaocms (medium 6.1)
- [CVE-2018-19192](https://insights.sbomify.com/CVE-2018-19192/): Cross-site request forgery in xiaocms:xiaocms (high 8.8)
- [CVE-2018-19191](https://insights.sbomify.com/CVE-2018-19191/): Cross-site scripting in webmin:webmin (medium 5.4)
- [CVE-2018-19190](https://insights.sbomify.com/CVE-2018-19190/): Cross-site scripting in amazon:payfort-php-sdk (medium 6.1)
- [CVE-2018-19189](https://insights.sbomify.com/CVE-2018-19189/): Cross-site scripting in amazon:payfort-php-sdk (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/76/