# Vulnerabilities published in 2018


- [CVE-2018-19069](https://insights.sbomify.com/CVE-2018-19069/): Hardcoded credentials in foscam:c2 application firmware (critical 9.8)
- [CVE-2018-19068](https://insights.sbomify.com/CVE-2018-19068/): Auth bypass in foscam:c2 application firmware (medium 4.9)
- [CVE-2018-19067](https://insights.sbomify.com/CVE-2018-19067/): Hardcoded credentials in foscam:c2 application firmware (critical 9.8)
- [CVE-2018-19066](https://insights.sbomify.com/CVE-2018-19066/): Hardcoded credentials in foscam:c2 application firmware (high 7.5)
- [CVE-2018-19065](https://insights.sbomify.com/CVE-2018-19065/): Hardcoded credentials in foscam:c2 application firmware (high 7.5)
- [CVE-2018-19064](https://insights.sbomify.com/CVE-2018-19064/): Hardcoded credentials in foscam:c2 application firmware (critical 9.8)
- [CVE-2018-19063](https://insights.sbomify.com/CVE-2018-19063/): Hardcoded credentials in foscam:c2 application firmware (critical 9.8)
- [CVE-2018-19061](https://insights.sbomify.com/CVE-2018-19061/): SQL injection in dedecms:dedecms (critical 9.8)
- [CVE-2018-19060](https://insights.sbomify.com/CVE-2018-19060/): Null dereference in canonical:ubuntu linux (medium 6.5)
- [CVE-2018-1906](https://insights.sbomify.com/CVE-2018-1906/): Information disclosure in InfoSphere Information Server (medium 4.3)
- [CVE-2018-19059](https://insights.sbomify.com/CVE-2018-19059/): Memory corruption in canonical:ubuntu linux (medium 6.5)
- [CVE-2018-19058](https://insights.sbomify.com/CVE-2018-19058/): Denial of service in canonical:ubuntu linux (medium 6.5)
- [CVE-2018-19057](https://insights.sbomify.com/CVE-2018-19057/): SimpleMDE XSS Vulnerability (medium 6.1)
- [CVE-2018-19056](https://insights.sbomify.com/CVE-2018-19056/): Pandao editor.md vulnerable to DOM XSS (medium 6.1)
- [CVE-2018-19053](https://insights.sbomify.com/CVE-2018-19053/): Code injection in pbootcms:pbootcms (high 7.2)
- [CVE-2018-19052](https://insights.sbomify.com/CVE-2018-19052/): Path traversal in debian:debian linux (high 7.5)
- [CVE-2018-19051](https://insights.sbomify.com/CVE-2018-19051/): Cross-site scripting in metinfo:metinfo (medium 6.1)
- [CVE-2018-19050](https://insights.sbomify.com/CVE-2018-19050/): Cross-site scripting in metinfo:metinfo (medium 6.1)
- [CVE-2018-1905](https://insights.sbomify.com/CVE-2018-1905/): XML external entity in WebSphere Application Server (high 7.1)
- [CVE-2018-19048](https://insights.sbomify.com/CVE-2018-19048/): Cross-Site Scripting in simditor (medium 6.1)
- [CVE-2018-19047](https://insights.sbomify.com/CVE-2018-19047/): Server-side request forgery in mpdf project:mpdf (critical 10.0)
- [CVE-2018-19046](https://insights.sbomify.com/CVE-2018-19046/): Information disclosure in keepalived:keepalived (medium 4.7)
- [CVE-2018-19045](https://insights.sbomify.com/CVE-2018-19045/): Information disclosure in keepalived:keepalived (high 7.5)
- [CVE-2018-19044](https://insights.sbomify.com/CVE-2018-19044/): Path traversal in keepalived:keepalived (medium 4.7)
- [CVE-2018-19043](https://insights.sbomify.com/CVE-2018-19043/): Path traversal in media file manager project:media file manager (medium 5.3)
- [CVE-2018-19042](https://insights.sbomify.com/CVE-2018-19042/): Path traversal in media file manager project:media file manager (medium 5.3)
- [CVE-2018-19041](https://insights.sbomify.com/CVE-2018-19041/): Cross-site scripting in media file manager project:media file manager (medium 6.1)
- [CVE-2018-19040](https://insights.sbomify.com/CVE-2018-19040/): Path traversal in media file manager project:media file manager (medium 5.3)
- [CVE-2018-1904](https://insights.sbomify.com/CVE-2018-1904/): Deserialization in WebSphere Application Server (high 8.1)
- [CVE-2018-19039](https://insights.sbomify.com/CVE-2018-19039/): Path traversal in grafana:grafana (medium 6.5)
- [CVE-2018-19037](https://insights.sbomify.com/CVE-2018-19037/): Denial of service in virginmedia:hub 3.0 firmware (high 7.5)
- [CVE-2018-19036](https://insights.sbomify.com/CVE-2018-19036/): Memory corruption in bosch:common product platform 4 firmware (critical 9.8)
- [CVE-2018-19031](https://insights.sbomify.com/CVE-2018-19031/): Command injection in 360 Safe Router (high 8.8)
- [CVE-2018-1903](https://insights.sbomify.com/CVE-2018-1903/): Privilege escalation in Sterling Connect:Direct for UNIX (medium 6.7)
- [CVE-2018-19029](https://insights.sbomify.com/CVE-2018-19029/): Memory corruption in LCDS Laquis SCADA (high 7.8)
- [CVE-2018-19027](https://insights.sbomify.com/CVE-2018-19027/): Memory corruption in CX-Protocol within CX-One (high 7.8)
- [CVE-2018-19025](https://insights.sbomify.com/CVE-2018-19025/): Command injection in JUUKO K-808 (critical 9.8)
- [CVE-2018-19023](https://insights.sbomify.com/CVE-2018-19023/): Auth bypass in Hetronic Nova-M (high 8.8)
- [CVE-2018-19021](https://insights.sbomify.com/CVE-2018-19021/): Auth bypass in Emerson DeltaV (medium 6.5)
- [CVE-2018-19020](https://insights.sbomify.com/CVE-2018-19020/): Memory corruption in CX-Supervisor (medium 5.0)
- [CVE-2018-1902](https://insights.sbomify.com/CVE-2018-1902/): Information disclosure in WebSphere Application Server (low 3.1)
- [CVE-2018-19019](https://insights.sbomify.com/CVE-2018-19019/): Memory corruption in CX-Supervisor (high 7.3)
- [CVE-2018-19018](https://insights.sbomify.com/CVE-2018-19018/): Memory corruption in CX-Supervisor (high 7.3)
- [CVE-2018-19017](https://insights.sbomify.com/CVE-2018-19017/): Use after free in CX-Supervisor (high 8.8)
- [CVE-2018-19016](https://insights.sbomify.com/CVE-2018-19016/): Denial of service in Rockwell Automation EtherNet/IP Web Server Modules 1756-EWEB (includes 1756-EWEBK) Version 5.001 and earlier, and CompactLogix 1768-EWEB Version 2.005 and earlier. (high 7.5)
- [CVE-2018-19015](https://insights.sbomify.com/CVE-2018-19015/): Command injection in CX-Supervisor (high 7.3)
- [CVE-2018-19014](https://insights.sbomify.com/CVE-2018-19014/): Information disclosure in Dräger Infinity Delta (medium 6.5)
- [CVE-2018-19013](https://insights.sbomify.com/CVE-2018-19013/): Command injection in CX-Supervisor (medium 5.0)
- [CVE-2018-19012](https://insights.sbomify.com/CVE-2018-19012/): Privilege escalation in Dräger Infinity Delta (high 7.8)
- [CVE-2018-19011](https://insights.sbomify.com/CVE-2018-19011/): Code injection in CX-Supervisor (high 8.8)
- [CVE-2018-19010](https://insights.sbomify.com/CVE-2018-19010/): Denial of service in Dräger Infinity Delta (medium 6.5)
- [CVE-2018-1901](https://insights.sbomify.com/CVE-2018-1901/): Privilege escalation in WebSphere Application Server (medium 5.0)
- [CVE-2018-19009](https://insights.sbomify.com/CVE-2018-19009/): Information disclosure in Pilz PNOZmulti Configurator (high 7.8)
- [CVE-2018-19008](https://insights.sbomify.com/CVE-2018-19008/): Code injection in ABB CP400 Panel Builder TextEditor 2.0 (high 7.8)
- [CVE-2018-19007](https://insights.sbomify.com/CVE-2018-19007/): Command injection in Geutebrück GmbH E2 Camera Series versions prior to 1.12.0.25 (critical 9.8)
- [CVE-2018-19006](https://insights.sbomify.com/CVE-2018-19006/): Cross-site scripting in PI Vision (medium 4.8)
- [CVE-2018-19005](https://insights.sbomify.com/CVE-2018-19005/): Other in Cscape (high 7.8)
- [CVE-2018-19004](https://insights.sbomify.com/CVE-2018-19004/): Memory corruption in LCDS Laquis SCADA (low 3.3)
- [CVE-2018-19003](https://insights.sbomify.com/CVE-2018-19003/): Path traversal in GE Mark VIe, EX2100e, EX2100e Reg, and LS2100e (high 7.5)
- [CVE-2018-19002](https://insights.sbomify.com/CVE-2018-19002/): Code injection in LCDS Laquis SCADA (high 7.8)
- [CVE-2018-19001](https://insights.sbomify.com/CVE-2018-19001/): Weak cryptography in Philips HealthSuite Health Android App (medium 4.3)
- [CVE-2018-19000](https://insights.sbomify.com/CVE-2018-19000/): Auth bypass in LCDS Laquis SCADA (medium 5.3)
- [CVE-2018-1900](https://insights.sbomify.com/CVE-2018-1900/): Cross-site scripting in Curam Social Program Management (medium 5.4)
- [CVE-2018-18999](https://insights.sbomify.com/CVE-2018-18999/): Memory corruption in WebAccess/SCADA (high 7.3)
- [CVE-2018-18998](https://insights.sbomify.com/CVE-2018-18998/): Hardcoded credentials in LCDS Laquis SCADA (critical 9.8)
- [CVE-2018-18997](https://insights.sbomify.com/CVE-2018-18997/): Cross-site scripting in ABB GATE-E1 and GATE-E2 (medium 6.1)
- [CVE-2018-18996](https://insights.sbomify.com/CVE-2018-18996/): Missing authorization in LCDS Laquis SCADA (critical 9.8)
- [CVE-2018-18995](https://insights.sbomify.com/CVE-2018-18995/): Missing authorization in ABB GATE-E1 and GATE-E2 (critical 9.8)
- [CVE-2018-18994](https://insights.sbomify.com/CVE-2018-18994/): Memory corruption in LCDS Laquis SCADA (high 7.1)
- [CVE-2018-18993](https://insights.sbomify.com/CVE-2018-18993/): Memory corruption in CX-One (CX-Programmer and CX-Server) (high 7.8)
- [CVE-2018-18992](https://insights.sbomify.com/CVE-2018-18992/): Code injection in LCDS Laquis SCADA (high 8.8)
- [CVE-2018-18991](https://insights.sbomify.com/CVE-2018-18991/): Cross-site scripting in SCADA WebServer (medium 6.1)
- [CVE-2018-18990](https://insights.sbomify.com/CVE-2018-18990/): Path traversal in LCDS Laquis SCADA (medium 5.3)
- [CVE-2018-1899](https://insights.sbomify.com/CVE-2018-1899/): Missing authorization in InfoSphere Information Server (medium 4.3)
- [CVE-2018-18989](https://insights.sbomify.com/CVE-2018-18989/): Use after free in CX-One (CX-Programmer and CX-Server) (high 7.8)
- [CVE-2018-18988](https://insights.sbomify.com/CVE-2018-18988/): Code injection in LCDS Laquis SCADA (high 8.8)
- [CVE-2018-18987](https://insights.sbomify.com/CVE-2018-18987/): Memory corruption in invt:vt-designer (high 8.8)
- [CVE-2018-18986](https://insights.sbomify.com/CVE-2018-18986/): Memory corruption in LCDS Laquis SCADA (high 7.8)
- [CVE-2018-18985](https://insights.sbomify.com/CVE-2018-18985/): Cross-site scripting in Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 (medium 5.4)
- [CVE-2018-18984](https://insights.sbomify.com/CVE-2018-18984/): Medtronic 9790, 2090 CareLink, and 29901 Encore Programmers Missing Encryption of Sensitive Data (medium 4.6)
- [CVE-2018-18983](https://insights.sbomify.com/CVE-2018-18983/): Memory corruption in invt:vt-designer (high 8.8)
- [CVE-2018-18982](https://insights.sbomify.com/CVE-2018-18982/): SQL injection in NUUO CMS (high 8.8)
- [CVE-2018-18981](https://insights.sbomify.com/CVE-2018-18981/): Denial of service in Rockwell Automation FactoryTalk Services Platform v2.90 and earlier (high 7.5)
- [CVE-2018-18980](https://insights.sbomify.com/CVE-2018-18980/): XML external entity in zohocorp:manageengine network configuration manager (high 7.5)
- [CVE-2018-18979](https://insights.sbomify.com/CVE-2018-18979/): Hardcoded credentials in ascensia:contour diabetes (high 7.4)
- [CVE-2018-18978](https://insights.sbomify.com/CVE-2018-18978/): Hardcoded credentials in ascensia:contour diabetes (high 7.4)
- [CVE-2018-18977](https://insights.sbomify.com/CVE-2018-18977/): Information disclosure in ascensia:contour diabetes (high 7.5)
- [CVE-2018-18976](https://insights.sbomify.com/CVE-2018-18976/): Missing authorization in ascensia:contour diabetes (medium 5.3)
- [CVE-2018-18975](https://insights.sbomify.com/CVE-2018-18975/): Weak cryptography in ascensia:contour diabetes (high 7.5)
- [CVE-2018-1897](https://insights.sbomify.com/CVE-2018-1897/): Memory corruption in DB2 for Linux, UNIX and Windows (high 8.4)
- [CVE-2018-18966](https://insights.sbomify.com/CVE-2018-18966/): File upload in oscommerce:online merchant (medium 4.9)
- [CVE-2018-18965](https://insights.sbomify.com/CVE-2018-18965/): File upload in oscommerce:online merchant (medium 4.9)
- [CVE-2018-18964](https://insights.sbomify.com/CVE-2018-18964/): File upload in oscommerce:online merchant (medium 4.9)
- [CVE-2018-18963](https://insights.sbomify.com/CVE-2018-18963/): SQL injection in degraupublicidade:degraupublicidade (critical 9.8)
- [CVE-2018-18960](https://insights.sbomify.com/CVE-2018-18960/): Denial of service in epson:epson workforce wf-2861 firmware (medium 5.9)
- [CVE-2018-1896](https://insights.sbomify.com/CVE-2018-1896/): Open redirect in Connections (medium 4.6)
- [CVE-2018-18959](https://insights.sbomify.com/CVE-2018-18959/): Memory corruption in epson:epson workforce wf-2861 firmware (high 7.5)
- [CVE-2018-18958](https://insights.sbomify.com/CVE-2018-18958/): Missing authorization in opnsense:opnsense (medium 6.5)
- [CVE-2018-18957](https://insights.sbomify.com/CVE-2018-18957/): Memory corruption in mz-automation:libiec61850 (critical 9.8)
- [CVE-2018-18956](https://insights.sbomify.com/CVE-2018-18956/): Memory corruption in suricata-ids:suricata (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/78/