# Vulnerabilities published in 2018 - [CVE-2018-18955](https://insights.sbomify.com/CVE-2018-18955/): Privilege escalation in canonical:ubuntu linux (high 7.0) - [CVE-2018-18954](https://insights.sbomify.com/CVE-2018-18954/): Memory corruption in canonical:ubuntu linux (medium 5.5) - [CVE-2018-18952](https://insights.sbomify.com/CVE-2018-18952/): Cross-site scripting in jeecms:jeecms (medium 4.8) - [CVE-2018-18950](https://insights.sbomify.com/CVE-2018-18950/): Path traversal in kindeditor:kindeditor (high 7.5) - [CVE-2018-1895](https://insights.sbomify.com/CVE-2018-1895/): Cross-site scripting in InfoSphere Information Server (medium 5.4) - [CVE-2018-18949](https://insights.sbomify.com/CVE-2018-18949/): SQL injection in zohocorp:manageengine opmanager (critical 9.8) - [CVE-2018-18944](https://insights.sbomify.com/CVE-2018-18944/): Memory corruption in artha project:artha (high 7.5) - [CVE-2018-18943](https://insights.sbomify.com/CVE-2018-18943/): XSS in baserCMS before 4.1.4 (medium 4.8) - [CVE-2018-18942](https://insights.sbomify.com/CVE-2018-18942/): RCE in baserCMS before 4.1.4 (high 7.2) - [CVE-2018-18941](https://insights.sbomify.com/CVE-2018-18941/): Information disclosure in vignette:content management (critical 9.8) - [CVE-2018-18940](https://insights.sbomify.com/CVE-2018-18940/): Cross-site scripting in netscape:enterprise server (medium 6.1) - [CVE-2018-18939](https://insights.sbomify.com/CVE-2018-18939/): Cross-site scripting in wuzhi cms project:wuzhi cms (medium 4.8) - [CVE-2018-18938](https://insights.sbomify.com/CVE-2018-18938/): Cross-site scripting in wuzhicms:wuzhicms (medium 4.8) - [CVE-2018-18937](https://insights.sbomify.com/CVE-2018-18937/): Null dereference in mz-automation:libiec61850 (high 7.5) - [CVE-2018-18936](https://insights.sbomify.com/CVE-2018-18936/): Path traversal in popojicms:popojicms (high 7.5) - [CVE-2018-18935](https://insights.sbomify.com/CVE-2018-18935/): Cross-site request forgery in popojicms:popojicms (high 8.8) - [CVE-2018-18934](https://insights.sbomify.com/CVE-2018-18934/): File upload in popojicms:popojicms (critical 9.8) - [CVE-2018-18933](https://insights.sbomify.com/CVE-2018-18933/): Memory corruption in foxitsoftware:foxit reader (critical 9.1) - [CVE-2018-18931](https://insights.sbomify.com/CVE-2018-18931/): Privilege escalation in trms:carousel digital signage (high 8.8) - [CVE-2018-18930](https://insights.sbomify.com/CVE-2018-18930/): File upload in trms:carousel digital signage (high 8.8) - [CVE-2018-1893](https://insights.sbomify.com/CVE-2018-1893/): Cross-site scripting in Rational Collaborative Lifecycle Management (medium 5.4) - [CVE-2018-18929](https://insights.sbomify.com/CVE-2018-18929/): Hardcoded credentials in trms:seneca hdn firmware (high 8.8) - [CVE-2018-18928](https://insights.sbomify.com/CVE-2018-18928/): Integer overflow in icu-project:international components for unicode (critical 9.8) - [CVE-2018-18927](https://insights.sbomify.com/CVE-2018-18927/): Cross-site scripting in publiccms:publiccms (medium 4.8) - [CVE-2018-18926](https://insights.sbomify.com/CVE-2018-18926/): Gitea Remote Code Execution (RCE) (critical 9.8) - [CVE-2018-18925](https://insights.sbomify.com/CVE-2018-18925/): Auth bypass in gogs:gogs (critical 9.8) - [CVE-2018-18924](https://insights.sbomify.com/CVE-2018-18924/): File upload in projeqtor:projeqtor (high 8.8) - [CVE-2018-18923](https://insights.sbomify.com/CVE-2018-18923/): SQL injection in abisoftgt:ticketly (critical 9.8) - [CVE-2018-18922](https://insights.sbomify.com/CVE-2018-18922/): Missing authorization in abisoftgt:ticketly (critical 9.8) - [CVE-2018-18921](https://insights.sbomify.com/CVE-2018-18921/): CSRF in PHP Server Monitor before 3.3.2 (medium 6.5) - [CVE-2018-18920](https://insights.sbomify.com/CVE-2018-18920/): Py-EVM is vulnerable to arbitrary bytecode injection (high 8.8) - [CVE-2018-1892](https://insights.sbomify.com/CVE-2018-1892/): Cross-site scripting in Rational Collaborative Lifecycle Management (medium 5.4) - [CVE-2018-18919](https://insights.sbomify.com/CVE-2018-18919/): Cross-site scripting in iiong:wp editor.md (medium 4.8) - [CVE-2018-18915](https://insights.sbomify.com/CVE-2018-18915/): Denial of service in exiv2:exiv2 (medium 6.5) - [CVE-2018-18913](https://insights.sbomify.com/CVE-2018-18913/): Other in opera:opera browser (high 7.8) - [CVE-2018-18912](https://insights.sbomify.com/CVE-2018-18912/): Memory corruption in sharing-file:easy file sharing web server (critical 9.8) - [CVE-2018-1891](https://insights.sbomify.com/CVE-2018-1891/): Cross-site scripting in Security Guardium (medium 5.4) - [CVE-2018-18909](https://insights.sbomify.com/CVE-2018-18909/): Cross-site scripting in xheditor:xheditor (medium 6.1) - [CVE-2018-18908](https://insights.sbomify.com/CVE-2018-18908/): Information disclosure in sky:sky go (medium 5.9) - [CVE-2018-18907](https://insights.sbomify.com/CVE-2018-18907/): Auth bypass in dlink:dir-850l firmare (high 7.5) - [CVE-2018-18903](https://insights.sbomify.com/CVE-2018-18903/): Code injection in vanillaforums:vanilla (critical 9.8) - [CVE-2018-1890](https://insights.sbomify.com/CVE-2018-1890/): Privilege escalation in Runtimes for Java Technology (medium 5.6) - [CVE-2018-18898](https://insights.sbomify.com/CVE-2018-18898/): Denial of service in bestpractical:request tracker (high 7.5) - [CVE-2018-18897](https://insights.sbomify.com/CVE-2018-18897/): Denial of service in canonical:ubuntu linux (medium 6.5) - [CVE-2018-18894](https://insights.sbomify.com/CVE-2018-18894/): Path traversal in lexmark:6500e firmware (high 7.5) - [CVE-2018-18893](https://insights.sbomify.com/CVE-2018-18893/): Jinjava calls getClass (medium 5.3) - [CVE-2018-18892](https://insights.sbomify.com/CVE-2018-18892/): Code injection in 1234n:minicms (critical 9.8) - [CVE-2018-18891](https://insights.sbomify.com/CVE-2018-18891/): Auth bypass in 1234n:minicms (high 7.5) - [CVE-2018-18890](https://insights.sbomify.com/CVE-2018-18890/): Information disclosure in 1234n:minicms (medium 5.3) - [CVE-2018-1889](https://insights.sbomify.com/CVE-2018-1889/): Cross-site scripting in Security Guardium (medium 5.4) - [CVE-2018-18888](https://insights.sbomify.com/CVE-2018-18888/): File upload in laravelcms project:laravelcms (critical 9.8) - [CVE-2018-18887](https://insights.sbomify.com/CVE-2018-18887/): SQL injection in s-cms:s-cms (critical 9.8) - [CVE-2018-18886](https://insights.sbomify.com/CVE-2018-18886/): Cross-site scripting in helpy.io:helpy (medium 6.1) - [CVE-2018-18883](https://insights.sbomify.com/CVE-2018-18883/): Null dereference in xen:xen (high 8.8) - [CVE-2018-18882](https://insights.sbomify.com/CVE-2018-18882/): Cross-site scripting in controlbyweb:x-320m-i firmware (medium 5.4) - [CVE-2018-18881](https://insights.sbomify.com/CVE-2018-18881/): Denial of service in controlbyweb:x-320m-i firmware (medium 6.5) - [CVE-2018-18880](https://insights.sbomify.com/CVE-2018-18880/): Cross-site scripting in columbiaweather:weather microserver firmware (medium 5.4) - [CVE-2018-1888](https://insights.sbomify.com/CVE-2018-1888/): Code injection in i Access for Windows (medium 5.3) - [CVE-2018-18879](https://insights.sbomify.com/CVE-2018-18879/): Command injection in columbiaweather:weather microserver firmware (high 8.8) - [CVE-2018-18878](https://insights.sbomify.com/CVE-2018-18878/): Denial of service in columbiaweather:weather microserver firmware (high 7.5) - [CVE-2018-18877](https://insights.sbomify.com/CVE-2018-18877/): Auth bypass in columbiaweather:weather microserver firmware (high 8.8) - [CVE-2018-18876](https://insights.sbomify.com/CVE-2018-18876/): Path traversal in columbiaweather:weather microserver firmware (medium 5.3) - [CVE-2018-18875](https://insights.sbomify.com/CVE-2018-18875/): Cross-site scripting in columbiaweather:weather microserver firmware (medium 5.4) - [CVE-2018-18874](https://insights.sbomify.com/CVE-2018-18874/): File upload in nconsulting:nc-cms (critical 9.8) - [CVE-2018-18873](https://insights.sbomify.com/CVE-2018-18873/): Null dereference in canonical:ubuntu linux (medium 5.5) - [CVE-2018-18872](https://insights.sbomify.com/CVE-2018-18872/): Cross-site scripting in kieranoshea:calendar (medium 5.4) - [CVE-2018-18871](https://insights.sbomify.com/CVE-2018-18871/): Auth bypass in gigasetpro:maxwell basic firmware (critical 9.8) - [CVE-2018-1887](https://insights.sbomify.com/CVE-2018-1887/): Hardcoded credentials in Security Access Manager Appliance (medium 5.9) - [CVE-2018-18869](https://insights.sbomify.com/CVE-2018-18869/): Path traversal in phome:empirecms (critical 9.8) - [CVE-2018-18868](https://insights.sbomify.com/CVE-2018-18868/): Cross-site scripting in no-cms project:no-cms (medium 6.1) - [CVE-2018-18867](https://insights.sbomify.com/CVE-2018-18867/): Server-side request forgery in tecrail:responsive filemanager (high 8.6) - [CVE-2018-18865](https://insights.sbomify.com/CVE-2018-18865/): Information disclosure in royalapplications:royal ts (high 8.1) - [CVE-2018-18864](https://insights.sbomify.com/CVE-2018-18864/): Cross-site scripting in loadbalancer:enterprise va max (critical 9.6) - [CVE-2018-18863](https://insights.sbomify.com/CVE-2018-18863/): Path traversal in ngahr:resourcelink (medium 6.5) - [CVE-2018-18862](https://insights.sbomify.com/CVE-2018-18862/): Missing authorization in bmc:remedy action request system (high 8.8) - [CVE-2018-18861](https://insights.sbomify.com/CVE-2018-18861/): Memory corruption in pcman:ftp server (critical 9.8) - [CVE-2018-18860](https://insights.sbomify.com/CVE-2018-18860/): Privilege escalation in switchvpn:switchvpn (high 7.8) - [CVE-2018-1886](https://insights.sbomify.com/CVE-2018-1886/): Information disclosure in Security Access Manager Appliance (medium 5.3) - [CVE-2018-18859](https://insights.sbomify.com/CVE-2018-18859/): Privilege escalation in liquidvpn:liquidvpn (high 7.8) - [CVE-2018-18858](https://insights.sbomify.com/CVE-2018-18858/): Command injection in liquidvpn:liquidvpn (high 7.8) - [CVE-2018-18857](https://insights.sbomify.com/CVE-2018-18857/): Command injection in liquidvpn:liquidvpn (high 7.8) - [CVE-2018-18856](https://insights.sbomify.com/CVE-2018-18856/): Command injection in liquidvpn:liquidvpn (high 7.8) - [CVE-2018-18854](https://insights.sbomify.com/CVE-2018-18854/): Uncontrolled Resource Consumption in spray-json (high 7.5) - [CVE-2018-18853](https://insights.sbomify.com/CVE-2018-18853/): Uncontrolled Resource Consumption in spray-json when parsing decimal digit fields (high 7.5) - [CVE-2018-18852](https://insights.sbomify.com/CVE-2018-18852/): Command injection in cerio:dt-300n firmware (high 8.8) - [CVE-2018-18850](https://insights.sbomify.com/CVE-2018-18850/): Deserialization in octopus:octopus server (high 8.8) - [CVE-2018-1885](https://insights.sbomify.com/CVE-2018-1885/): Information disclosure in Business Automation Workflow (medium 5.3) - [CVE-2018-18849](https://insights.sbomify.com/CVE-2018-18849/): Memory corruption in canonical:ubuntu linux (medium 5.5) - [CVE-2018-18845](https://insights.sbomify.com/CVE-2018-18845/): Cross-site scripting in advanced comment system project:advanced comment system (medium 6.1) - [CVE-2018-18843](https://insights.sbomify.com/CVE-2018-18843/): Server-side request forgery in gitlab:gitlab (critical 10.0) - [CVE-2018-18842](https://insights.sbomify.com/CVE-2018-18842/): Cross-site request forgery in zblogcn:z-blogphp (high 8.8) - [CVE-2018-18841](https://insights.sbomify.com/CVE-2018-18841/): Cross-site scripting in sem-cms:semcms (medium 4.8) - [CVE-2018-18840](https://insights.sbomify.com/CVE-2018-18840/): Cross-site scripting in sem-cms:semcms (medium 5.4) - [CVE-2018-1884](https://insights.sbomify.com/CVE-2018-1884/): Path traversal in Case Manager (medium 4.8) - [CVE-2018-18839](https://insights.sbomify.com/CVE-2018-18839/): Information disclosure in my-netdata:netdata (medium 5.3) - [CVE-2018-18838](https://insights.sbomify.com/CVE-2018-18838/): Other in my-netdata:netdata (high 7.5) - [CVE-2018-18837](https://insights.sbomify.com/CVE-2018-18837/): Other in my-netdata:netdata (medium 6.1) - [CVE-2018-18836](https://insights.sbomify.com/CVE-2018-18836/): Code injection in my-netdata:netdata (medium 6.5) - [CVE-2018-18835](https://insights.sbomify.com/CVE-2018-18835/): Code injection in doccms:doccms (critical 9.8) - [CVE-2018-18834](https://insights.sbomify.com/CVE-2018-18834/): Memory corruption in mz-automation:libiec61850 (critical 9.8) --- From sbomify Insights: https://insights.sbomify.com/years/2018/page/79/