# Vulnerabilities published in 2018 - [CVE-2018-18832](https://insights.sbomify.com/CVE-2018-18832/): SQL injection in dkcms:dkcms (critical 9.8) - [CVE-2018-18831](https://insights.sbomify.com/CVE-2018-18831/): Path Traversal in minsoft:ms-mcms (high 7.5) - [CVE-2018-18830](https://insights.sbomify.com/CVE-2018-18830/): Unrestricted Upload of File with Dangerous Type in mingsoft:ms-mcms (critical 9.8) - [CVE-2018-1883](https://insights.sbomify.com/CVE-2018-1883/): Denial of service in MQ (medium 5.3) - [CVE-2018-18829](https://insights.sbomify.com/CVE-2018-18829/): Null dereference in libav:libav (medium 6.5) - [CVE-2018-18828](https://insights.sbomify.com/CVE-2018-18828/): Memory corruption in libav:libav (medium 6.5) - [CVE-2018-18827](https://insights.sbomify.com/CVE-2018-18827/): Memory corruption in libav:libav (medium 6.5) - [CVE-2018-18826](https://insights.sbomify.com/CVE-2018-18826/): Memory corruption in libav:libav (medium 6.5) - [CVE-2018-18825](https://insights.sbomify.com/CVE-2018-18825/): Cross-site scripting in pagoda linux project:pagoda linux (medium 6.1) - [CVE-2018-18824](https://insights.sbomify.com/CVE-2018-18824/): Cross-site scripting in wolfcms:wolf cms (medium 4.8) - [CVE-2018-18823](https://insights.sbomify.com/CVE-2018-18823/): Cross-site scripting in wolfcms:wolf cms (medium 4.8) - [CVE-2018-18822](https://insights.sbomify.com/CVE-2018-18822/): SQL injection in grapixel:new media (critical 9.8) - [CVE-2018-18820](https://insights.sbomify.com/CVE-2018-18820/): Memory corruption in debian:debian linux (high 8.1) - [CVE-2018-1882](https://insights.sbomify.com/CVE-2018-1882/): Information disclosure in Spectrum Protect (medium 4.7) - [CVE-2018-18819](https://insights.sbomify.com/CVE-2018-18819/): Missing authorization in mitel:micollab (medium 5.3) - [CVE-2018-18817](https://insights.sbomify.com/CVE-2018-18817/): Missing authorization in leostream:agent (high 7.5) - [CVE-2018-18816](https://insights.sbomify.com/CVE-2018-18816/): TIBCO JasperReports Persistent Cross Site Scripting Vulnerability (high 8.0) - [CVE-2018-18815](https://insights.sbomify.com/CVE-2018-18815/): TIBCO JasperReports Server User Information Disclosure (critical 10.0) - [CVE-2018-18814](https://insights.sbomify.com/CVE-2018-18814/): TIBCO Spotfire Authentication Vulnerability (high 8.8) - [CVE-2018-18813](https://insights.sbomify.com/CVE-2018-18813/): TIBCO Spotfire Reflected and Persistent Cross-Site Scripting Vulnerabilities (high 8.8) - [CVE-2018-18812](https://insights.sbomify.com/CVE-2018-18812/): TIBCO Spotfire Fails To Prevent Write Access to Spotfire Library (medium 6.5) - [CVE-2018-18810](https://insights.sbomify.com/CVE-2018-18810/): TIBCO Managed File Transfer Credentials Disclosure (medium 6.8) - [CVE-2018-18809](https://insights.sbomify.com/CVE-2018-18809/): TIBCO JasperReports Library Directory Traversal (critical 9.9, exploited in the wild) - [CVE-2018-18808](https://insights.sbomify.com/CVE-2018-18808/): TIBCO JasperReports Server Privilege Escalation Via Race Condition (high 8.8) - [CVE-2018-18807](https://insights.sbomify.com/CVE-2018-18807/): TIBCO Statistica Server Vulnerable to Cross Site Scripting (high 7.6) - [CVE-2018-18806](https://insights.sbomify.com/CVE-2018-18806/): SQL injection in school equipment monitoring system project:school equipment monitoring system (critical 9.8) - [CVE-2018-18805](https://insights.sbomify.com/CVE-2018-18805/): SQL injection in pointofsales project:pointofsales (critical 9.8) - [CVE-2018-18804](https://insights.sbomify.com/CVE-2018-18804/): SQL injection in bakeshop inventory system project:bakeshop inventory system (critical 9.8) - [CVE-2018-18803](https://insights.sbomify.com/CVE-2018-18803/): SQL injection in curriculum evaluation system project:curriculum evaluation system (critical 9.8) - [CVE-2018-18802](https://insights.sbomify.com/CVE-2018-18802/): Cross-site request forgery in tubigan:welcome to our resort (high 8.8) - [CVE-2018-18801](https://insights.sbomify.com/CVE-2018-18801/): SQL injection in bsen ordering software project:bsen ordering software (critical 9.8) - [CVE-2018-18800](https://insights.sbomify.com/CVE-2018-18800/): SQL injection in tubigan:welcome to our resort (critical 9.8) - [CVE-2018-18799](https://insights.sbomify.com/CVE-2018-18799/): Cross-site request forgery in school attendance monitoring system project:school attendance monitoring system (high 8.8) - [CVE-2018-18798](https://insights.sbomify.com/CVE-2018-18798/): SQL injection in school attendance monitoring system project:school attendance monitoring system (critical 9.8) - [CVE-2018-18797](https://insights.sbomify.com/CVE-2018-18797/): Cross-site request forgery in school attendance monitoring system project:school attendance monitoring system (high 8.8) - [CVE-2018-18796](https://insights.sbomify.com/CVE-2018-18796/): SQL injection in library management system project:library management system (critical 9.8) - [CVE-2018-18795](https://insights.sbomify.com/CVE-2018-18795/): SQL injection in school event management system project:school event management system (critical 9.8) - [CVE-2018-18794](https://insights.sbomify.com/CVE-2018-18794/): Cross-site request forgery in school event management system project:school event management system (high 8.8) - [CVE-2018-18793](https://insights.sbomify.com/CVE-2018-18793/): File upload in school event management system project:school event management system (critical 9.8) - [CVE-2018-18792](https://insights.sbomify.com/CVE-2018-18792/): SQL injection in zzcms:zzcms (critical 9.8) - [CVE-2018-18791](https://insights.sbomify.com/CVE-2018-18791/): SQL injection in zzcms:zzcms (critical 9.8) - [CVE-2018-18790](https://insights.sbomify.com/CVE-2018-18790/): SQL injection in zzcms:zzcms (high 7.2) - [CVE-2018-18789](https://insights.sbomify.com/CVE-2018-18789/): SQL injection in zzcms:zzcms (critical 9.8) - [CVE-2018-18788](https://insights.sbomify.com/CVE-2018-18788/): SQL injection in zzcms:zzcms (high 7.2) - [CVE-2018-18787](https://insights.sbomify.com/CVE-2018-18787/): SQL injection in zzcms:zzcms (critical 9.8) - [CVE-2018-18786](https://insights.sbomify.com/CVE-2018-18786/): SQL injection in zzcms:zzcms (critical 9.8) - [CVE-2018-18785](https://insights.sbomify.com/CVE-2018-18785/): SQL injection in zzcms:zzcms (critical 9.8) - [CVE-2018-18784](https://insights.sbomify.com/CVE-2018-18784/): SQL injection in zzcms:zzcms (high 7.2) - [CVE-2018-18783](https://insights.sbomify.com/CVE-2018-18783/): Cross-site scripting in sem-cms:semcms (medium 6.1) - [CVE-2018-18782](https://insights.sbomify.com/CVE-2018-18782/): Cross-site scripting in dedecms:dedecms (medium 6.1) - [CVE-2018-18781](https://insights.sbomify.com/CVE-2018-18781/): Cross-site scripting in dedecms:dedecms (medium 6.1) - [CVE-2018-1878](https://insights.sbomify.com/CVE-2018-1878/): Information disclosure in Robotic Process Automation with Automation Anywhere (medium 5.3) - [CVE-2018-18778](https://insights.sbomify.com/CVE-2018-18778/): Path traversal in acme:mini-httpd (medium 6.5) - [CVE-2018-18777](https://insights.sbomify.com/CVE-2018-18777/): Path traversal in microstrategy:microstrategy web (medium 4.3) - [CVE-2018-18776](https://insights.sbomify.com/CVE-2018-18776/): Cross-site scripting in microstrategy:microstrategy web (medium 6.1) - [CVE-2018-18775](https://insights.sbomify.com/CVE-2018-18775/): Cross-site scripting in microstrategy:microstrategy web (medium 6.1) - [CVE-2018-18774](https://insights.sbomify.com/CVE-2018-18774/): Cross-site scripting in control-webpanel:webpanel (medium 6.1) - [CVE-2018-18773](https://insights.sbomify.com/CVE-2018-18773/): Cross-site request forgery in control-webpanel:webpanel (high 8.8) - [CVE-2018-18772](https://insights.sbomify.com/CVE-2018-18772/): Cross-site request forgery in control-webpanel:webpanel (high 8.8) - [CVE-2018-18771](https://insights.sbomify.com/CVE-2018-18771/): File upload in lulucms:lulu cms (high 7.5) - [CVE-2018-1877](https://insights.sbomify.com/CVE-2018-1877/): Information disclosure in Robotic Process Automation with Automation Anywhere (medium 6.2) - [CVE-2018-18767](https://insights.sbomify.com/CVE-2018-18767/): Weak cryptography in d-link:dcs-825l firmware (high 7.0) - [CVE-2018-18766](https://insights.sbomify.com/CVE-2018-18766/): Privilege escalation in provisio:sitekiosk (critical 9.8) - [CVE-2018-18765](https://insights.sbomify.com/CVE-2018-18765/): Memory corruption in cesanta:mongoose (critical 9.1) - [CVE-2018-18764](https://insights.sbomify.com/CVE-2018-18764/): Memory corruption in cesanta:mongoose (critical 9.1) - [CVE-2018-18763](https://insights.sbomify.com/CVE-2018-18763/): SQL injection in saltos:saltos (critical 9.8) - [CVE-2018-18762](https://insights.sbomify.com/CVE-2018-18762/): Information disclosure in saltos:saltos (medium 6.5) - [CVE-2018-18761](https://insights.sbomify.com/CVE-2018-18761/): SQL injection in saltos:saltos (critical 9.8) - [CVE-2018-18760](https://insights.sbomify.com/CVE-2018-18760/): RhinOS 3.0 build 1190 allows CSRF. (medium 6.5) - [CVE-2018-1876](https://insights.sbomify.com/CVE-2018-1876/): Information disclosure in Robotic Process Automation with Automation Anywhere (medium 6.2) - [CVE-2018-18759](https://insights.sbomify.com/CVE-2018-18759/): Memory corruption in modbustools:modbus slave (high 7.5) - [CVE-2018-18758](https://insights.sbomify.com/CVE-2018-18758/): SQL injection in open faculty evaluation system project:open faculty evaluation system (critical 9.8) - [CVE-2018-18757](https://insights.sbomify.com/CVE-2018-18757/): SQL injection in open faculty evaluation system project:open faculty evaluation system (critical 9.8) - [CVE-2018-18756](https://insights.sbomify.com/CVE-2018-18756/): Memory corruption in kangujang:local server (high 7.5) - [CVE-2018-18755](https://insights.sbomify.com/CVE-2018-18755/): SQL injection in k-iwi:k-iwi (critical 9.8) - [CVE-2018-18754](https://insights.sbomify.com/CVE-2018-18754/): Hardcoded credentials in zyxel:vmg3312-b10b firmware (critical 9.8) - [CVE-2018-18753](https://insights.sbomify.com/CVE-2018-18753/): Deserialization in typecho:typecho (critical 9.8) - [CVE-2018-18752](https://insights.sbomify.com/CVE-2018-18752/): File upload in webiness project:webiness inventory (critical 9.8) - [CVE-2018-18751](https://insights.sbomify.com/CVE-2018-18751/): Memory corruption in canonical:ubuntu linux (critical 9.8) - [CVE-2018-1875](https://insights.sbomify.com/CVE-2018-1875/): Open redirect in InfoSphere Information Governance Catalog (high 7.4) - [CVE-2018-18749](https://insights.sbomify.com/CVE-2018-18749/): Integer overflow in data tools project:data tools (medium 5.5) - [CVE-2018-18748](https://insights.sbomify.com/CVE-2018-18748/): Security feature bypass in sandboxie-plus:sandboxie (critical 10.0) - [CVE-2018-18745](https://insights.sbomify.com/CVE-2018-18745/): Cross-site scripting in sem-cms:semcms (medium 4.8) - [CVE-2018-18744](https://insights.sbomify.com/CVE-2018-18744/): Cross-site scripting in sem-cms:semcms (medium 4.8) - [CVE-2018-18743](https://insights.sbomify.com/CVE-2018-18743/): Cross-site scripting in sem-cms:semcms (medium 4.8) - [CVE-2018-18742](https://insights.sbomify.com/CVE-2018-18742/): Cross-site request forgery in sem-cms:semcms (high 8.8) - [CVE-2018-18741](https://insights.sbomify.com/CVE-2018-18741/): Cross-site scripting in sem-cms:semcms (medium 4.8) - [CVE-2018-18740](https://insights.sbomify.com/CVE-2018-18740/): Cross-site scripting in sem-cms:semcms (medium 4.8) - [CVE-2018-1874](https://insights.sbomify.com/CVE-2018-1874/): Information disclosure in API Connect (medium 4.6) - [CVE-2018-18739](https://insights.sbomify.com/CVE-2018-18739/): Cross-site scripting in sem-cms:semcms (medium 4.8) - [CVE-2018-18738](https://insights.sbomify.com/CVE-2018-18738/): Cross-site scripting in sem-cms:semcms (medium 4.8) - [CVE-2018-18737](https://insights.sbomify.com/CVE-2018-18737/): XML external entity in douchat:douchat (high 7.5) - [CVE-2018-18736](https://insights.sbomify.com/CVE-2018-18736/): Cross-site scripting in catfish-cms:catfish blog (medium 5.4) - [CVE-2018-18735](https://insights.sbomify.com/CVE-2018-18735/): Cross-site request forgery in catfish-cms:catfish blog (high 8.8) - [CVE-2018-18734](https://insights.sbomify.com/CVE-2018-18734/): Cross-site request forgery in catfish-cms:catfish cms (high 8.8) - [CVE-2018-18733](https://insights.sbomify.com/CVE-2018-18733/): Cross-site scripting in catfish-cms:catfish cms (medium 5.4) - [CVE-2018-18732](https://insights.sbomify.com/CVE-2018-18732/): Memory corruption in tenda:ac10 firmware (high 7.5) - [CVE-2018-18731](https://insights.sbomify.com/CVE-2018-18731/): Memory corruption in tenda:ac10 firmware (high 7.5) - [CVE-2018-18730](https://insights.sbomify.com/CVE-2018-18730/): Memory corruption in tenda:ac10 firmware (high 7.5) - [CVE-2018-18729](https://insights.sbomify.com/CVE-2018-18729/): Memory corruption in tenda:ac10 firmware (critical 9.8) --- From sbomify Insights: https://insights.sbomify.com/years/2018/page/80/