# Vulnerabilities published in 2018


- [CVE-2018-18590](https://insights.sbomify.com/CVE-2018-18590/): MFSBGN03829 rev.1 - Micro Focus Operation Bridge Containerized Suite, Remote Code Execution (critical 9.6)
- [CVE-2018-1859](https://insights.sbomify.com/CVE-2018-1859/): Privilege escalation in API Connect (medium 4.3)
- [CVE-2018-18589](https://insights.sbomify.com/CVE-2018-18589/): MFSBGN03827 rev.1 - Microfocus Real User Monitoring 9.4.0 BPRDownload Java Deserialization Vulnerability (medium 6.3)
- [CVE-2018-18587](https://insights.sbomify.com/CVE-2018-18587/): Weak cryptography in bigprof:appgini (medium 5.3)
- [CVE-2018-18586](https://insights.sbomify.com/CVE-2018-18586/): Path traversal in kyzer:libmspack (medium 5.3)
- [CVE-2018-18585](https://insights.sbomify.com/CVE-2018-18585/): Null dereference in canonical:ubuntu linux (medium 4.3)
- [CVE-2018-18584](https://insights.sbomify.com/CVE-2018-18584/): Memory corruption in cabextract project:cabextract (medium 6.5)
- [CVE-2018-18583](https://insights.sbomify.com/CVE-2018-18583/): Memory corruption in lupng project:lupng (high 8.8)
- [CVE-2018-18582](https://insights.sbomify.com/CVE-2018-18582/): Memory corruption in lupng project:lupng (high 8.8)
- [CVE-2018-18581](https://insights.sbomify.com/CVE-2018-18581/): Memory corruption in lupng project:lupng (high 8.8)
- [CVE-2018-1858](https://insights.sbomify.com/CVE-2018-1858/): Cross-site request forgery in API Connect (medium 4.3)
- [CVE-2018-18579](https://insights.sbomify.com/CVE-2018-18579/): Cross-site scripting in dedecms:dedecms (medium 6.1)
- [CVE-2018-18578](https://insights.sbomify.com/CVE-2018-18578/): Cross-site scripting in dedecms:dedecms (medium 6.1)
- [CVE-2018-18576](https://insights.sbomify.com/CVE-2018-18576/): Path traversal in incsub:hustle (medium 5.3)
- [CVE-2018-18573](https://insights.sbomify.com/CVE-2018-18573/): Code injection in oscommerce:oscommerce (high 7.2)
- [CVE-2018-18572](https://insights.sbomify.com/CVE-2018-18572/): File upload in oscommerce:oscommerce (high 7.2)
- [CVE-2018-18571](https://insights.sbomify.com/CVE-2018-18571/): Auth bypass in citrix:xenmobile server (critical 9.1)
- [CVE-2018-18570](https://insights.sbomify.com/CVE-2018-18570/): Planon before Live Build 41 has XSS. (medium 6.1)
- [CVE-2018-1857](https://insights.sbomify.com/CVE-2018-1857/): Security feature bypass in DB2 for Linux, UNIX and Windows (medium 4.8)
- [CVE-2018-18569](https://insights.sbomify.com/CVE-2018-18569/): Server-side request forgery in dundas:dundas bi (high 8.6)
- [CVE-2018-18568](https://insights.sbomify.com/CVE-2018-18568/): Weak cryptography in polycom:unified communications software (medium 5.9)
- [CVE-2018-18567](https://insights.sbomify.com/CVE-2018-18567/): Weak cryptography in audiocodes:440hd firmware (medium 5.9)
- [CVE-2018-18566](https://insights.sbomify.com/CVE-2018-18566/): Information disclosure in polycom:unified communications software (medium 5.3)
- [CVE-2018-18565](https://insights.sbomify.com/CVE-2018-18565/): File upload in roche:accu-chek inform ii firmware (medium 6.8)
- [CVE-2018-18564](https://insights.sbomify.com/CVE-2018-18564/): Missing authorization in roche:accu-chek inform ii firmware (high 7.4)
- [CVE-2018-18563](https://insights.sbomify.com/CVE-2018-18563/): Missing authorization in roche:accu-chek inform ii firmware (critical 9.6)
- [CVE-2018-18562](https://insights.sbomify.com/CVE-2018-18562/): Hardcoded credentials in roche:accu-chek inform ii firmware (high 8.8)
- [CVE-2018-18561](https://insights.sbomify.com/CVE-2018-18561/): Misconfiguration in roche:accu-chek inform ii firmware (high 8.0)
- [CVE-2018-18559](https://insights.sbomify.com/CVE-2018-18559/): Use after free in linux:linux kernel (high 8.1)
- [CVE-2018-18558](https://insights.sbomify.com/CVE-2018-18558/): Security feature bypass in espressif:esp-idf (medium 6.4)
- [CVE-2018-18557](https://insights.sbomify.com/CVE-2018-18557/): Memory corruption in canonical:ubuntu linux (high 8.8)
- [CVE-2018-18556](https://insights.sbomify.com/CVE-2018-18556/): Privilege escalation in vyos:vyos (critical 9.9)
- [CVE-2018-18555](https://insights.sbomify.com/CVE-2018-18555/): Command injection in vyos:vyos (critical 9.9)
- [CVE-2018-18553](https://insights.sbomify.com/CVE-2018-18553/): Cross-site scripting in leanote:leanote (medium 6.1)
- [CVE-2018-18552](https://insights.sbomify.com/CVE-2018-18552/): Path traversal in serverscheck:monitoring software (medium 6.5)
- [CVE-2018-18551](https://insights.sbomify.com/CVE-2018-18551/): Cross-site scripting in serverscheck:monitoring software (medium 6.1)
- [CVE-2018-18550](https://insights.sbomify.com/CVE-2018-18550/): SQL injection in serverscheck:serverscheck (high 8.8)
- [CVE-2018-18548](https://insights.sbomify.com/CVE-2018-18548/): Ajenti Cross-site Scripting Via Filename (medium 6.1)
- [CVE-2018-18547](https://insights.sbomify.com/CVE-2018-18547/): Cross-site scripting in vestacp:control panel (medium 6.1)
- [CVE-2018-18546](https://insights.sbomify.com/CVE-2018-18546/): ThinkPHP SQLi Vulnerability (critical 9.8)
- [CVE-2018-18545](https://insights.sbomify.com/CVE-2018-18545/): Cross-site scripting in fiyo:fiyo cms (medium 6.1)
- [CVE-2018-18544](https://insights.sbomify.com/CVE-2018-18544/): Denial of service in graphicsmagick:graphicsmagick (medium 6.5)
- [CVE-2018-18541](https://insights.sbomify.com/CVE-2018-18541/): Auth bypass in debian:debian linux (high 7.5)
- [CVE-2018-18540](https://insights.sbomify.com/CVE-2018-18540/): Cross-site scripting in teakki:teakki (medium 6.1)
- [CVE-2018-18537](https://insights.sbomify.com/CVE-2018-18537/): Memory corruption in asus:aura sync firmware (medium 5.5)
- [CVE-2018-18536](https://insights.sbomify.com/CVE-2018-18536/): Privilege escalation in asus:aura sync firmware (high 7.8)
- [CVE-2018-18535](https://insights.sbomify.com/CVE-2018-18535/): Privilege escalation in asus:aura sync firmware (high 7.8)
- [CVE-2018-18531](https://insights.sbomify.com/CVE-2018-18531/): Use of Insufficiently Random Values in penggle:kaptcha (critical 9.8)
- [CVE-2018-18530](https://insights.sbomify.com/CVE-2018-18530/): ThinkPHP SQLi Vulnerability (critical 9.8)
- [CVE-2018-1853](https://insights.sbomify.com/CVE-2018-1853/): Other in Spectrum Protect (medium 6.1)
- [CVE-2018-18529](https://insights.sbomify.com/CVE-2018-18529/): ThinkPHP SQLi Vulnerability (critical 9.8)
- [CVE-2018-18527](https://insights.sbomify.com/CVE-2018-18527/): SQL injection in owndms:ownticket (critical 9.8)
- [CVE-2018-18524](https://insights.sbomify.com/CVE-2018-18524/): Cross-site scripting in evernote:evernote (medium 6.1)
- [CVE-2018-18521](https://insights.sbomify.com/CVE-2018-18521/): Denial of service in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-18520](https://insights.sbomify.com/CVE-2018-18520/): Memory corruption in canonical:ubuntu linux (medium 6.5)
- [CVE-2018-18519](https://insights.sbomify.com/CVE-2018-18519/): Privilege escalation in bestxsoftware:best free keylogger (high 7.8)
- [CVE-2018-18517](https://insights.sbomify.com/CVE-2018-18517/): Cross-site scripting in citrix:netscaler gateway firmware (medium 4.8)
- [CVE-2018-18513](https://insights.sbomify.com/CVE-2018-18513/): Null dereference in Thunderbird (high 7.5)
- [CVE-2018-18512](https://insights.sbomify.com/CVE-2018-18512/): Use after free in Thunderbird (critical 9.8)
- [CVE-2018-18511](https://insights.sbomify.com/CVE-2018-18511/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2018-18510](https://insights.sbomify.com/CVE-2018-18510/): Denial of service in Firefox (medium 6.5)
- [CVE-2018-1851](https://insights.sbomify.com/CVE-2018-1851/): Deserialization in WebSphere Application Server (high 7.3)
- [CVE-2018-18509](https://insights.sbomify.com/CVE-2018-18509/): Security feature bypass in Thunderbird (medium 5.3)
- [CVE-2018-18508](https://insights.sbomify.com/CVE-2018-18508/): Null dereference in NSS (medium 6.5)
- [CVE-2018-18506](https://insights.sbomify.com/CVE-2018-18506/): Security feature bypass in Firefox (medium 5.9)
- [CVE-2018-18505](https://insights.sbomify.com/CVE-2018-18505/): Security feature bypass in Firefox (critical 10.0)
- [CVE-2018-18504](https://insights.sbomify.com/CVE-2018-18504/): Use after free in canonical:ubuntu linux (critical 9.8)
- [CVE-2018-18503](https://insights.sbomify.com/CVE-2018-18503/): Memory corruption in Firefox (high 8.8)
- [CVE-2018-18502](https://insights.sbomify.com/CVE-2018-18502/): Memory corruption in Firefox (critical 9.8)
- [CVE-2018-18501](https://insights.sbomify.com/CVE-2018-18501/): Memory corruption in Firefox (critical 9.8)
- [CVE-2018-18500](https://insights.sbomify.com/CVE-2018-18500/): Use after free in canonical:ubuntu linux (critical 9.8)
- [CVE-2018-1850](https://insights.sbomify.com/CVE-2018-1850/): Missing authorization in Security Access Manager Appliance (high 8.8)
- [CVE-2018-18499](https://insights.sbomify.com/CVE-2018-18499/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2018-18498](https://insights.sbomify.com/CVE-2018-18498/): Integer overflow in Firefox (critical 9.8)
- [CVE-2018-18497](https://insights.sbomify.com/CVE-2018-18497/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2018-18496](https://insights.sbomify.com/CVE-2018-18496/): Other in Firefox (high 8.8)
- [CVE-2018-18495](https://insights.sbomify.com/CVE-2018-18495/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2018-18494](https://insights.sbomify.com/CVE-2018-18494/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2018-18493](https://insights.sbomify.com/CVE-2018-18493/): Memory corruption in Firefox (critical 9.8)
- [CVE-2018-18492](https://insights.sbomify.com/CVE-2018-18492/): Use after free in Firefox (critical 9.8)
- [CVE-2018-18489](https://insights.sbomify.com/CVE-2018-18489/): Denial of service in tp-link:wr840n firmware (medium 4.9)
- [CVE-2018-18488](https://insights.sbomify.com/CVE-2018-18488/): SQL injection in gxlcms:gxlcms (critical 9.8)
- [CVE-2018-18487](https://insights.sbomify.com/CVE-2018-18487/): Weak cryptography in gxlcms:gxlcms (high 7.5)
- [CVE-2018-18486](https://insights.sbomify.com/CVE-2018-18486/): SQL injection in phpshe:phpshe (critical 9.8)
- [CVE-2018-18485](https://insights.sbomify.com/CVE-2018-18485/): Path traversal in phpshe:phpshe (high 7.5)
- [CVE-2018-18484](https://insights.sbomify.com/CVE-2018-18484/): Denial of service in gnu:binutils (medium 5.5)
- [CVE-2018-18483](https://insights.sbomify.com/CVE-2018-18483/): Integer overflow in gnu:binutils (high 7.8)
- [CVE-2018-18482](https://insights.sbomify.com/CVE-2018-18482/): libpg_query memory leak (medium 6.5)
- [CVE-2018-18481](https://insights.sbomify.com/CVE-2018-18481/): Memory corruption in libopencad project:libopencad (medium 6.5)
- [CVE-2018-18480](https://insights.sbomify.com/CVE-2018-18480/): Memory corruption in libopencad project:libopencad (medium 6.5)
- [CVE-2018-1848](https://insights.sbomify.com/CVE-2018-1848/): Cross-site scripting in Business Automation Workflow (medium 6.1)
- [CVE-2018-18478](https://insights.sbomify.com/CVE-2018-18478/): LibreNMS XSS Vulnerability (medium 6.1)
- [CVE-2018-18476](https://insights.sbomify.com/CVE-2018-18476/): mysql-bunuuid-rails vulnerable to SQL injection (critical 9.8)
- [CVE-2018-18475](https://insights.sbomify.com/CVE-2018-18475/): File upload in zohocorp:manageengine opmanager (critical 9.8)
- [CVE-2018-18473](https://insights.sbomify.com/CVE-2018-18473/): Hardcoded credentials in patlite:nbm-d88n firmware (critical 9.8)
- [CVE-2018-18472](https://insights.sbomify.com/CVE-2018-18472/): Command injection in westerndigital:my book live firmware (critical 9.8)
- [CVE-2018-18471](https://insights.sbomify.com/CVE-2018-18471/): XML external entity in axentra:hipserv (critical 9.8)
- [CVE-2018-1847](https://insights.sbomify.com/CVE-2018-1847/): Path traversal in Financial Transaction Manager (medium 5.0)
- [CVE-2018-18467](https://insights.sbomify.com/CVE-2018-18467/): Missing authorization in conversations:conversations (high 7.5)
- [CVE-2018-18466](https://insights.sbomify.com/CVE-2018-18466/): Information disclosure in securenvoy:securaccess (high 7.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/82/