# Vulnerabilities published in 2018


- [CVE-2018-16874](https://insights.sbomify.com/CVE-2018-16874/): Path traversal in golang (medium 6.8)
- [CVE-2018-16873](https://insights.sbomify.com/CVE-2018-16873/): Command injection in golang (high 7.5)
- [CVE-2018-16872](https://insights.sbomify.com/CVE-2018-16872/): Race condition in QEMU: (medium 5.0)
- [CVE-2018-16871](https://insights.sbomify.com/CVE-2018-16871/): Null dereference in kernel: (high 7.5)
- [CVE-2018-16870](https://insights.sbomify.com/CVE-2018-16870/): Weak cryptography in wolfssl (medium 5.9)
- [CVE-2018-16869](https://insights.sbomify.com/CVE-2018-16869/): Weak cryptography in nettle (medium 4.7)
- [CVE-2018-16868](https://insights.sbomify.com/CVE-2018-16868/): Weak cryptography in gnutls (medium 4.7)
- [CVE-2018-16867](https://insights.sbomify.com/CVE-2018-16867/): Path traversal in QEMU: (high 7.0)
- [CVE-2018-16866](https://insights.sbomify.com/CVE-2018-16866/): Information disclosure in systemd (medium 4.3)
- [CVE-2018-16865](https://insights.sbomify.com/CVE-2018-16865/): Memory corruption in systemd (high 7.5)
- [CVE-2018-16864](https://insights.sbomify.com/CVE-2018-16864/): Memory corruption in systemd (high 7.4)
- [CVE-2018-16863](https://insights.sbomify.com/CVE-2018-16863/): Command injection in ghostscript (high 7.3)
- [CVE-2018-16862](https://insights.sbomify.com/CVE-2018-16862/): Information disclosure in kernel: (medium 5.3)
- [CVE-2018-16861](https://insights.sbomify.com/CVE-2018-16861/): Cross-site scripting in foreman (high 7.6)
- [CVE-2018-16860](https://insights.sbomify.com/CVE-2018-16860/): Auth bypass in samba (high 7.5)
- [CVE-2018-1686](https://insights.sbomify.com/CVE-2018-1686/): Cross-site scripting in Maximo Asset Management (medium 5.4)
- [CVE-2018-16859](https://insights.sbomify.com/CVE-2018-16859/): Ansible Logs Passwords If PowerShell ScriptBlock is Enabled (medium 4.2)
- [CVE-2018-16858](https://insights.sbomify.com/CVE-2018-16858/): Path traversal in libreoffice (high 7.8)
- [CVE-2018-16857](https://insights.sbomify.com/CVE-2018-16857/): Security feature bypass in samba (high 7.4)
- [CVE-2018-16856](https://insights.sbomify.com/CVE-2018-16856/): Openstack Octavia allows Insertion of Sensitive Information into Log File (medium 5.5)
- [CVE-2018-16855](https://insights.sbomify.com/CVE-2018-16855/): Memory corruption in pdns-recursor (high 7.5)
- [CVE-2018-16854](https://insights.sbomify.com/CVE-2018-16854/): Moodle Login CSRF vulnerability in login form (medium 6.5)
- [CVE-2018-16853](https://insights.sbomify.com/CVE-2018-16853/): Denial of service in samba (high 7.5)
- [CVE-2018-16852](https://insights.sbomify.com/CVE-2018-16852/): Null dereference in samba (medium 6.5)
- [CVE-2018-16851](https://insights.sbomify.com/CVE-2018-16851/): Null dereference in samba (medium 6.5)
- [CVE-2018-16850](https://insights.sbomify.com/CVE-2018-16850/): SQL injection in postgresql (high 8.0)
- [CVE-2018-1685](https://insights.sbomify.com/CVE-2018-1685/): Information disclosure in ibm:db2 (medium 5.5)
- [CVE-2018-16849](https://insights.sbomify.com/CVE-2018-16849/): openstack-mistral Discloses the presence of arbitrary files within the filesystem (low 3.1)
- [CVE-2018-16848](https://insights.sbomify.com/CVE-2018-16848/): OpenStack Mistral DoS (medium 6.5)
- [CVE-2018-16847](https://insights.sbomify.com/CVE-2018-16847/): Memory corruption in QEMU: (high 7.0)
- [CVE-2018-16846](https://insights.sbomify.com/CVE-2018-16846/): Denial of service in ceph (medium 6.5)
- [CVE-2018-16845](https://insights.sbomify.com/CVE-2018-16845/): Denial of service in nginx (high 8.2)
- [CVE-2018-16844](https://insights.sbomify.com/CVE-2018-16844/): Denial of service in nginx (medium 5.3)
- [CVE-2018-16843](https://insights.sbomify.com/CVE-2018-16843/): Denial of service in nginx (medium 5.3)
- [CVE-2018-16842](https://insights.sbomify.com/CVE-2018-16842/): Memory corruption in curl: (medium 4.4)
- [CVE-2018-16841](https://insights.sbomify.com/CVE-2018-16841/): Memory corruption in samba (medium 5.7)
- [CVE-2018-16840](https://insights.sbomify.com/CVE-2018-16840/): Use after free in curl (medium 4.3)
- [CVE-2018-1684](https://insights.sbomify.com/CVE-2018-1684/): Denial of service in MQ (medium 5.3)
- [CVE-2018-16839](https://insights.sbomify.com/CVE-2018-16839/): Memory corruption in curl: (medium 4.3)
- [CVE-2018-16838](https://insights.sbomify.com/CVE-2018-16838/): Auth bypass in sssd (medium 5.4)
- [CVE-2018-16837](https://insights.sbomify.com/CVE-2018-16837/): Ansible Leaks Data Passed to ssh-keygen (high 7.8)
- [CVE-2018-16836](https://insights.sbomify.com/CVE-2018-16836/): Path traversal in rubedo project:rubedo (critical 9.8)
- [CVE-2018-16833](https://insights.sbomify.com/CVE-2018-16833/): Cross-site scripting in zohocorp:manageengine desktop central (medium 6.1)
- [CVE-2018-16832](https://insights.sbomify.com/CVE-2018-16832/): Cross-site request forgery in xunfeng project:xunfeng (medium 6.5)
- [CVE-2018-16831](https://insights.sbomify.com/CVE-2018-16831/): Smarty Path Traversal Vulnerability (medium 5.9)
- [CVE-2018-1683](https://insights.sbomify.com/CVE-2018-1683/): Information disclosure in WebSphere Application Server (medium 5.9)
- [CVE-2018-16822](https://insights.sbomify.com/CVE-2018-16822/): SQL injection in seacms:seacms (critical 9.8)
- [CVE-2018-16821](https://insights.sbomify.com/CVE-2018-16821/): Path traversal in seacms:seacms (medium 5.3)
- [CVE-2018-16820](https://insights.sbomify.com/CVE-2018-16820/): Path traversal in monstra:monstra (high 7.5)
- [CVE-2018-1682](https://insights.sbomify.com/CVE-2018-1682/): Information disclosure in Watson Studio Local (medium 5.3)
- [CVE-2018-16819](https://insights.sbomify.com/CVE-2018-16819/): Path traversal in monstra:monstra (medium 4.9)
- [CVE-2018-16809](https://insights.sbomify.com/CVE-2018-16809/): Dolibarr SQL injection via the integer parameters qty and value_unit (critical 9.8)
- [CVE-2018-16808](https://insights.sbomify.com/CVE-2018-16808/): Dolibarr Stored Cross-site Scripting in expensereport/card.php (medium 6.1)
- [CVE-2018-16807](https://insights.sbomify.com/CVE-2018-16807/): Denial of service in bro:bro (high 7.5)
- [CVE-2018-16806](https://insights.sbomify.com/CVE-2018-16806/): Weak cryptography in pektron:passive keyless entry and start system firmware (medium 6.5)
- [CVE-2018-16805](https://insights.sbomify.com/CVE-2018-16805/): Cross-site scripting in b3log:solo (medium 4.8)
- [CVE-2018-16804](https://insights.sbomify.com/CVE-2018-16804/): Cross-site scripting in ucms project:ucms (medium 6.1)
- [CVE-2018-16803](https://insights.sbomify.com/CVE-2018-16803/): SQL injection in cimtechniques:cimscan (critical 9.8)
- [CVE-2018-16802](https://insights.sbomify.com/CVE-2018-16802/): Security feature bypass in artifex:ghostscript (high 7.8)
- [CVE-2018-1680](https://insights.sbomify.com/CVE-2018-1680/): Misconfiguration in Security Privileged Identity Manager (medium 5.9)
- [CVE-2018-16797](https://insights.sbomify.com/CVE-2018-16797/): Memory corruption in kakaocorp:potplayer (high 7.8)
- [CVE-2018-16796](https://insights.sbomify.com/CVE-2018-16796/): File upload in hiscout:grc suite (high 8.8)
- [CVE-2018-16795](https://insights.sbomify.com/CVE-2018-16795/): Cross-site request forgery in open-emr:openemr (high 8.8)
- [CVE-2018-16794](https://insights.sbomify.com/CVE-2018-16794/): Server-side request forgery in microsoft:active directory federation services (high 8.6)
- [CVE-2018-16793](https://insights.sbomify.com/CVE-2018-16793/): Server-side request forgery in microsoft:exchange server (high 8.6)
- [CVE-2018-16792](https://insights.sbomify.com/CVE-2018-16792/): XML external entity in solarwinds:sftp\/scp server (critical 9.1)
- [CVE-2018-16791](https://insights.sbomify.com/CVE-2018-16791/): Misconfiguration in solarwinds:sftp\/scp server (critical 9.8)
- [CVE-2018-16790](https://insights.sbomify.com/CVE-2018-16790/): Memory corruption in mongodb:libbson (high 8.1)
- [CVE-2018-1679](https://insights.sbomify.com/CVE-2018-1679/): Information disclosure in Sterling B2B Integrator (medium 5.3)
- [CVE-2018-16789](https://insights.sbomify.com/CVE-2018-16789/): Denial of service in shellinabox project:shellinabox (high 7.5)
- [CVE-2018-16786](https://insights.sbomify.com/CVE-2018-16786/): Cross-site scripting in dedecms:dedecms (medium 6.1)
- [CVE-2018-16785](https://insights.sbomify.com/CVE-2018-16785/): Code injection in dedecms:dedecms (high 8.8)
- [CVE-2018-16784](https://insights.sbomify.com/CVE-2018-16784/): Code injection in dedecms:dedecms (high 7.2)
- [CVE-2018-16782](https://insights.sbomify.com/CVE-2018-16782/): Memory corruption in entropymine:imageworsener (high 8.8)
- [CVE-2018-16781](https://insights.sbomify.com/CVE-2018-16781/): Denial of service in rockcarry:ffjpeg (medium 6.5)
- [CVE-2018-16780](https://insights.sbomify.com/CVE-2018-16780/): Cross-site scripting in complete responsive cms blog project:complete responsive cms blog (medium 5.4)
- [CVE-2018-16779](https://insights.sbomify.com/CVE-2018-16779/): Cross-site scripting in blogcms project:blogcms (medium 6.1)
- [CVE-2018-16778](https://insights.sbomify.com/CVE-2018-16778/): Cross-site scripting in jenzabar:jenzabar (medium 6.1)
- [CVE-2018-16776](https://insights.sbomify.com/CVE-2018-16776/): Cross-site scripting in creatiwity:witycms (medium 4.8)
- [CVE-2018-16775](https://insights.sbomify.com/CVE-2018-16775/): Cross-site scripting in victor cms project:victor cms (medium 4.8)
- [CVE-2018-16774](https://insights.sbomify.com/CVE-2018-16774/): Path traversal in hongcms project:hongcms (high 7.5)
- [CVE-2018-16773](https://insights.sbomify.com/CVE-2018-16773/): Cross-site scripting in easycms:easycms (medium 4.8)
- [CVE-2018-16772](https://insights.sbomify.com/CVE-2018-16772/): Cross-site scripting in hoosk:hoosk (medium 4.8)
- [CVE-2018-16771](https://insights.sbomify.com/CVE-2018-16771/): Code injection in hoosk:hoosk (critical 9.8)
- [CVE-2018-16770](https://insights.sbomify.com/CVE-2018-16770/): Memory corruption in webassembly virtual machine project:webassembly virtual machine (high 8.8)
- [CVE-2018-1677](https://insights.sbomify.com/CVE-2018-1677/): Denial of service in DataPower Gateways (medium 5.1)
- [CVE-2018-16769](https://insights.sbomify.com/CVE-2018-16769/): Memory corruption in webassembly virtual machine project:webassembly virtual machine (high 8.8)
- [CVE-2018-16768](https://insights.sbomify.com/CVE-2018-16768/): Memory corruption in webassembly virtual machine project:webassembly virtual machine (high 8.8)
- [CVE-2018-16767](https://insights.sbomify.com/CVE-2018-16767/): Memory corruption in webassembly virtual machine project:webassembly virtual machine (high 8.8)
- [CVE-2018-16766](https://insights.sbomify.com/CVE-2018-16766/): Denial of service in webassembly virtual machine project:webassembly virtual machine (high 8.8)
- [CVE-2018-16765](https://insights.sbomify.com/CVE-2018-16765/): Memory corruption in webassembly virtual machine project:webassembly virtual machine (high 8.8)
- [CVE-2018-16764](https://insights.sbomify.com/CVE-2018-16764/): Memory corruption in webassembly virtual machine project:webassembly virtual machine (high 8.8)
- [CVE-2018-16763](https://insights.sbomify.com/CVE-2018-16763/): Code injection in thedaylightstudio:fuel cms (critical 9.8)
- [CVE-2018-16762](https://insights.sbomify.com/CVE-2018-16762/): SQL injection in thedaylightstudio:fuel cms (critical 9.8)
- [CVE-2018-16761](https://insights.sbomify.com/CVE-2018-16761/): Open redirect in eventum project:eventum (medium 6.1)
- [CVE-2018-1676](https://insights.sbomify.com/CVE-2018-1676/): Cross-site scripting in Planning Analytics Local (medium 6.1)
- [CVE-2018-16759](https://insights.sbomify.com/CVE-2018-16759/): Cross-site scripting in easycms:easycms (medium 6.1)
- [CVE-2018-16758](https://insights.sbomify.com/CVE-2018-16758/): Auth bypass in debian:debian linux (medium 5.9)
- [CVE-2018-16752](https://insights.sbomify.com/CVE-2018-16752/): Command injection in linknet-usa:lw-n605r firmware (high 8.8)
- [CVE-2018-16750](https://insights.sbomify.com/CVE-2018-16750/): Denial of service in canonical:ubuntu linux (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/94/