# Vulnerabilities published in 2018


- [CVE-2018-16619](https://insights.sbomify.com/CVE-2018-16619/): Cross-site scripting in sonatype:nexus repository manager (medium 6.1)
- [CVE-2018-16618](https://insights.sbomify.com/CVE-2018-16618/): Command injection in vtech:storio max firmware (critical 9.8)
- [CVE-2018-16613](https://insights.sbomify.com/CVE-2018-16613/): Privilege escalation in gvectors:wpforo forum (critical 9.8)
- [CVE-2018-1661](https://insights.sbomify.com/CVE-2018-1661/): Cross-site request forgery in DataPower Gateways (medium 6.5)
- [CVE-2018-16608](https://insights.sbomify.com/CVE-2018-16608/): Missing authorization in monstra:monstra (high 8.8)
- [CVE-2018-16607](https://insights.sbomify.com/CVE-2018-16607/): Cross-site scripting in opmantek:open-audit (medium 5.4)
- [CVE-2018-16606](https://insights.sbomify.com/CVE-2018-16606/): Missing authorization in proconf:proconf (medium 6.5)
- [CVE-2018-16605](https://insights.sbomify.com/CVE-2018-16605/): Cross-site scripting in dlink:dir-600m firmware (medium 5.4)
- [CVE-2018-16604](https://insights.sbomify.com/CVE-2018-16604/): Code injection in nibbleblog:nibbleblog (high 7.2)
- [CVE-2018-16603](https://insights.sbomify.com/CVE-2018-16603/): Information disclosure in amazon:amazon web services freertos (medium 5.9)
- [CVE-2018-16602](https://insights.sbomify.com/CVE-2018-16602/): Memory corruption in amazon:amazon web services freertos (medium 5.9)
- [CVE-2018-16601](https://insights.sbomify.com/CVE-2018-16601/): Integer overflow in amazon:amazon web services freertos (high 8.1)
- [CVE-2018-16600](https://insights.sbomify.com/CVE-2018-16600/): Memory corruption in amazon:amazon web services freertos (medium 5.9)
- [CVE-2018-1660](https://insights.sbomify.com/CVE-2018-1660/): Cross-site scripting in WebSphere Portal (medium 5.4)
- [CVE-2018-16599](https://insights.sbomify.com/CVE-2018-16599/): Memory corruption in amazon:amazon web services freertos (medium 5.9)
- [CVE-2018-16598](https://insights.sbomify.com/CVE-2018-16598/): Other in amazon:amazon web services freertos (medium 5.9)
- [CVE-2018-16597](https://insights.sbomify.com/CVE-2018-16597/): Missing authorization in linux:linux kernel (medium 5.5)
- [CVE-2018-16596](https://insights.sbomify.com/CVE-2018-16596/): Memory corruption in swisscom:internet-box 2 firmware (high 7.5)
- [CVE-2018-16595](https://insights.sbomify.com/CVE-2018-16595/): Memory corruption in sony:r5c firmware (medium 6.5)
- [CVE-2018-16594](https://insights.sbomify.com/CVE-2018-16594/): Path traversal in sony:r5c firmware (high 8.1)
- [CVE-2018-16593](https://insights.sbomify.com/CVE-2018-16593/): Command injection in sony:r5c firmware (high 8.8)
- [CVE-2018-16591](https://insights.sbomify.com/CVE-2018-16591/): Missing authorization in furuno:felcom 250 firmware (critical 9.8)
- [CVE-2018-16590](https://insights.sbomify.com/CVE-2018-16590/): Auth bypass in furuno:felcom 250 firmware (critical 9.8)
- [CVE-2018-1659](https://insights.sbomify.com/CVE-2018-1659/): Cross-site scripting in Rational Engineering Lifecycle Manager (medium 5.4)
- [CVE-2018-16588](https://insights.sbomify.com/CVE-2018-16588/): Privilege escalation in suse:shadow (high 7.8)
- [CVE-2018-16587](https://insights.sbomify.com/CVE-2018-16587/): Path traversal in debian:debian linux (medium 6.5)
- [CVE-2018-16586](https://insights.sbomify.com/CVE-2018-16586/): Other in debian:debian linux (medium 4.3)
- [CVE-2018-16585](https://insights.sbomify.com/CVE-2018-16585/): Memory corruption in artifex:ghostscript (high 7.8)
- [CVE-2018-1658](https://insights.sbomify.com/CVE-2018-1658/): Other in Rational Collaborative Lifecycle Management (medium 5.4)
- [CVE-2018-1657](https://insights.sbomify.com/CVE-2018-1657/): Cross-site scripting in Rational Publishing Engine (medium 5.4)
- [CVE-2018-16563](https://insights.sbomify.com/CVE-2018-16563/): Denial of service in Firmware variant DNP3 TCP for EN100 Ethernet module (medium 5.9)
- [CVE-2018-16561](https://insights.sbomify.com/CVE-2018-16561/): Denial of service in SIMATIC S7-300 CPUs (high 7.5)
- [CVE-2018-1656](https://insights.sbomify.com/CVE-2018-1656/): Path traversal in SDK, Java Technology Edition (high 7.4)
- [CVE-2018-16559](https://insights.sbomify.com/CVE-2018-16559/): Denial of service in SIMATIC S7-1500 CPU (high 7.5)
- [CVE-2018-16558](https://insights.sbomify.com/CVE-2018-16558/): Denial of service in SIMATIC S7-1500 CPU (high 7.5)
- [CVE-2018-16557](https://insights.sbomify.com/CVE-2018-16557/): Denial of service in SIMATIC S7-400 CPU 412-1 DP V7 (high 8.2)
- [CVE-2018-16556](https://insights.sbomify.com/CVE-2018-16556/): Denial of service in SIMATIC S7-400 CPU 412-1 DP V7 (high 7.5)
- [CVE-2018-16555](https://insights.sbomify.com/CVE-2018-16555/): Cross-site scripting in SCALANCE S602, SCALANCE S612, SCALANCE S623, SCALANCE S627-2M (medium 5.4)
- [CVE-2018-16554](https://insights.sbomify.com/CVE-2018-16554/): Memory corruption in jhead project:jhead (high 7.8)
- [CVE-2018-16553](https://insights.sbomify.com/CVE-2018-16553/): Code injection in jspxcms:jspxcms (high 7.2)
- [CVE-2018-16552](https://insights.sbomify.com/CVE-2018-16552/): MicroPyramid Django-CRM CSRF (high 8.8)
- [CVE-2018-16551](https://insights.sbomify.com/CVE-2018-16551/): Stored XSS in LavaLite 5.5 (medium 5.4)
- [CVE-2018-16550](https://insights.sbomify.com/CVE-2018-16550/): Auth bypass in teamviewer:teamviewer (critical 9.8)
- [CVE-2018-1655](https://insights.sbomify.com/CVE-2018-1655/): Information disclosure in AIX (medium 4.0)
- [CVE-2018-16549](https://insights.sbomify.com/CVE-2018-16549/): Path traversal in php file browser script project:php file browser script (medium 5.3)
- [CVE-2018-16548](https://insights.sbomify.com/CVE-2018-16548/): Denial of service in gdraheim:zziplib (medium 6.5)
- [CVE-2018-16546](https://insights.sbomify.com/CVE-2018-16546/): Hardcoded credentials in amcrest:amcrest ipc-hx1x3x-lexus eng n amcrest (medium 5.9)
- [CVE-2018-16545](https://insights.sbomify.com/CVE-2018-16545/): Code injection in kzsoftware:asset manager (high 7.8)
- [CVE-2018-16543](https://insights.sbomify.com/CVE-2018-16543/): Other in artifex:ghostscript (high 7.8)
- [CVE-2018-16542](https://insights.sbomify.com/CVE-2018-16542/): Memory corruption in artifex:ghostscript (medium 5.5)
- [CVE-2018-16541](https://insights.sbomify.com/CVE-2018-16541/): Use after free in artifex:ghostscript (medium 5.5)
- [CVE-2018-16540](https://insights.sbomify.com/CVE-2018-16540/): Use after free in artifex:ghostscript (high 7.8)
- [CVE-2018-1654](https://insights.sbomify.com/CVE-2018-1654/): Open redirect in Curam Social Program Management (medium 6.8)
- [CVE-2018-16539](https://insights.sbomify.com/CVE-2018-16539/): Information disclosure in artifex:ghostscript (medium 5.5)
- [CVE-2018-16530](https://insights.sbomify.com/CVE-2018-16530/): Memory corruption in Forcepoint Email Security (critical 9.8)
- [CVE-2018-1653](https://insights.sbomify.com/CVE-2018-1653/): Cross-site scripting in Security Access Manager Appliance (medium 5.4)
- [CVE-2018-16529](https://insights.sbomify.com/CVE-2018-16529/): Auth bypass in Forcepoint Email Security (critical 9.8)
- [CVE-2018-16528](https://insights.sbomify.com/CVE-2018-16528/): Memory corruption in amazon:amazon web services freertos (high 8.1)
- [CVE-2018-16527](https://insights.sbomify.com/CVE-2018-16527/): Information disclosure in amazon:amazon web services freertos (medium 5.9)
- [CVE-2018-16526](https://insights.sbomify.com/CVE-2018-16526/): Memory corruption in amazon:amazon web services freertos (high 8.1)
- [CVE-2018-16525](https://insights.sbomify.com/CVE-2018-16525/): Memory corruption in amazon:amazon web services freertos (high 8.1)
- [CVE-2018-16524](https://insights.sbomify.com/CVE-2018-16524/): Information disclosure in amazon:amazon web services freertos (medium 5.9)
- [CVE-2018-16523](https://insights.sbomify.com/CVE-2018-16523/): Denial of service in amazon:amazon web services freertos (high 7.4)
- [CVE-2018-16522](https://insights.sbomify.com/CVE-2018-16522/): Memory corruption in amazon:amazon web services freertos (high 8.1)
- [CVE-2018-16521](https://insights.sbomify.com/CVE-2018-16521/): XML external entity in openmrs:html form entry (critical 9.8)
- [CVE-2018-1652](https://insights.sbomify.com/CVE-2018-1652/): Denial of service in DataPower Gateways (medium 6.2)
- [CVE-2018-16519](https://insights.sbomify.com/CVE-2018-16519/): Cross-site scripting in coyoapp:coyo (medium 6.1)
- [CVE-2018-16518](https://insights.sbomify.com/CVE-2018-16518/): Path traversal in primx:zed\! (critical 9.8)
- [CVE-2018-16517](https://insights.sbomify.com/CVE-2018-16517/): Null dereference in nasm:netwide assembler (medium 5.5)
- [CVE-2018-16516](https://insights.sbomify.com/CVE-2018-16516/): Flask-Admin Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2018-16515](https://insights.sbomify.com/CVE-2018-16515/): Matrix Synapse Improper Signature Validation (high 8.8)
- [CVE-2018-16514](https://insights.sbomify.com/CVE-2018-16514/): MantisBT cross-site scripting (XSS) vulnerability through crafted PATH_INFO (medium 4.7)
- [CVE-2018-16513](https://insights.sbomify.com/CVE-2018-16513/): Memory corruption in artifex:ghostscript (high 7.8)
- [CVE-2018-16511](https://insights.sbomify.com/CVE-2018-16511/): Memory corruption in artifex:ghostscript (high 7.8)
- [CVE-2018-16510](https://insights.sbomify.com/CVE-2018-16510/): Memory corruption in artifex:ghostscript (high 7.8)
- [CVE-2018-16509](https://insights.sbomify.com/CVE-2018-16509/): Security feature bypass in artifex:ghostscript (high 7.8)
- [CVE-2018-1650](https://insights.sbomify.com/CVE-2018-1650/): Hardcoded credentials in QRadar SIEM (medium 5.9)
- [CVE-2018-16499](https://insights.sbomify.com/CVE-2018-16499/): Weak cryptography in Versa VOS (medium 5.9)
- [CVE-2018-16498](https://insights.sbomify.com/CVE-2018-16498/): Information disclosure in Versa Director (medium 5.5)
- [CVE-2018-16497](https://insights.sbomify.com/CVE-2018-16497/): Privilege escalation in Versa Analytics (high 7.8)
- [CVE-2018-16496](https://insights.sbomify.com/CVE-2018-16496/): Auth bypass in Versa Director (medium 5.3)
- [CVE-2018-16495](https://insights.sbomify.com/CVE-2018-16495/): Auth bypass in Versa VOS (high 8.8)
- [CVE-2018-16494](https://insights.sbomify.com/CVE-2018-16494/): Misconfiguration in Versa VOS (high 8.8)
- [CVE-2018-16493](https://insights.sbomify.com/CVE-2018-16493/): Path Traversal in simplehttpserver (high 7.5)
- [CVE-2018-16492](https://insights.sbomify.com/CVE-2018-16492/): Prototype Pollution in extend (critical 9.8)
- [CVE-2018-16491](https://insights.sbomify.com/CVE-2018-16491/): Prototype Pollution in node.extend (critical 9.8)
- [CVE-2018-16490](https://insights.sbomify.com/CVE-2018-16490/): Prototype Pollution in mpath (high 7.5)
- [CVE-2018-1649](https://insights.sbomify.com/CVE-2018-1649/): Path traversal in QRadar Incident Forensics (high 7.7)
- [CVE-2018-16489](https://insights.sbomify.com/CVE-2018-16489/): Prototype Pollution in just-extend (critical 9.8)
- [CVE-2018-16487](https://insights.sbomify.com/CVE-2018-16487/): Prototype Pollution in lodash (medium 5.6)
- [CVE-2018-16486](https://insights.sbomify.com/CVE-2018-16486/): Prototype Pollution in defaults-deep (critical 9.8)
- [CVE-2018-16485](https://insights.sbomify.com/CVE-2018-16485/): m-server Vulnerable to Directory Traversal (medium 6.5)
- [CVE-2018-16484](https://insights.sbomify.com/CVE-2018-16484/): Cross-Site Scripting in m-server (medium 5.4)
- [CVE-2018-16483](https://insights.sbomify.com/CVE-2018-16483/): Authentication Bypass by Spoofing in express-cart (high 8.8)
- [CVE-2018-16482](https://insights.sbomify.com/CVE-2018-16482/): mcstatic directory traversal vulnerability (high 7.5)
- [CVE-2018-16481](https://insights.sbomify.com/CVE-2018-16481/): Cross-Site Scripting in html-pages (medium 6.1)
- [CVE-2018-16480](https://insights.sbomify.com/CVE-2018-16480/): Tnantoka/public XSS Vulnerability (medium 6.1)
- [CVE-2018-1648](https://insights.sbomify.com/CVE-2018-1648/): Weak cryptography in ibm:qradar incident forensics (high 7.5)
- [CVE-2018-16479](https://insights.sbomify.com/CVE-2018-16479/): Path Traversal in http-live-simulator (high 7.5)
- [CVE-2018-16478](https://insights.sbomify.com/CVE-2018-16478/): Path Traversal in simplehttpserver (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/96/