# Vulnerabilities published in 2018 - [CVE-2018-16477](https://insights.sbomify.com/CVE-2018-16477/): Exposure of Sensitive Information to an Unauthorized Actor in activestorage (medium 6.5) - [CVE-2018-16476](https://insights.sbomify.com/CVE-2018-16476/): Improper Access Control in activejob (high 7.5) - [CVE-2018-16475](https://insights.sbomify.com/CVE-2018-16475/): Path Traversal in knightjs (high 7.5) - [CVE-2018-16474](https://insights.sbomify.com/CVE-2018-16474/): Stored Cross-Site Scripting in tianma-static (medium 6.1) - [CVE-2018-16473](https://insights.sbomify.com/CVE-2018-16473/): Path Traversal in takeapeek (medium 5.3) - [CVE-2018-16472](https://insights.sbomify.com/CVE-2018-16472/): Prototype Pollution in cached-path-relative (high 7.5) - [CVE-2018-16471](https://insights.sbomify.com/CVE-2018-16471/): Rack vulnerable to Cross-site Scripting (medium 6.1) - [CVE-2018-16470](https://insights.sbomify.com/CVE-2018-16470/): Rack vulnerable to Denial of Service (high 7.5) - [CVE-2018-1647](https://insights.sbomify.com/CVE-2018-1647/): Denial of service in QRadar Incident Forensics (high 7.5) - [CVE-2018-16469](https://insights.sbomify.com/CVE-2018-16469/): Prototype Pollution in merge (high 7.5) - [CVE-2018-16468](https://insights.sbomify.com/CVE-2018-16468/): Loofah Cross-site Scripting vulnerability (medium 5.4) - [CVE-2018-16467](https://insights.sbomify.com/CVE-2018-16467/): Auth bypass in Nextcloud Server (medium 5.3) - [CVE-2018-16466](https://insights.sbomify.com/CVE-2018-16466/): Security feature bypass in Nextcloud Server (high 8.1) - [CVE-2018-16465](https://insights.sbomify.com/CVE-2018-16465/): Auth bypass in Nextcloud Server (medium 5.3) - [CVE-2018-16464](https://insights.sbomify.com/CVE-2018-16464/): Auth bypass in Nextcloud Server (medium 5.7) - [CVE-2018-16463](https://insights.sbomify.com/CVE-2018-16463/): Auth bypass in Nextcloud Server (low 3.1) - [CVE-2018-16462](https://insights.sbomify.com/CVE-2018-16462/): Command Injection in apex-publish-static-files (critical 10.0) - [CVE-2018-16461](https://insights.sbomify.com/CVE-2018-16461/): Command Injection in libnmap (critical 9.8) - [CVE-2018-16460](https://insights.sbomify.com/CVE-2018-16460/): ps Enables OS Command Injection (critical 9.8) - [CVE-2018-16459](https://insights.sbomify.com/CVE-2018-16459/): Cross-Site Scripting in exceljs (medium 6.1) - [CVE-2018-16458](https://insights.sbomify.com/CVE-2018-16458/): Cross-site request forgery in baigo:baigo cms (medium 6.5) - [CVE-2018-16457](https://insights.sbomify.com/CVE-2018-16457/): Information disclosure in open source real-estate script project:open source real-estate script (medium 5.3) - [CVE-2018-16456](https://insights.sbomify.com/CVE-2018-16456/): Cross-site scripting in phpscriptsmall:website seller script (medium 6.1) - [CVE-2018-16455](https://insights.sbomify.com/CVE-2018-16455/): Cross-site scripting in marketplace script project:marketplace script (medium 6.1) - [CVE-2018-16454](https://insights.sbomify.com/CVE-2018-16454/): Denial of service in currency converter script project:currency converter script (high 7.5) - [CVE-2018-16453](https://insights.sbomify.com/CVE-2018-16453/): Cross-site scripting in domain lookup script project:domain lookup script (medium 6.1) - [CVE-2018-16452](https://insights.sbomify.com/CVE-2018-16452/): Denial of service in tcpdump:tcpdump (high 7.5) - [CVE-2018-16451](https://insights.sbomify.com/CVE-2018-16451/): Memory corruption in apple:mac os x (critical 9.8) - [CVE-2018-16450](https://insights.sbomify.com/CVE-2018-16450/): Cross-site scripting in craftedweb project:craftedweb (medium 6.1) - [CVE-2018-16449](https://insights.sbomify.com/CVE-2018-16449/): Cross-site request forgery in onethink:onethink (medium 6.5) - [CVE-2018-16448](https://insights.sbomify.com/CVE-2018-16448/): Cross-site request forgery in chshcms:cscms (high 8.8) - [CVE-2018-16447](https://insights.sbomify.com/CVE-2018-16447/): Cross-site request forgery in frogcms project:frogcms (high 8.8) - [CVE-2018-16446](https://insights.sbomify.com/CVE-2018-16446/): Path traversal in seamcms:seacms (high 7.5) - [CVE-2018-16445](https://insights.sbomify.com/CVE-2018-16445/): SQL injection in seacms:seacms (critical 9.8) - [CVE-2018-16444](https://insights.sbomify.com/CVE-2018-16444/): Server-side request forgery in seacms:seacms (critical 9.1) - [CVE-2018-1644](https://insights.sbomify.com/CVE-2018-1644/): Information disclosure in WebSphere Commerce (low 3.1) - [CVE-2018-16438](https://insights.sbomify.com/CVE-2018-16438/): Memory corruption in hdfgroup:hdf5 (high 8.8) - [CVE-2018-16437](https://insights.sbomify.com/CVE-2018-16437/): Path traversal in gxlcms:gxlcms (medium 4.9) - [CVE-2018-16436](https://insights.sbomify.com/CVE-2018-16436/): SQL injection in gxlcms:gxlcms (high 7.2) - [CVE-2018-16435](https://insights.sbomify.com/CVE-2018-16435/): Integer overflow in canonical:ubuntu linux (medium 5.5) - [CVE-2018-16432](https://insights.sbomify.com/CVE-2018-16432/): SQL injection in bluecms project:bluecms (critical 9.8) - [CVE-2018-16431](https://insights.sbomify.com/CVE-2018-16431/): Cross-site request forgery in yfcmf:yfcmf (high 8.8) - [CVE-2018-16430](https://insights.sbomify.com/CVE-2018-16430/): Memory corruption in debian:debian linux (high 8.8) - [CVE-2018-1643](https://insights.sbomify.com/CVE-2018-1643/): Cross-site scripting in WebSphere Application Server (medium 6.1) - [CVE-2018-16429](https://insights.sbomify.com/CVE-2018-16429/): Memory corruption in canonical:ubuntu linux (high 7.5) - [CVE-2018-16428](https://insights.sbomify.com/CVE-2018-16428/): Null dereference in canonical:ubuntu linux (critical 9.8) - [CVE-2018-16427](https://insights.sbomify.com/CVE-2018-16427/): Memory corruption in opensc project:opensc (medium 4.3) - [CVE-2018-16426](https://insights.sbomify.com/CVE-2018-16426/): Denial of service in opensc project:opensc (medium 4.3) - [CVE-2018-16425](https://insights.sbomify.com/CVE-2018-16425/): Memory corruption in opensc project:opensc (medium 6.6) - [CVE-2018-16424](https://insights.sbomify.com/CVE-2018-16424/): Memory corruption in opensc project:opensc (medium 6.6) - [CVE-2018-16423](https://insights.sbomify.com/CVE-2018-16423/): Memory corruption in opensc project:opensc (medium 6.6) - [CVE-2018-16422](https://insights.sbomify.com/CVE-2018-16422/): Memory corruption in opensc project:opensc (medium 6.6) - [CVE-2018-16421](https://insights.sbomify.com/CVE-2018-16421/): Memory corruption in opensc project:opensc (medium 6.6) - [CVE-2018-16420](https://insights.sbomify.com/CVE-2018-16420/): Memory corruption in opensc project:opensc (medium 6.6) - [CVE-2018-16419](https://insights.sbomify.com/CVE-2018-16419/): Memory corruption in opensc project:opensc (medium 6.6) - [CVE-2018-16418](https://insights.sbomify.com/CVE-2018-16418/): Memory corruption in opensc project:opensc (medium 6.6) - [CVE-2018-16417](https://insights.sbomify.com/CVE-2018-16417/): Command injection in arubanetworks:instant (high 7.5) - [CVE-2018-16416](https://insights.sbomify.com/CVE-2018-16416/): Cross-site request forgery in thedaylightstudio:fuel cms (high 8.8) - [CVE-2018-16413](https://insights.sbomify.com/CVE-2018-16413/): Memory corruption in imagemagick:imagemagick (high 8.8) - [CVE-2018-16412](https://insights.sbomify.com/CVE-2018-16412/): Memory corruption in imagemagick:imagemagick (high 8.8) - [CVE-2018-16410](https://insights.sbomify.com/CVE-2018-16410/): SQL injection in vanillaforums:vanilla (medium 6.5) - [CVE-2018-16409](https://insights.sbomify.com/CVE-2018-16409/): Server-side request forgery in gogs:gogs (high 8.6) - [CVE-2018-16408](https://insights.sbomify.com/CVE-2018-16408/): Command injection in d-link:dir-846 firmware (high 7.2) - [CVE-2018-16407](https://insights.sbomify.com/CVE-2018-16407/): Moderate severity vulnerability that affects mayan-edms (medium 6.1) - [CVE-2018-16406](https://insights.sbomify.com/CVE-2018-16406/): Moderate severity vulnerability that affects mayan-edms (medium 6.1) - [CVE-2018-16405](https://insights.sbomify.com/CVE-2018-16405/): mayan-edms Cross-site Scripting vulnerability (medium 6.1) - [CVE-2018-16403](https://insights.sbomify.com/CVE-2018-16403/): Memory corruption in elfutils project:elfutils (medium 5.5) - [CVE-2018-16402](https://insights.sbomify.com/CVE-2018-16402/): Memory corruption in canonical:ubuntu linux (critical 9.8) - [CVE-2018-1640](https://insights.sbomify.com/CVE-2018-1640/): Command injection in Security Privileged Identity Manager (high 8.8) - [CVE-2018-16398](https://insights.sbomify.com/CVE-2018-16398/): Security feature bypass in twistlock:authz broker (high 7.5) - [CVE-2018-16397](https://insights.sbomify.com/CVE-2018-16397/): Path traversal in limesurvey:limesurvey (medium 4.9) - [CVE-2018-16396](https://insights.sbomify.com/CVE-2018-16396/): Security feature bypass in canonical:ubuntu linux (high 8.1) - [CVE-2018-16395](https://insights.sbomify.com/CVE-2018-16395/): Ruby Openssl Allows Incorrect Value Comparison (critical 9.8) - [CVE-2018-16393](https://insights.sbomify.com/CVE-2018-16393/): Memory corruption in opensc project:opensc (medium 6.8) - [CVE-2018-16392](https://insights.sbomify.com/CVE-2018-16392/): Memory corruption in opensc project:opensc (medium 6.8) - [CVE-2018-16391](https://insights.sbomify.com/CVE-2018-16391/): Memory corruption in opensc project:opensc (medium 6.8) - [CVE-2018-1639](https://insights.sbomify.com/CVE-2018-1639/): Information disclosure in Jazz Reporting Service (medium 4.3) - [CVE-2018-16389](https://insights.sbomify.com/CVE-2018-16389/): SQL injection in e107:e107 (medium 6.5) - [CVE-2018-16388](https://insights.sbomify.com/CVE-2018-16388/): File upload in e107:e107 (high 7.2) - [CVE-2018-16387](https://insights.sbomify.com/CVE-2018-16387/): Elefant CMS CSRF Vulnerability (high 8.8) - [CVE-2018-16386](https://insights.sbomify.com/CVE-2018-16386/): Other in swift:alliance web platform (high 7.5) - [CVE-2018-16385](https://insights.sbomify.com/CVE-2018-16385/): ThinkPHP SQL Injection vulnerability (critical 9.8) - [CVE-2018-16384](https://insights.sbomify.com/CVE-2018-16384/): SQL injection in owasp:owasp modsecurity core rule set (high 7.5) - [CVE-2018-16382](https://insights.sbomify.com/CVE-2018-16382/): Memory corruption in nasm:netwide assembler (medium 5.5) - [CVE-2018-16381](https://insights.sbomify.com/CVE-2018-16381/): Cross-site scripting in e107:e107 (medium 6.1) - [CVE-2018-16380](https://insights.sbomify.com/CVE-2018-16380/): Cross-site request forgery in digimute:ogma cms (high 8.8) - [CVE-2018-1638](https://insights.sbomify.com/CVE-2018-1638/): Auth bypass in API Connect (medium 5.9) - [CVE-2018-16379](https://insights.sbomify.com/CVE-2018-16379/): Cross-site scripting in digimute:ogma cms (medium 4.8) - [CVE-2018-16376](https://insights.sbomify.com/CVE-2018-16376/): Memory corruption in uclouvain:openjpeg (high 8.8) - [CVE-2018-16375](https://insights.sbomify.com/CVE-2018-16375/): Memory corruption in uclouvain:openjpeg (high 8.8) - [CVE-2018-16374](https://insights.sbomify.com/CVE-2018-16374/): Cross-site scripting in frog cms project:frog cms (medium 4.8) - [CVE-2018-16373](https://insights.sbomify.com/CVE-2018-16373/): File upload in frog cms project:frog cms (medium 4.9) - [CVE-2018-16372](https://insights.sbomify.com/CVE-2018-16372/): Cross-site scripting in ideacms:ideacms (medium 6.1) - [CVE-2018-16371](https://insights.sbomify.com/CVE-2018-16371/): Cross-site scripting in pescms:pescms team (medium 6.1) - [CVE-2018-16370](https://insights.sbomify.com/CVE-2018-16370/): File upload in pescms:pescms team (critical 9.8) - [CVE-2018-16369](https://insights.sbomify.com/CVE-2018-16369/): Denial of service in xpdfreader:xpdf (medium 5.5) - [CVE-2018-16368](https://insights.sbomify.com/CVE-2018-16368/): Memory corruption in xpdfreader:xpdf (medium 5.5) - [CVE-2018-16367](https://insights.sbomify.com/CVE-2018-16367/): Path traversal in qduoj:onlinejudge (critical 9.9) - [CVE-2018-16366](https://insights.sbomify.com/CVE-2018-16366/): Cross-site request forgery in idreamsoft:icms (high 8.8) - [CVE-2018-16365](https://insights.sbomify.com/CVE-2018-16365/): Cross-site request forgery in idreamsoft:icms (high 8.8) --- From sbomify Insights: https://insights.sbomify.com/years/2018/page/97/