# Vulnerabilities published in 2018 - [CVE-2018-16249](https://insights.sbomify.com/CVE-2018-16249/): Cross-site scripting in b3log:symphony (medium 4.8) - [CVE-2018-16248](https://insights.sbomify.com/CVE-2018-16248/): Cross-site scripting in b3log:solo (medium 6.1) - [CVE-2018-16247](https://insights.sbomify.com/CVE-2018-16247/): Cross-site scripting in yzmcms:yzmcms (medium 5.4) - [CVE-2018-16243](https://insights.sbomify.com/CVE-2018-16243/): Cross-site scripting in solarwinds:database performance analyzer (medium 5.4) - [CVE-2018-16242](https://insights.sbomify.com/CVE-2018-16242/): Weak cryptography in o.bike:obike-stationless bike sharing (medium 5.3) - [CVE-2018-16239](https://insights.sbomify.com/CVE-2018-16239/): Weak cryptography in damicms:damicms (critical 9.8) - [CVE-2018-16238](https://insights.sbomify.com/CVE-2018-16238/): File upload in damicms:damicms (high 7.2) - [CVE-2018-16237](https://insights.sbomify.com/CVE-2018-16237/): Path traversal in damicms:damicms (low 2.7) - [CVE-2018-16236](https://insights.sbomify.com/CVE-2018-16236/): Cross-site scripting in cpanel:cpanel (medium 6.1) - [CVE-2018-16235](https://insights.sbomify.com/CVE-2018-16235/): Cross-site scripting in telligent:community (medium 6.1) - [CVE-2018-16234](https://insights.sbomify.com/CVE-2018-16234/): Cross-site scripting in morningstarsecurity:whatweb (medium 6.1) - [CVE-2018-16233](https://insights.sbomify.com/CVE-2018-16233/): Cross-site scripting in 1234n:minicms (medium 6.1) - [CVE-2018-16232](https://insights.sbomify.com/CVE-2018-16232/): Command injection in ipfire:ipfire (high 8.8) - [CVE-2018-16231](https://insights.sbomify.com/CVE-2018-16231/): Denial of service in michael-roth-software:pftp (high 7.5) - [CVE-2018-16230](https://insights.sbomify.com/CVE-2018-16230/): Memory corruption in apple:mac os x (critical 9.8) - [CVE-2018-1623](https://insights.sbomify.com/CVE-2018-1623/): Information disclosure in Security Privileged Identity Manager (medium 4.0) - [CVE-2018-16229](https://insights.sbomify.com/CVE-2018-16229/): Memory corruption in apple:mac os x (high 7.5) - [CVE-2018-16228](https://insights.sbomify.com/CVE-2018-16228/): Memory corruption in apple:mac os x (critical 9.8) - [CVE-2018-16227](https://insights.sbomify.com/CVE-2018-16227/): Memory corruption in apple:mac os x (high 7.5) - [CVE-2018-16226](https://insights.sbomify.com/CVE-2018-16226/): Cross-site scripting in mitel:mivoice office 400 (medium 6.1) - [CVE-2018-16225](https://insights.sbomify.com/CVE-2018-16225/): Auth bypass in qbeecam:qbee multi-sensor camera firmware (medium 6.5) - [CVE-2018-16224](https://insights.sbomify.com/CVE-2018-16224/): Information disclosure in ismartalarm:cubeone firmware (medium 5.3) - [CVE-2018-16223](https://insights.sbomify.com/CVE-2018-16223/): Information disclosure in qbeecam:qbeecam (critical 9.8) - [CVE-2018-16222](https://insights.sbomify.com/CVE-2018-16222/): Information disclosure in ismartalarm:ismartalarm (medium 6.8) - [CVE-2018-16221](https://insights.sbomify.com/CVE-2018-16221/): Path traversal in yealink:ultra-elegant ip phone sip-t41p firmware (high 8.0) - [CVE-2018-16220](https://insights.sbomify.com/CVE-2018-16220/): Cross-site scripting in audiocodes:405hd firmware (medium 6.1) - [CVE-2018-1622](https://insights.sbomify.com/CVE-2018-1622/): Cross-site request forgery in Security Privileged Identity Manager (medium 4.3) - [CVE-2018-16219](https://insights.sbomify.com/CVE-2018-16219/): Auth bypass in audiocodes:405hd firmware (high 8.8) - [CVE-2018-16218](https://insights.sbomify.com/CVE-2018-16218/): Cross-site request forgery in yealink:ultra-elegant ip phone sip-t41p firmware (high 8.8) - [CVE-2018-16217](https://insights.sbomify.com/CVE-2018-16217/): Command injection in yealink:ultra-elegant ip phone sip-t41p firmware (high 8.8) - [CVE-2018-16216](https://insights.sbomify.com/CVE-2018-16216/): Command injection in audiocodes:405hd firmware (high 8.0) - [CVE-2018-16210](https://insights.sbomify.com/CVE-2018-16210/): Cross-site scripting in wago:750-352 firmware (medium 6.1) - [CVE-2018-1621](https://insights.sbomify.com/CVE-2018-1621/): Information disclosure in WebSphere Application Server (medium 4.4) - [CVE-2018-16207](https://insights.sbomify.com/CVE-2018-16207/): Missing authorization in PowerAct Pro Master Agent for Windows (medium 6.5) - [CVE-2018-16206](https://insights.sbomify.com/CVE-2018-16206/): Cross-site scripting in spam-byebye (medium 6.1) - [CVE-2018-16205](https://insights.sbomify.com/CVE-2018-16205/): Cross-site scripting in GROWI (medium 5.4) - [CVE-2018-16204](https://insights.sbomify.com/CVE-2018-16204/): Cross-site scripting in Google XML Sitemaps (medium 4.8) - [CVE-2018-16203](https://insights.sbomify.com/CVE-2018-16203/): Auth bypass in PgpoolAdmin (critical 9.8) - [CVE-2018-16202](https://insights.sbomify.com/CVE-2018-16202/): Path Traversal in cordova-plugin-ionic-webview (high 8.6) - [CVE-2018-16201](https://insights.sbomify.com/CVE-2018-16201/): Hardcoded credentials in Toshiba Home gateway HEM-GW16A and Toshiba Home gateway HEM-GW26A (high 8.8) - [CVE-2018-16200](https://insights.sbomify.com/CVE-2018-16200/): Command injection in Toshiba Home gateway HEM-GW16A and Toshiba Home gateway HEM-GW26A (high 8.8) - [CVE-2018-16199](https://insights.sbomify.com/CVE-2018-16199/): Cross-site scripting in Toshiba Home gateway HEM-GW16A and Toshiba Home gateway HEM-GW26A (medium 6.1) - [CVE-2018-16198](https://insights.sbomify.com/CVE-2018-16198/): Auth bypass in Toshiba Home gateway HEM-GW16A and Toshiba Home gateway HEM-GW26A (high 8.8) - [CVE-2018-16197](https://insights.sbomify.com/CVE-2018-16197/): Auth bypass in Toshiba Home gateway HEM-GW16A and Toshiba Home gateway HEM-GW26A (medium 6.5) - [CVE-2018-16196](https://insights.sbomify.com/CVE-2018-16196/): Denial of service in Multiple Yokogawa products that contain Vnet/IP Open Communication Driver (high 7.5) - [CVE-2018-16195](https://insights.sbomify.com/CVE-2018-16195/): Command injection in Aterm WF1200CR and Aterm WG1200CR (high 8.8) - [CVE-2018-16194](https://insights.sbomify.com/CVE-2018-16194/): Command injection in Aterm WF1200CR and Aterm WG1200CR (high 7.2) - [CVE-2018-16193](https://insights.sbomify.com/CVE-2018-16193/): Cross-site scripting in Aterm WF1200CR and Aterm WG1200CR (medium 5.4) - [CVE-2018-16192](https://insights.sbomify.com/CVE-2018-16192/): Information disclosure in Aterm WF1200CR and Aterm WG1200CR (medium 6.5) - [CVE-2018-16191](https://insights.sbomify.com/CVE-2018-16191/): EC-CUBE Open redirect vulnerability (medium 6.1) - [CVE-2018-16190](https://insights.sbomify.com/CVE-2018-16190/): Other in UNARJ32.DLL for Win32, LHMelting for Win32, and LMLzh32.DLL (high 7.8) - [CVE-2018-16189](https://insights.sbomify.com/CVE-2018-16189/): Other in Self-Extracting Archives created by UNLHA32.DLL (high 7.8) - [CVE-2018-16188](https://insights.sbomify.com/CVE-2018-16188/): SQL injection in RICOH Interactive Whiteboard (critical 9.8) - [CVE-2018-16187](https://insights.sbomify.com/CVE-2018-16187/): Security feature bypass in RICOH Interactive Whiteboard (medium 5.9) - [CVE-2018-16186](https://insights.sbomify.com/CVE-2018-16186/): Hardcoded credentials in RICOH Interactive Whiteboard (high 8.8) - [CVE-2018-16185](https://insights.sbomify.com/CVE-2018-16185/): Code injection in RICOH Interactive Whiteboard (high 7.8) - [CVE-2018-16184](https://insights.sbomify.com/CVE-2018-16184/): Command injection in RICOH Interactive Whiteboard (critical 9.8) - [CVE-2018-16183](https://insights.sbomify.com/CVE-2018-16183/): Privilege escalation in Some pre-installed applications on Panasonic PC (high 7.8) - [CVE-2018-16182](https://insights.sbomify.com/CVE-2018-16182/): Other in The installer of MARKET SPEED (high 7.8) - [CVE-2018-16181](https://insights.sbomify.com/CVE-2018-16181/): Other in i-FILTER (medium 6.1) - [CVE-2018-16180](https://insights.sbomify.com/CVE-2018-16180/): Cross-site scripting in i-FILTER (medium 6.1) - [CVE-2018-1618](https://insights.sbomify.com/CVE-2018-1618/): Path traversal in Security Privileged Identity Manager (high 7.7) - [CVE-2018-16179](https://insights.sbomify.com/CVE-2018-16179/): Security feature bypass in Mizuho Direct App for Android (medium 5.9) - [CVE-2018-16178](https://insights.sbomify.com/CVE-2018-16178/): Auth bypass in Cybozu Garoon (high 7.5) - [CVE-2018-16177](https://insights.sbomify.com/CVE-2018-16177/): Privilege escalation in The installer of Windows10 Fall Creators Update Modify module for Security Measures tool (high 7.8) - [CVE-2018-16176](https://insights.sbomify.com/CVE-2018-16176/): Other in Installer of Mapping Tool (high 7.8) - [CVE-2018-16175](https://insights.sbomify.com/CVE-2018-16175/): SQL injection in LearnPress (high 7.2) - [CVE-2018-16174](https://insights.sbomify.com/CVE-2018-16174/): Open redirect in LearnPress (medium 6.1) - [CVE-2018-16173](https://insights.sbomify.com/CVE-2018-16173/): Cross-site scripting in LearnPress (medium 6.1) - [CVE-2018-16172](https://insights.sbomify.com/CVE-2018-16172/): Other in Cybozu Remote Service (medium 6.5) - [CVE-2018-16171](https://insights.sbomify.com/CVE-2018-16171/): Path traversal in Cybozu Remote Service (high 8.8) - [CVE-2018-16170](https://insights.sbomify.com/CVE-2018-16170/): Path traversal in Cybozu Remote Service (high 8.1) - [CVE-2018-16169](https://insights.sbomify.com/CVE-2018-16169/): File upload in Cybozu Remote Service (high 8.8) - [CVE-2018-16168](https://insights.sbomify.com/CVE-2018-16168/): Code injection in LogonTracer (critical 9.8) - [CVE-2018-16167](https://insights.sbomify.com/CVE-2018-16167/): Command injection in LogonTracer (critical 9.8) - [CVE-2018-16166](https://insights.sbomify.com/CVE-2018-16166/): XML external entity in LogonTracer (high 8.8) - [CVE-2018-16165](https://insights.sbomify.com/CVE-2018-16165/): Cross-site scripting in LogonTracer (medium 6.1) - [CVE-2018-16164](https://insights.sbomify.com/CVE-2018-16164/): Cross-site scripting in Event Calendar WD version (medium 5.4) - [CVE-2018-16163](https://insights.sbomify.com/CVE-2018-16163/): Auth bypass in OpenDolphin (medium 6.5) - [CVE-2018-16162](https://insights.sbomify.com/CVE-2018-16162/): Information disclosure in OpenDolphin (high 8.8) - [CVE-2018-16161](https://insights.sbomify.com/CVE-2018-16161/): Privilege escalation in OpenDolphin (high 8.8) - [CVE-2018-16160](https://insights.sbomify.com/CVE-2018-16160/): Auth bypass in SecureCore Standard Edition (high 7.8) - [CVE-2018-16159](https://insights.sbomify.com/CVE-2018-16159/): SQL injection in codemenschen:gift vouchers (critical 9.8) - [CVE-2018-16158](https://insights.sbomify.com/CVE-2018-16158/): Hardcoded credentials in eaton:power xpert meter 4000 firmware (critical 9.8) - [CVE-2018-16157](https://insights.sbomify.com/CVE-2018-16157/): Business logic in bijiadao:waimai super cms (medium 5.3) - [CVE-2018-16156](https://insights.sbomify.com/CVE-2018-16156/): Privilege escalation in fujitsu:paperstream ip \(twain\) (high 7.8) - [CVE-2018-16153](https://insights.sbomify.com/CVE-2018-16153/): Opencast publishes global system account credentials (high 7.5) - [CVE-2018-16152](https://insights.sbomify.com/CVE-2018-16152/): Weak cryptography in canonical:ubuntu linux (high 7.5) - [CVE-2018-16151](https://insights.sbomify.com/CVE-2018-16151/): Weak cryptography in canonical:ubuntu linux (high 7.5) - [CVE-2018-16150](https://insights.sbomify.com/CVE-2018-16150/): Weak cryptography in axtls project:axtls (medium 5.9) - [CVE-2018-16149](https://insights.sbomify.com/CVE-2018-16149/): Memory corruption in axtls project:axtls (medium 5.9) - [CVE-2018-16148](https://insights.sbomify.com/CVE-2018-16148/): Cross-site scripting in opsview:opsview (medium 6.1) - [CVE-2018-16147](https://insights.sbomify.com/CVE-2018-16147/): Cross-site scripting in opsview:opsview (medium 6.1) - [CVE-2018-16146](https://insights.sbomify.com/CVE-2018-16146/): Command injection in opsview:opsview (high 7.2) - [CVE-2018-16145](https://insights.sbomify.com/CVE-2018-16145/): Privilege escalation in opsview:opsview (high 8.1) - [CVE-2018-16144](https://insights.sbomify.com/CVE-2018-16144/): Command injection in opsview:opsview (critical 9.8) - [CVE-2018-16142](https://insights.sbomify.com/CVE-2018-16142/): Cross-site scripting in phpok:phpok (medium 6.1) - [CVE-2018-16141](https://insights.sbomify.com/CVE-2018-16141/): Path traversal in thinkcmf:thinkcmfx (medium 6.5) - [CVE-2018-16140](https://insights.sbomify.com/CVE-2018-16140/): Memory corruption in canonical:ubuntu linux (high 7.8) - [CVE-2018-1614](https://insights.sbomify.com/CVE-2018-1614/): Information disclosure in WebSphere Application Server (medium 5.8) --- From sbomify Insights: https://insights.sbomify.com/years/2018/page/99/