# Vulnerabilities published in 2018


- [CVE-2018-15784](https://insights.sbomify.com/CVE-2018-15784/): DSA-2019-001: Dell Networking OS10 Improper Certificate Validation Vulnerability (high 7.4)
- [CVE-2018-15782](https://insights.sbomify.com/CVE-2018-15782/): DSA-2018-226: RSA® Authentication Manager Relative Path Traversal Vulnerability (high 7.7)
- [CVE-2018-15781](https://insights.sbomify.com/CVE-2018-15781/): DSA-2019-022: Dell Wyse Password Encoder Hard-coded Cryptographic Key Vulnerability (high 7.9)
- [CVE-2018-15780](https://insights.sbomify.com/CVE-2018-15780/): DSA-2018-224: RSA Archer GRC Platform Improper Access Control Vulnerability (medium 4.3)
- [CVE-2018-15778](https://insights.sbomify.com/CVE-2018-15778/): DSA-2019-019: Dell Networking OS10 OS Command Injection Vulnerability (high 8.8)
- [CVE-2018-15776](https://insights.sbomify.com/CVE-2018-15776/): iDRAC7, iDRAC8 - Improper Error Handling (medium 6.4)
- [CVE-2018-15774](https://insights.sbomify.com/CVE-2018-15774/): iDRAC7/iDRAC8/iDRAC9 - Privilege Escalation Vulnerability (low 3.8)
- [CVE-2018-15773](https://insights.sbomify.com/CVE-2018-15773/): Dell Encryption Enterprise \ Dell Data Protection Encryption Information Disclosure Vulnerability (medium 4.3)
- [CVE-2018-15772](https://insights.sbomify.com/CVE-2018-15772/): Dell EMC RecoverPoint Uncontrolled Resource Consumption Vulnerability (high 7.1)
- [CVE-2018-15771](https://insights.sbomify.com/CVE-2018-15771/): Dell EMC RecoverPoint Information Disclosure Vulnerability (medium 5.5)
- [CVE-2018-15769](https://insights.sbomify.com/CVE-2018-15769/): Denial of service in dell:bsafe (high 7.5)
- [CVE-2018-15768](https://insights.sbomify.com/CVE-2018-15768/): Insecure MySQL Configuration Vulnerability (medium 6.5)
- [CVE-2018-15767](https://insights.sbomify.com/CVE-2018-15767/): Improper Authorization Vulnerability (high 8.8)
- [CVE-2018-15766](https://insights.sbomify.com/CVE-2018-15766/): Dell Encryption and Dell Endpoint Security Suite Enterprise Security Policy Overwrite Vulnerability (high 7.5)
- [CVE-2018-15765](https://insights.sbomify.com/CVE-2018-15765/): Information disclosure in ESRS Virtual Edition (low 3.4)
- [CVE-2018-15764](https://insights.sbomify.com/CVE-2018-15764/): Misconfiguration in ESRS Policy Manager (critical 9.8)
- [CVE-2018-15763](https://insights.sbomify.com/CVE-2018-15763/): PKS leaks IaaS Credentials to Application Logs (critical 9.0)
- [CVE-2018-15762](https://insights.sbomify.com/CVE-2018-15762/): Pivotal Operations Manager gives all users heightened privileges (critical 9.0)
- [CVE-2018-15761](https://insights.sbomify.com/CVE-2018-15761/): UAA Privilege Escalation (critical 9.9)
- [CVE-2018-15759](https://insights.sbomify.com/CVE-2018-15759/): On Demand Services SDK Timing Attack Vulnerability (critical 9.1)
- [CVE-2018-15758](https://insights.sbomify.com/CVE-2018-15758/): Privilege Escalation in spring-security-oauth2 (critical 9.6)
- [CVE-2018-15756](https://insights.sbomify.com/CVE-2018-15756/): DoS Attack via Range Requests (high 7.5)
- [CVE-2018-15755](https://insights.sbomify.com/CVE-2018-15755/): CF networking internal policy server SQL injection (medium 6.6)
- [CVE-2018-15754](https://insights.sbomify.com/CVE-2018-15754/): UAA can issue tokens across identity providers if users with matching usernames exist (medium 4.2)
- [CVE-2018-15753](https://insights.sbomify.com/CVE-2018-15753/): Hardcoded credentials in mensamax:mensamax (high 7.5)
- [CVE-2018-15752](https://insights.sbomify.com/CVE-2018-15752/): Information disclosure in mensamax:mensamax (high 8.1)
- [CVE-2018-15751](https://insights.sbomify.com/CVE-2018-15751/): SaltStack Salt Remote command execution and incorrect access control when using salt-api (critical 9.8)
- [CVE-2018-15750](https://insights.sbomify.com/CVE-2018-15750/): SaltStack Salt Directory Traversal vulnerability in salt-api (medium 5.3)
- [CVE-2018-15749](https://insights.sbomify.com/CVE-2018-15749/): Memory corruption in pulsesecure:pulse secure desktop client (medium 5.5)
- [CVE-2018-15748](https://insights.sbomify.com/CVE-2018-15748/): Information disclosure in dell:2335dn engine firmware (high 8.8)
- [CVE-2018-15747](https://insights.sbomify.com/CVE-2018-15747/): glot-code-runner RCE (critical 9.8)
- [CVE-2018-15746](https://insights.sbomify.com/CVE-2018-15746/): Denial of service in qemu:qemu (medium 5.5)
- [CVE-2018-15745](https://insights.sbomify.com/CVE-2018-15745/): Path traversal in argussurveillance:dvr (high 7.5)
- [CVE-2018-15740](https://insights.sbomify.com/CVE-2018-15740/): Cross-site scripting in zohocorp:manageengine admanager plus (medium 6.1)
- [CVE-2018-15738](https://insights.sbomify.com/CVE-2018-15738/): Memory corruption in stopzilla:antimalware (medium 5.5)
- [CVE-2018-15737](https://insights.sbomify.com/CVE-2018-15737/): Denial of service in stopzilla:antimalware (medium 5.5)
- [CVE-2018-15736](https://insights.sbomify.com/CVE-2018-15736/): Denial of service in stopzilla:antimalware (medium 5.5)
- [CVE-2018-15735](https://insights.sbomify.com/CVE-2018-15735/): Memory corruption in stopzilla:antimalware (medium 5.5)
- [CVE-2018-15734](https://insights.sbomify.com/CVE-2018-15734/): Memory corruption in stopzilla:antimalware (medium 5.5)
- [CVE-2018-15733](https://insights.sbomify.com/CVE-2018-15733/): Null dereference in stopzilla:antimalware (medium 5.5)
- [CVE-2018-15732](https://insights.sbomify.com/CVE-2018-15732/): Memory corruption in stopzilla:antimalware (medium 5.5)
- [CVE-2018-15731](https://insights.sbomify.com/CVE-2018-15731/): Denial of service in stopzilla:antimalware (medium 5.5)
- [CVE-2018-15730](https://insights.sbomify.com/CVE-2018-15730/): Denial of service in stopzilla:antimalware (medium 5.5)
- [CVE-2018-15729](https://insights.sbomify.com/CVE-2018-15729/): Denial of service in stopzilla:antimalware (medium 5.5)
- [CVE-2018-15728](https://insights.sbomify.com/CVE-2018-15728/): Code injection in couchbase:couchbase server (high 8.8)
- [CVE-2018-15727](https://insights.sbomify.com/CVE-2018-15727/): Grafana Authentication Bypass (critical 9.8)
- [CVE-2018-15726](https://insights.sbomify.com/CVE-2018-15726/): Command injection in pulsesecure:pulse secure desktop client (medium 5.3)
- [CVE-2018-15723](https://insights.sbomify.com/CVE-2018-15723/): Command injection in Logitech Harmony Hub (critical 9.8)
- [CVE-2018-15722](https://insights.sbomify.com/CVE-2018-15722/): Command injection in Logitech Harmony Hub (high 8.1)
- [CVE-2018-15721](https://insights.sbomify.com/CVE-2018-15721/): Auth bypass in Logitech Harmony Hub (critical 9.8)
- [CVE-2018-15720](https://insights.sbomify.com/CVE-2018-15720/): Hardcoded credentials in Logitech Harmony Hub (critical 9.8)
- [CVE-2018-15719](https://insights.sbomify.com/CVE-2018-15719/): Hardcoded credentials in Open Dental (critical 9.8)
- [CVE-2018-15718](https://insights.sbomify.com/CVE-2018-15718/): Information disclosure in Open Dental (high 7.5)
- [CVE-2018-15717](https://insights.sbomify.com/CVE-2018-15717/): Weak cryptography in Open Dental (medium 5.3)
- [CVE-2018-15716](https://insights.sbomify.com/CVE-2018-15716/): Command injection in NUUO NVRMini2 (high 8.8)
- [CVE-2018-15715](https://insights.sbomify.com/CVE-2018-15715/): Auth bypass in Zoom (critical 9.8)
- [CVE-2018-15714](https://insights.sbomify.com/CVE-2018-15714/): Cross-site scripting in Nagios XI (medium 6.1)
- [CVE-2018-15713](https://insights.sbomify.com/CVE-2018-15713/): Cross-site scripting in Nagios XI (medium 5.4)
- [CVE-2018-15712](https://insights.sbomify.com/CVE-2018-15712/): Cross-site scripting in Nagios XI (medium 6.1)
- [CVE-2018-15711](https://insights.sbomify.com/CVE-2018-15711/): Privilege escalation in Nagios XI (high 8.8)
- [CVE-2018-15710](https://insights.sbomify.com/CVE-2018-15710/): Command injection in Nagios XI (high 7.8)
- [CVE-2018-1571](https://insights.sbomify.com/CVE-2018-1571/): Command injection in QRadar SIEM (high 8.8)
- [CVE-2018-15709](https://insights.sbomify.com/CVE-2018-15709/): Command injection in Nagios XI (high 8.8)
- [CVE-2018-15708](https://insights.sbomify.com/CVE-2018-15708/): Command injection in Nagios XI (critical 9.8)
- [CVE-2018-15707](https://insights.sbomify.com/CVE-2018-15707/): Cross-site scripting in Advantech WebAccess (medium 5.4)
- [CVE-2018-15706](https://insights.sbomify.com/CVE-2018-15706/): Path traversal in Advantech WebAccess (medium 6.5)
- [CVE-2018-15705](https://insights.sbomify.com/CVE-2018-15705/): Path traversal in Advantech WebAccess (medium 6.5)
- [CVE-2018-15704](https://insights.sbomify.com/CVE-2018-15704/): Memory corruption in Advantech WebAccess (high 8.8)
- [CVE-2018-15703](https://insights.sbomify.com/CVE-2018-15703/): Cross-site scripting in Advantech WebAccess (medium 6.1)
- [CVE-2018-15702](https://insights.sbomify.com/CVE-2018-15702/): Cross-site request forgery in TP-Link TL-WRN841N (high 8.8)
- [CVE-2018-15701](https://insights.sbomify.com/CVE-2018-15701/): Denial of service in TP-Link TL-WRN841N (medium 6.5)
- [CVE-2018-15700](https://insights.sbomify.com/CVE-2018-15700/): Denial of service in TP-Link TL-WRN841N (medium 6.5)
- [CVE-2018-15699](https://insights.sbomify.com/CVE-2018-15699/): Cross-site scripting in ASUSTOR Data Master (medium 6.1)
- [CVE-2018-15698](https://insights.sbomify.com/CVE-2018-15698/): Path traversal in ASUSTOR Data Master (medium 6.5)
- [CVE-2018-15697](https://insights.sbomify.com/CVE-2018-15697/): Path traversal in ASUSTOR Data Master (medium 6.5)
- [CVE-2018-15696](https://insights.sbomify.com/CVE-2018-15696/): Information disclosure in ASUSTOR Data Master (medium 4.3)
- [CVE-2018-15695](https://insights.sbomify.com/CVE-2018-15695/): Path traversal in ASUSTOR Data Master (medium 6.5)
- [CVE-2018-15694](https://insights.sbomify.com/CVE-2018-15694/): Path traversal in ASUSTOR Data Master (high 7.5)
- [CVE-2018-15693](https://insights.sbomify.com/CVE-2018-15693/): Missing authorization in inova-software:inova partner (medium 6.4)
- [CVE-2018-15692](https://insights.sbomify.com/CVE-2018-15692/): Missing authorization in inova-software:inova partner (medium 6.4)
- [CVE-2018-15691](https://insights.sbomify.com/CVE-2018-15691/): Deserialization in Release Automation (critical 9.8)
- [CVE-2018-15688](https://insights.sbomify.com/CVE-2018-15688/): Out-of-Bounds write in systemd-networkd dhcpv6 option handling (high 8.8)
- [CVE-2018-15687](https://insights.sbomify.com/CVE-2018-15687/): systemd: chown_one() can dereference symlinks (high 7.8)
- [CVE-2018-15686](https://insights.sbomify.com/CVE-2018-15686/): systemd: reexec state injection: fgets() on overlong lines leads to line splitting (high 7.0)
- [CVE-2018-15685](https://insights.sbomify.com/CVE-2018-15685/): Electron webPreferences vulnerability can be used to perform remote code execution (high 8.1)
- [CVE-2018-15684](https://insights.sbomify.com/CVE-2018-15684/): Information disclosure in btiteam:xbtit (medium 5.3)
- [CVE-2018-15683](https://insights.sbomify.com/CVE-2018-15683/): Open redirect in btiteam:xbtit (medium 6.1)
- [CVE-2018-15682](https://insights.sbomify.com/CVE-2018-15682/): Cross-site request forgery in btiteam:xbtit (high 8.8)
- [CVE-2018-15681](https://insights.sbomify.com/CVE-2018-15681/): Weak cryptography in btiteam:xbtit (critical 9.8)
- [CVE-2018-15680](https://insights.sbomify.com/CVE-2018-15680/): Weak cryptography in btiteam:xbtit (critical 9.8)
- [CVE-2018-1568](https://insights.sbomify.com/CVE-2018-1568/): Information disclosure in QRadar SIEM (medium 4.0)
- [CVE-2018-15679](https://insights.sbomify.com/CVE-2018-15679/): Cross-site scripting in btiteam:xbtit (medium 6.1)
- [CVE-2018-15678](https://insights.sbomify.com/CVE-2018-15678/): Cross-site scripting in btiteam:xbtit (medium 6.1)
- [CVE-2018-15677](https://insights.sbomify.com/CVE-2018-15677/): Cross-site scripting in btiteam:xbtit (medium 6.1)
- [CVE-2018-15676](https://insights.sbomify.com/CVE-2018-15676/): Cross-site scripting in btiteam:xbtit (medium 5.3)
- [CVE-2018-15671](https://insights.sbomify.com/CVE-2018-15671/): Denial of service in hdfgroup:hdf5 (medium 6.5)
- [CVE-2018-15670](https://insights.sbomify.com/CVE-2018-15670/): Security feature bypass in bloop:airmail (medium 4.3)
- [CVE-2018-1567](https://insights.sbomify.com/CVE-2018-1567/): Deserialization in WebSphere Application Server (critical 9.8)
- [CVE-2018-15669](https://insights.sbomify.com/CVE-2018-15669/): Security feature bypass in bloop:airmail 3 (medium 5.3)
- [CVE-2018-15668](https://insights.sbomify.com/CVE-2018-15668/): Information disclosure in bloop:airmail 3 (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/103/