# Vulnerabilities published in 2018


- [CVE-2018-14668](https://insights.sbomify.com/CVE-2018-14668/): Cross-site request forgery in ClickHouse (high 8.8)
- [CVE-2018-14667](https://insights.sbomify.com/CVE-2018-14667/): Red Hat JBoss RichFaces Framework Expression Language Injection (critical 9.8, exploited in the wild)
- [CVE-2018-14666](https://insights.sbomify.com/CVE-2018-14666/): Missing authorization in Satellite (medium 6.8)
- [CVE-2018-14665](https://insights.sbomify.com/CVE-2018-14665/): Privilege escalation in canonical:ubuntu linux (medium 6.6)
- [CVE-2018-14664](https://insights.sbomify.com/CVE-2018-14664/): Cross-site scripting in foreman (medium 5.4)
- [CVE-2018-14663](https://insights.sbomify.com/CVE-2018-14663/): Security feature bypass in dnsdist (medium 5.9)
- [CVE-2018-14662](https://insights.sbomify.com/CVE-2018-14662/): Missing authorization in ceph (low 3.5)
- [CVE-2018-14661](https://insights.sbomify.com/CVE-2018-14661/): Memory corruption in glusterfs-server (medium 6.5)
- [CVE-2018-14660](https://insights.sbomify.com/CVE-2018-14660/): Denial of service in glusterfs (medium 6.5)
- [CVE-2018-1466](https://insights.sbomify.com/CVE-2018-1466/): Weak cryptography in FlashSystem V9000 (medium 5.3)
- [CVE-2018-14659](https://insights.sbomify.com/CVE-2018-14659/): Denial of service in glusterfs (medium 6.5)
- [CVE-2018-14658](https://insights.sbomify.com/CVE-2018-14658/): Keycloak Open Redirect (medium 6.1)
- [CVE-2018-14657](https://insights.sbomify.com/CVE-2018-14657/): Keycloak Improper Bruteforce Detection (medium 5.4)
- [CVE-2018-14656](https://insights.sbomify.com/CVE-2018-14656/): Information disclosure in kernel (high 7.0)
- [CVE-2018-14655](https://insights.sbomify.com/CVE-2018-14655/): Keycloak vulnerable to cross-site scripting via the state parameter (medium 4.6)
- [CVE-2018-14654](https://insights.sbomify.com/CVE-2018-14654/): Path traversal in glusterfs (medium 5.4)
- [CVE-2018-14653](https://insights.sbomify.com/CVE-2018-14653/): Memory corruption in glusterfs (medium 6.5)
- [CVE-2018-14652](https://insights.sbomify.com/CVE-2018-14652/): Memory corruption in glusterfs (medium 6.5)
- [CVE-2018-14651](https://insights.sbomify.com/CVE-2018-14651/): Path traversal in glusterfs (high 8.8)
- [CVE-2018-14650](https://insights.sbomify.com/CVE-2018-14650/): Misconfiguration in sos-collector (medium 5.9)
- [CVE-2018-1465](https://insights.sbomify.com/CVE-2018-1465/): Information disclosure in FlashSystem V9000 (medium 5.3)
- [CVE-2018-14649](https://insights.sbomify.com/CVE-2018-14649/): Misconfiguration in ceph-iscsi-cli (critical 9.8)
- [CVE-2018-14648](https://insights.sbomify.com/CVE-2018-14648/): Denial of service in 389-ds-base: (high 7.5)
- [CVE-2018-14647](https://insights.sbomify.com/CVE-2018-14647/): Denial of service in Python (medium 5.3)
- [CVE-2018-14646](https://insights.sbomify.com/CVE-2018-14646/): Null dereference in kernel: (medium 5.5)
- [CVE-2018-14645](https://insights.sbomify.com/CVE-2018-14645/): Memory corruption in haproxy (high 7.5)
- [CVE-2018-14644](https://insights.sbomify.com/CVE-2018-14644/): Denial of service in pdns (medium 5.3)
- [CVE-2018-14643](https://insights.sbomify.com/CVE-2018-14643/): smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature (critical 9.8)
- [CVE-2018-14642](https://insights.sbomify.com/CVE-2018-14642/): Exposure of Sensitive Information to an Unauthorized Actor in Undertow (medium 5.3)
- [CVE-2018-14641](https://insights.sbomify.com/CVE-2018-14641/): Denial of service in kernel (medium 6.5)
- [CVE-2018-1464](https://insights.sbomify.com/CVE-2018-1464/): Information disclosure in FlashSystem V9000 (medium 6.5)
- [CVE-2018-14638](https://insights.sbomify.com/CVE-2018-14638/): Denial of service in 389-ds-base (high 7.5)
- [CVE-2018-14637](https://insights.sbomify.com/CVE-2018-14637/): Improper Authentication in Keycloak (medium 6.1)
- [CVE-2018-14636](https://insights.sbomify.com/CVE-2018-14636/): Openstack Neutron vulnerable to eavesdropping on private traffic (medium 5.3)
- [CVE-2018-14635](https://insights.sbomify.com/CVE-2018-14635/): OpensStack Neutron Denial of Service Vulnerability (medium 6.5)
- [CVE-2018-14634](https://insights.sbomify.com/CVE-2018-14634/): Linux Kernel Integer Overflow (high 7.8, exploited in the wild)
- [CVE-2018-14633](https://insights.sbomify.com/CVE-2018-14633/): Memory corruption in kernel (high 7.0)
- [CVE-2018-14632](https://insights.sbomify.com/CVE-2018-14632/): JSON-Patch Out-of-bounds Write vulnerability (high 7.7)
- [CVE-2018-14631](https://insights.sbomify.com/CVE-2018-14631/): Moodle Cross-site Scripting (high 8.8)
- [CVE-2018-14630](https://insights.sbomify.com/CVE-2018-14630/): Moodle XML import of ddwtos could lead to intentional remote code execution (high 8.8)
- [CVE-2018-1463](https://insights.sbomify.com/CVE-2018-1463/): Missing authorization in FlashSystem V9000 (medium 6.5)
- [CVE-2018-14629](https://insights.sbomify.com/CVE-2018-14629/): Denial of service in samba (medium 6.5)
- [CVE-2018-14628](https://insights.sbomify.com/CVE-2018-14628/): Missing authorization in Samba (medium 4.3)
- [CVE-2018-14627](https://insights.sbomify.com/CVE-2018-14627/): Security feature bypass in JBoss/WildFly (medium 5.3)
- [CVE-2018-14626](https://insights.sbomify.com/CVE-2018-14626/): Denial of service in pdns (medium 5.3)
- [CVE-2018-14625](https://insights.sbomify.com/CVE-2018-14625/): Race condition in kernel (medium 5.3)
- [CVE-2018-14624](https://insights.sbomify.com/CVE-2018-14624/): Denial of service in 389-ds-base (high 7.5)
- [CVE-2018-14623](https://insights.sbomify.com/CVE-2018-14623/): katello SQL Injection vulnerability (medium 4.3)
- [CVE-2018-14622](https://insights.sbomify.com/CVE-2018-14622/): Null dereference in libtirpc (medium 5.3)
- [CVE-2018-14621](https://insights.sbomify.com/CVE-2018-14621/): Denial of service in libtirpc (medium 5.3)
- [CVE-2018-14620](https://insights.sbomify.com/CVE-2018-14620/): Supply chain in openstack-rabbitmq-container (medium 4.7)
- [CVE-2018-1462](https://insights.sbomify.com/CVE-2018-1462/): Missing authorization in FlashSystem V9000 (high 7.6)
- [CVE-2018-14619](https://insights.sbomify.com/CVE-2018-14619/): Use after free in kernel (medium 6.2)
- [CVE-2018-14618](https://insights.sbomify.com/CVE-2018-14618/): Integer overflow in curl (high 7.5)
- [CVE-2018-14617](https://insights.sbomify.com/CVE-2018-14617/): Null dereference in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-14616](https://insights.sbomify.com/CVE-2018-14616/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2018-14615](https://insights.sbomify.com/CVE-2018-14615/): Memory corruption in linux:linux kernel (medium 5.5)
- [CVE-2018-14614](https://insights.sbomify.com/CVE-2018-14614/): Memory corruption in linux:linux kernel (medium 5.5)
- [CVE-2018-14613](https://insights.sbomify.com/CVE-2018-14613/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2018-14612](https://insights.sbomify.com/CVE-2018-14612/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2018-14611](https://insights.sbomify.com/CVE-2018-14611/): Use after free in debian:debian linux (medium 5.5)
- [CVE-2018-14610](https://insights.sbomify.com/CVE-2018-14610/): Memory corruption in linux:linux kernel (medium 5.5)
- [CVE-2018-1461](https://insights.sbomify.com/CVE-2018-1461/): Cross-site scripting in FlashSystem V9000 (medium 5.4)
- [CVE-2018-14609](https://insights.sbomify.com/CVE-2018-14609/): Null dereference in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-14608](https://insights.sbomify.com/CVE-2018-14608/): Information disclosure in thomsonreuters:ultratax cs (high 7.5)
- [CVE-2018-14607](https://insights.sbomify.com/CVE-2018-14607/): Information disclosure in thomsonreuters:ultratax cs 2017 (high 7.5)
- [CVE-2018-14606](https://insights.sbomify.com/CVE-2018-14606/): Cross-site scripting in gitlab:gitlab (medium 5.4)
- [CVE-2018-14605](https://insights.sbomify.com/CVE-2018-14605/): Cross-site scripting in gitlab:gitlab (medium 5.4)
- [CVE-2018-14604](https://insights.sbomify.com/CVE-2018-14604/): Cross-site scripting in gitlab:gitlab (medium 6.1)
- [CVE-2018-14603](https://insights.sbomify.com/CVE-2018-14603/): Cross-site request forgery in gitlab:gitlab (high 8.8)
- [CVE-2018-14602](https://insights.sbomify.com/CVE-2018-14602/): Information disclosure in gitlab:gitlab (high 7.5)
- [CVE-2018-14601](https://insights.sbomify.com/CVE-2018-14601/): Denial of service in gitlab:gitlab (high 7.5)
- [CVE-2018-14600](https://insights.sbomify.com/CVE-2018-14600/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2018-1460](https://insights.sbomify.com/CVE-2018-1460/): Privilege escalation in PureData System for Analytics (high 8.4)
- [CVE-2018-14599](https://insights.sbomify.com/CVE-2018-14599/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2018-14598](https://insights.sbomify.com/CVE-2018-14598/): Null dereference in canonical:ubuntu linux (high 7.5)
- [CVE-2018-14597](https://insights.sbomify.com/CVE-2018-14597/): Information disclosure in CA Identity Governance (medium 5.3)
- [CVE-2018-14596](https://insights.sbomify.com/CVE-2018-14596/): Denial of service in wancms:wancms (high 7.5)
- [CVE-2018-14593](https://insights.sbomify.com/CVE-2018-14593/): Privilege escalation in debian:debian linux (high 8.8)
- [CVE-2018-14592](https://insights.sbomify.com/CVE-2018-14592/): SQL injection in cwjoomla:cw article attachments free (critical 9.8)
- [CVE-2018-14590](https://insights.sbomify.com/CVE-2018-14590/): Memory corruption in axiosys:bento4 (high 7.5)
- [CVE-2018-1459](https://insights.sbomify.com/CVE-2018-1459/): Memory corruption in DB2 for Linux, UNIX and Windows (high 7.8)
- [CVE-2018-14589](https://insights.sbomify.com/CVE-2018-14589/): Memory corruption in axiosys:bento4 (high 8.8)
- [CVE-2018-14588](https://insights.sbomify.com/CVE-2018-14588/): Null dereference in axiosys:bento4 (high 7.5)
- [CVE-2018-14587](https://insights.sbomify.com/CVE-2018-14587/): Memory corruption in axiosys:bento4 (high 8.8)
- [CVE-2018-14586](https://insights.sbomify.com/CVE-2018-14586/): Memory corruption in axiosys:bento4 (high 8.8)
- [CVE-2018-14585](https://insights.sbomify.com/CVE-2018-14585/): Memory corruption in axiosys:bento4 (high 8.8)
- [CVE-2018-14584](https://insights.sbomify.com/CVE-2018-14584/): Memory corruption in axiosys:bento4 (high 8.8)
- [CVE-2018-14583](https://insights.sbomify.com/CVE-2018-14583/): Cross-site request forgery in xyhcms:xyhcms (high 8.8)
- [CVE-2018-14582](https://insights.sbomify.com/CVE-2018-14582/): Cross-site request forgery in bagesoft:bagecms (high 8.8)
- [CVE-2018-14581](https://insights.sbomify.com/CVE-2018-14581/): Code injection in red-gate:.net reflector (high 7.8)
- [CVE-2018-1458](https://insights.sbomify.com/CVE-2018-1458/): Privilege escalation in DB2 for Linux, UNIX and Windows (high 7.4)
- [CVE-2018-14579](https://insights.sbomify.com/CVE-2018-14579/): Code injection in golemcms project:golemcms (critical 9.8)
- [CVE-2018-14576](https://insights.sbomify.com/CVE-2018-14576/): Integer overflow in suncontract:suncontract (high 7.5)
- [CVE-2018-14575](https://insights.sbomify.com/CVE-2018-14575/): Cross-site scripting in mybb:trash bin (high 8.8)
- [CVE-2018-14574](https://insights.sbomify.com/CVE-2018-14574/): Django open redirect (medium 6.1)
- [CVE-2018-14573](https://insights.sbomify.com/CVE-2018-14573/): Path traversal in trms:tightrope media carousel digital signage (medium 5.5)
- [CVE-2018-14572](https://insights.sbomify.com/CVE-2018-14572/): conference-scheduler-cli Arbitrary Code Execution (high 7.8)
- [CVE-2018-14570](https://insights.sbomify.com/CVE-2018-14570/): File upload in niushop:b2b2c multi-business (high 8.8)
- [CVE-2018-1457](https://insights.sbomify.com/CVE-2018-1457/): Privilege escalation in Rational DOORS (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/111/