# Vulnerabilities published in 2018


- [CVE-2018-11846](https://insights.sbomify.com/CVE-2018-11846/): Information disclosure in Snapdragon Mobile (medium 4.7)
- [CVE-2018-11845](https://insights.sbomify.com/CVE-2018-11845/): Information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music (medium 5.5)
- [CVE-2018-11843](https://insights.sbomify.com/CVE-2018-11843/): Use after free in Android for MSM, Firefox OS for MSM, QRD Android (high 7.8)
- [CVE-2018-11842](https://insights.sbomify.com/CVE-2018-11842/): Memory corruption in Android for MSM, Firefox OS for MSM, QRD Android (high 7.8)
- [CVE-2018-11840](https://insights.sbomify.com/CVE-2018-11840/): Memory corruption in Android for MSM, Firefox OS for MSM, QRD Android (high 7.8)
- [CVE-2018-1184](https://insights.sbomify.com/CVE-2018-1184/): Command injection in EMC RecoverPoint for Virtual Machines versions prior to 5.1.1, EMC RecoverPoint version 5.1.0.0, EMC RecoverPoint versions prior to 5.0.1.3 (medium 6.7)
- [CVE-2018-11838](https://insights.sbomify.com/CVE-2018-11838/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music (high 7.8)
- [CVE-2018-11836](https://insights.sbomify.com/CVE-2018-11836/): Memory corruption in Android for MSM, Firefox OS for MSM, QRD Android (high 7.8)
- [CVE-2018-11832](https://insights.sbomify.com/CVE-2018-11832/): Memory corruption in Android for MSM, Firefox OS for MSM, QRD Android (high 7.8)
- [CVE-2018-11830](https://insights.sbomify.com/CVE-2018-11830/): Integer overflow in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile (high 7.8)
- [CVE-2018-1183](https://insights.sbomify.com/CVE-2018-1183/): XML external entity in Dell EMC Unisphere for VMAX Virtual Appliance, Dell EMC Solutions Enabler Virtual Appliance, Dell EMC VASA Provider Virtual Appliance, Dell EMC SMIS, Dell EMC VMAX Embedded Management (eManagement), Dell EMC VNX2 Operating Environment (OE) for File, Dell EMC VNX2 Operating Environment (OE) for Block, Dell EMC VNX1 Operating Environment (OE) for File, Dell EMC VNX1 Operating Environment (OE) for Block, Dell EMC VNXe3200 Operating Environment (OE), Dell EMC VNXe1600 Operating Environment (OE), Dell EMC VNXe 3100/3150/3300 Operating Environment (OE), Dell EMC ViPR SRM, Dell EMC ViPR SRM, Dell EMC XtremIO, Dell EMC VMAX eNAS, Dell EMC Unity Operating Environment (OE) (critical 9.8)
- [CVE-2018-11828](https://insights.sbomify.com/CVE-2018-11828/): Denial of service in Snapdragon Mobile (high 7.5)
- [CVE-2018-11827](https://insights.sbomify.com/CVE-2018-11827/): Memory corruption in Android for MSM, Firefox OS for MSM, QRD Android (high 7.8)
- [CVE-2018-11826](https://insights.sbomify.com/CVE-2018-11826/): Integer overflow in Android for MSM, Firefox OS for MSM, QRD Android (high 7.8)
- [CVE-2018-11824](https://insights.sbomify.com/CVE-2018-11824/): Memory corruption in Snapdragon Mobile, Snapdragon Wear (high 7.8)
- [CVE-2018-11823](https://insights.sbomify.com/CVE-2018-11823/): Memory corruption in google:android (high 7.8)
- [CVE-2018-11822](https://insights.sbomify.com/CVE-2018-11822/): Integer overflow in Snapdragon Mobile (high 7.8)
- [CVE-2018-11821](https://insights.sbomify.com/CVE-2018-11821/): Integer overflow in Snapdragon Mobile, Snapdragon Wear (high 7.8)
- [CVE-2018-11820](https://insights.sbomify.com/CVE-2018-11820/): Weak cryptography in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking (medium 5.5)
- [CVE-2018-1182](https://insights.sbomify.com/CVE-2018-1182/): Privilege escalation in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and software bundle deployments only); RSA Via Lifecycle and Governance version 7.0, all patch levels (hardware appliance and software bundle deployments only); RSA Identity Management & Governance (RSA IMG) versions 6.9.0, 6.9.1, all patch levels (hardware appliance and software bundle deployments only) (high 7.8)
- [CVE-2018-11819](https://insights.sbomify.com/CVE-2018-11819/): Use after free in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile (high 7.8)
- [CVE-2018-11818](https://insights.sbomify.com/CVE-2018-11818/): Race condition in Android for MSM, Firefox OS for MSM, QRD Android (high 7.0)
- [CVE-2018-11816](https://insights.sbomify.com/CVE-2018-11816/): Use After Free in Video (high 7.8)
- [CVE-2018-11813](https://insights.sbomify.com/CVE-2018-11813/): Denial of service in ijg:libjpeg (high 7.5)
- [CVE-2018-11808](https://insights.sbomify.com/CVE-2018-11808/): Missing authorization in zohocorp:manageengine applications manager (critical 9.1)
- [CVE-2018-11806](https://insights.sbomify.com/CVE-2018-11806/): Memory corruption in canonical:ubuntu linux (high 8.2)
- [CVE-2018-11805](https://insights.sbomify.com/CVE-2018-11805/): Command injection in Apache SpamAssassin (medium 6.7)
- [CVE-2018-11804](https://insights.sbomify.com/CVE-2018-11804/): Improper Input Validation in Apache Spark (high 7.5)
- [CVE-2018-11803](https://insights.sbomify.com/CVE-2018-11803/): Null dereference in Apache Subversion (high 7.5)
- [CVE-2018-11802](https://insights.sbomify.com/CVE-2018-11802/): Incorrect Authorization in Apache Solr (medium 4.3)
- [CVE-2018-11801](https://insights.sbomify.com/CVE-2018-11801/): SQL injection in Apache Fineract (critical 9.8)
- [CVE-2018-11800](https://insights.sbomify.com/CVE-2018-11800/): SQL injection in Apache Fineract (critical 9.8)
- [CVE-2018-1180](https://insights.sbomify.com/CVE-2018-1180/): Use after free in Foxit Reader (high 8.8)
- [CVE-2018-11799](https://insights.sbomify.com/CVE-2018-11799/): Moderate severity vulnerability that affects org.apache.oozie:oozie-core (medium 6.5)
- [CVE-2018-11798](https://insights.sbomify.com/CVE-2018-11798/): Apache Thrift Node.js static web server sandbox escape (medium 6.5)
- [CVE-2018-11797](https://insights.sbomify.com/CVE-2018-11797/): In Apache PDFBox a carefully crafted PDF file can trigger an extremely long running computation (medium 5.5)
- [CVE-2018-11796](https://insights.sbomify.com/CVE-2018-11796/): Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack (high 7.5)
- [CVE-2018-11793](https://insights.sbomify.com/CVE-2018-11793/): Stack Overflow in Apache Mesos (high 7.5)
- [CVE-2018-11792](https://insights.sbomify.com/CVE-2018-11792/): Privilege escalation in Apache Impala (critical 9.8)
- [CVE-2018-11790](https://insights.sbomify.com/CVE-2018-11790/): Integer overflow in Apache OpenOffice (high 7.8)
- [CVE-2018-1179](https://insights.sbomify.com/CVE-2018-1179/): Memory corruption in Foxit Reader (medium 6.5)
- [CVE-2018-11789](https://insights.sbomify.com/CVE-2018-11789/): Path traversal in Apache Incubator Heron (high 7.5)
- [CVE-2018-11788](https://insights.sbomify.com/CVE-2018-11788/): XML External Entity Reference in Apache Karaf (critical 9.8)
- [CVE-2018-11787](https://insights.sbomify.com/CVE-2018-11787/): Improper Authentication in Apache Karaf (high 8.1)
- [CVE-2018-11786](https://insights.sbomify.com/CVE-2018-11786/): Improper Privilege Management in Apache Karaf (high 8.8)
- [CVE-2018-11785](https://insights.sbomify.com/CVE-2018-11785/): Missing authorization in Apache Impala (medium 6.5)
- [CVE-2018-11784](https://insights.sbomify.com/CVE-2018-11784/): Apache Tomcat Open Redirect vulnerability (medium 4.3)
- [CVE-2018-11783](https://insights.sbomify.com/CVE-2018-11783/): Information disclosure in Apache Traffic Server (high 7.5)
- [CVE-2018-11782](https://insights.sbomify.com/CVE-2018-11782/): Denial of service in Apache Subversion (medium 6.5)
- [CVE-2018-11781](https://insights.sbomify.com/CVE-2018-11781/): Code injection in Apache SpamAssassin (high 7.8)
- [CVE-2018-11780](https://insights.sbomify.com/CVE-2018-11780/): Code injection in Apache SpamAssassin (critical 9.8)
- [CVE-2018-1178](https://insights.sbomify.com/CVE-2018-1178/): Use after free in Foxit Reader (high 8.8)
- [CVE-2018-11779](https://insights.sbomify.com/CVE-2018-11779/): Deserialization of Untrusted Data in Apache Storm (critical 9.8)
- [CVE-2018-11778](https://insights.sbomify.com/CVE-2018-11778/): UnixAuthenticationService in Apache Ranger was updated to correctly handle user input to avoid Stack-based buffer overflow (high 8.8)
- [CVE-2018-11777](https://insights.sbomify.com/CVE-2018-11777/): Improper Authentication in hive:hive-exec (high 8.1)
- [CVE-2018-11776](https://insights.sbomify.com/CVE-2018-11776/): Apache Struts Remote Code Execution (high 8.1, exploited in the wild)
- [CVE-2018-11775](https://insights.sbomify.com/CVE-2018-11775/): Improper Certificate Validation in Apache activemq-client (high 7.4)
- [CVE-2018-11774](https://insights.sbomify.com/CVE-2018-11774/): SQL injection in VCL (high 7.2)
- [CVE-2018-11773](https://insights.sbomify.com/CVE-2018-11773/): Other in VCL (critical 9.8)
- [CVE-2018-11772](https://insights.sbomify.com/CVE-2018-11772/): SQL injection in VCL (high 7.2)
- [CVE-2018-11771](https://insights.sbomify.com/CVE-2018-11771/): Moderate severity vulnerability that affects org.apache.commons:commons-compress (medium 5.5)
- [CVE-2018-11770](https://insights.sbomify.com/CVE-2018-11770/): org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability (medium 4.2)
- [CVE-2018-1177](https://insights.sbomify.com/CVE-2018-1177/): Use after free in Foxit Reader (high 8.8)
- [CVE-2018-11769](https://insights.sbomify.com/CVE-2018-11769/): Privilege escalation in Apache CouchDB (high 7.2)
- [CVE-2018-11768](https://insights.sbomify.com/CVE-2018-11768/): user/group information can be corrupted across storing in fsimage and reading back from fsimage (high 7.5)
- [CVE-2018-11767](https://insights.sbomify.com/CVE-2018-11767/): Improper Privilege Management in org.apache.hadoop:hadoop-main (high 7.4)
- [CVE-2018-11766](https://insights.sbomify.com/CVE-2018-11766/): Arbitrary Command Execution in Hadoop (high 8.8)
- [CVE-2018-11765](https://insights.sbomify.com/CVE-2018-11765/): Improper Authentication in Apache Hadoop (high 7.5)
- [CVE-2018-11764](https://insights.sbomify.com/CVE-2018-11764/): Authentication bypass in Apache Hadoop (high 8.8)
- [CVE-2018-11763](https://insights.sbomify.com/CVE-2018-11763/): Denial of service in Apache HTTP Server (medium 5.9)
- [CVE-2018-11762](https://insights.sbomify.com/CVE-2018-11762/): Moderate severity vulnerability that affects org.apache.tika:tika-core (medium 5.9)
- [CVE-2018-11761](https://insights.sbomify.com/CVE-2018-11761/): High severity vulnerability that affects org.apache.tika:tika-core (high 7.5)
- [CVE-2018-11760](https://insights.sbomify.com/CVE-2018-11760/): Pyspark User Impersonation Vulnerability (medium 5.5)
- [CVE-2018-1176](https://insights.sbomify.com/CVE-2018-1176/): Memory corruption in Foxit Reader (high 8.8)
- [CVE-2018-11759](https://insights.sbomify.com/CVE-2018-11759/): Path traversal in Apache Tomcat Connectors (high 7.5)
- [CVE-2018-11758](https://insights.sbomify.com/CVE-2018-11758/): XML External Entity Reference in Apache Cayenne (high 8.1)
- [CVE-2018-11757](https://insights.sbomify.com/CVE-2018-11757/): Code injection in Docker Skeleton Runtime for Apache OpenWhisk (critical 9.8)
- [CVE-2018-11756](https://insights.sbomify.com/CVE-2018-11756/): Code injection in PHP Runtime for Apache OpenWhisk (critical 9.8)
- [CVE-2018-11752](https://insights.sbomify.com/CVE-2018-11752/): Information disclosure in puppet:cisco ios (medium 5.5)
- [CVE-2018-11751](https://insights.sbomify.com/CVE-2018-11751/): Security feature bypass in Puppet Agent, Puppet (medium 5.4)
- [CVE-2018-11750](https://insights.sbomify.com/CVE-2018-11750/): Auth bypass in puppet:cisco ios module (medium 6.5)
- [CVE-2018-1175](https://insights.sbomify.com/CVE-2018-1175/): Information disclosure in Foxit Reader (medium 6.5)
- [CVE-2018-11749](https://insights.sbomify.com/CVE-2018-11749/): Information disclosure in Puppet Enterprise (critical 9.8)
- [CVE-2018-11748](https://insights.sbomify.com/CVE-2018-11748/): Information disclosure in puppet:device manager (high 7.8)
- [CVE-2018-11747](https://insights.sbomify.com/CVE-2018-11747/): Hardcoded credentials in Puppet Discovery (critical 9.8)
- [CVE-2018-11746](https://insights.sbomify.com/CVE-2018-11746/): Puppet Discovery can leak authentication information (high 8.6)
- [CVE-2018-11744](https://insights.sbomify.com/CVE-2018-11744/): Missing authorization in cloudera:cloudera manager (high 8.1)
- [CVE-2018-11743](https://insights.sbomify.com/CVE-2018-11743/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2018-11742](https://insights.sbomify.com/CVE-2018-11742/): Information disclosure in nec:univerge sv9100 webpro firmware (critical 9.8)
- [CVE-2018-11741](https://insights.sbomify.com/CVE-2018-11741/): Information disclosure in nec:univerge sv9100 webpro firmware (critical 9.8)
- [CVE-2018-11740](https://insights.sbomify.com/CVE-2018-11740/): Memory corruption in sleuthkit:the sleuth kit (high 8.1)
- [CVE-2018-1174](https://insights.sbomify.com/CVE-2018-1174/): Information disclosure in Foxit Reader (medium 6.5)
- [CVE-2018-11739](https://insights.sbomify.com/CVE-2018-11739/): Memory corruption in sleuthkit:the sleuth kit (high 8.1)
- [CVE-2018-11738](https://insights.sbomify.com/CVE-2018-11738/): Memory corruption in sleuthkit:the sleuth kit (high 8.1)
- [CVE-2018-11737](https://insights.sbomify.com/CVE-2018-11737/): Memory corruption in sleuthkit:the sleuth kit (high 8.1)
- [CVE-2018-11736](https://insights.sbomify.com/CVE-2018-11736/): File upload in pluck-cms:pluck (critical 9.8)
- [CVE-2018-11735](https://insights.sbomify.com/CVE-2018-11735/): Cross-site scripting in ximdex:ximdex (medium 6.1)
- [CVE-2018-11734](https://insights.sbomify.com/CVE-2018-11734/): Cross-site scripting in e107:e107 (medium 6.1)
- [CVE-2018-11731](https://insights.sbomify.com/CVE-2018-11731/): Memory corruption in libfsntfs project:libfsntfs (medium 5.5)
- [CVE-2018-11730](https://insights.sbomify.com/CVE-2018-11730/): Memory corruption in libfsntfs project:libfsntfs (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/134/