# Vulnerabilities published in 2018


- [CVE-2018-1173](https://insights.sbomify.com/CVE-2018-1173/): Use after free in Foxit Reader (high 8.8)
- [CVE-2018-11729](https://insights.sbomify.com/CVE-2018-11729/): Memory corruption in libfsntfs project:libfsntfs (medium 5.5)
- [CVE-2018-11728](https://insights.sbomify.com/CVE-2018-11728/): Memory corruption in libfsntfs project:libfsntfs (medium 5.5)
- [CVE-2018-11727](https://insights.sbomify.com/CVE-2018-11727/): Memory corruption in libfsntfs project:libfsntfs (medium 5.5)
- [CVE-2018-11726](https://insights.sbomify.com/CVE-2018-11726/): Memory corruption in libmobi project:libmobi (high 8.8)
- [CVE-2018-11725](https://insights.sbomify.com/CVE-2018-11725/): Memory corruption in libmobi project:libmobi (medium 6.5)
- [CVE-2018-11724](https://insights.sbomify.com/CVE-2018-11724/): Memory corruption in libmobi project:libmobi (high 8.8)
- [CVE-2018-11723](https://insights.sbomify.com/CVE-2018-11723/): Memory corruption in libpff project:libpff (medium 5.5)
- [CVE-2018-11722](https://insights.sbomify.com/CVE-2018-11722/): SQL injection in wuzhicms:wuzhicms (critical 9.8)
- [CVE-2018-11720](https://insights.sbomify.com/CVE-2018-11720/): Path traversal in xovis:pc2 firmware (high 7.5)
- [CVE-2018-1172](https://insights.sbomify.com/CVE-2018-1172/): Null dereference in The Squid Software Foundation Squid (medium 5.9)
- [CVE-2018-11719](https://insights.sbomify.com/CVE-2018-11719/): XML external entity in xovis:pc2 firmware (medium 4.9)
- [CVE-2018-11718](https://insights.sbomify.com/CVE-2018-11718/): Cross-site request forgery in xovis:pc2 firmware (high 8.8)
- [CVE-2018-11717](https://insights.sbomify.com/CVE-2018-11717/): Information disclosure in zohocorp:manageengine desktop central (critical 9.8)
- [CVE-2018-11716](https://insights.sbomify.com/CVE-2018-11716/): Information disclosure in zohocorp:manageengine desktop central (critical 9.8)
- [CVE-2018-11715](https://insights.sbomify.com/CVE-2018-11715/): Cross-site scripting in recent threads project:recent threads (medium 5.4)
- [CVE-2018-11714](https://insights.sbomify.com/CVE-2018-11714/): Auth bypass in tp-link:tl-wr840n firmware (critical 9.8)
- [CVE-2018-11713](https://insights.sbomify.com/CVE-2018-11713/): Information disclosure in gnome:libsoup (medium 6.5)
- [CVE-2018-11712](https://insights.sbomify.com/CVE-2018-11712/): Security feature bypass in webkitgtk:webkitgtk\+ (high 7.5)
- [CVE-2018-11711](https://insights.sbomify.com/CVE-2018-11711/): Auth bypass in canon:mf210 firmware (critical 9.8)
- [CVE-2018-11710](https://insights.sbomify.com/CVE-2018-11710/): Memory corruption in openmpt:libopenmpt (high 8.8)
- [CVE-2018-1171](https://insights.sbomify.com/CVE-2018-1171/): Memory corruption in Joyent SmartOS (high 7.0)
- [CVE-2018-11709](https://insights.sbomify.com/CVE-2018-11709/): Cross-site scripting in gvectors:wpforo forum (medium 6.1)
- [CVE-2018-11707](https://insights.sbomify.com/CVE-2018-11707/): Memory corruption in faststone:image viewer (high 7.8)
- [CVE-2018-11706](https://insights.sbomify.com/CVE-2018-11706/): Memory corruption in faststone:image viewer (high 7.8)
- [CVE-2018-11705](https://insights.sbomify.com/CVE-2018-11705/): Memory corruption in faststone:image viewer (high 7.8)
- [CVE-2018-11704](https://insights.sbomify.com/CVE-2018-11704/): Memory corruption in faststone:image viewer (high 7.8)
- [CVE-2018-11703](https://insights.sbomify.com/CVE-2018-11703/): Memory corruption in faststone:image viewer (high 7.8)
- [CVE-2018-11702](https://insights.sbomify.com/CVE-2018-11702/): Memory corruption in faststone:image viewer (high 7.8)
- [CVE-2018-11701](https://insights.sbomify.com/CVE-2018-11701/): Memory corruption in faststone:image viewer (high 7.8)
- [CVE-2018-1170](https://insights.sbomify.com/CVE-2018-1170/): Security feature bypass in Volkswagen Customer-Link App (high 8.8)
- [CVE-2018-11698](https://insights.sbomify.com/CVE-2018-11698/): Memory corruption in sass-lang:libsass (high 8.1)
- [CVE-2018-11697](https://insights.sbomify.com/CVE-2018-11697/): Memory corruption in sass-lang:libsass (high 8.1)
- [CVE-2018-11696](https://insights.sbomify.com/CVE-2018-11696/): Null dereference in sass-lang:libsass (high 8.8)
- [CVE-2018-11695](https://insights.sbomify.com/CVE-2018-11695/): Null dereference in sass-lang:libsass (high 8.8)
- [CVE-2018-11694](https://insights.sbomify.com/CVE-2018-11694/): Null dereference in sass-lang:libsass (high 8.8)
- [CVE-2018-11693](https://insights.sbomify.com/CVE-2018-11693/): Memory corruption in sass-lang:libsass (high 8.1)
- [CVE-2018-11692](https://insights.sbomify.com/CVE-2018-11692/): Auth bypass in canon:lbp3370 firmware (critical 9.8)
- [CVE-2018-11691](https://insights.sbomify.com/CVE-2018-11691/): Hardcoded credentials in emerson:ve6046 firmware (critical 9.8)
- [CVE-2018-11690](https://insights.sbomify.com/CVE-2018-11690/): Cross-site scripting in balbooa:gridbox (medium 6.1)
- [CVE-2018-1169](https://insights.sbomify.com/CVE-2018-1169/): Command injection in Amazon Music Player (high 8.8)
- [CVE-2018-11689](https://insights.sbomify.com/CVE-2018-11689/): Cross-site scripting in hanwha-security:hrd-1641 firmware (medium 6.1)
- [CVE-2018-11688](https://insights.sbomify.com/CVE-2018-11688/): Ignite Realtime Openfire vulnerable to cross-site scripting (medium 6.1)
- [CVE-2018-11687](https://insights.sbomify.com/CVE-2018-11687/): Integer overflow in bitcoin red project:bitcoin red (high 7.5)
- [CVE-2018-11686](https://insights.sbomify.com/CVE-2018-11686/): Code injection in flowpaper:flexpaper (critical 9.8)
- [CVE-2018-11685](https://insights.sbomify.com/CVE-2018-11685/): Memory corruption in canonical:ubuntu linux (high 8.8)
- [CVE-2018-11684](https://insights.sbomify.com/CVE-2018-11684/): Memory corruption in canonical:ubuntu linux (high 8.8)
- [CVE-2018-11683](https://insights.sbomify.com/CVE-2018-11683/): Memory corruption in canonical:ubuntu linux (high 8.8)
- [CVE-2018-11682](https://insights.sbomify.com/CVE-2018-11682/): Hardcoded credentials in lutron:homeworks qs firmware (critical 9.8)
- [CVE-2018-11681](https://insights.sbomify.com/CVE-2018-11681/): Hardcoded credentials in lutron:homeworks qs firmware (critical 9.8)
- [CVE-2018-11680](https://insights.sbomify.com/CVE-2018-11680/): Cross-site request forgery in cmseasy:cmseasy (medium 6.5)
- [CVE-2018-1168](https://insights.sbomify.com/CVE-2018-1168/): Misconfiguration in ABB MicroSCADA (high 7.8)
- [CVE-2018-11679](https://insights.sbomify.com/CVE-2018-11679/): Cross-site request forgery in cmseasy:cmseasy (high 8.8)
- [CVE-2018-11678](https://insights.sbomify.com/CVE-2018-11678/): Security feature bypass in monstra:monstra cms (critical 9.8)
- [CVE-2018-11671](https://insights.sbomify.com/CVE-2018-11671/): Cross-site request forgery in njtech:greencms (high 8.8)
- [CVE-2018-11670](https://insights.sbomify.com/CVE-2018-11670/): Cross-site request forgery in njtech:greencms (high 8.8)
- [CVE-2018-1167](https://insights.sbomify.com/CVE-2018-1167/): Command injection in Spotify Music Player (high 8.8)
- [CVE-2018-1166](https://insights.sbomify.com/CVE-2018-1166/): Use after free in Joyent SmartOS (high 7.8)
- [CVE-2018-11657](https://insights.sbomify.com/CVE-2018-11657/): Denial of service in miniupnp project:ngiflib (high 7.5)
- [CVE-2018-11656](https://insights.sbomify.com/CVE-2018-11656/): Denial of service in canonical:ubuntu linux (medium 6.5)
- [CVE-2018-11655](https://insights.sbomify.com/CVE-2018-11655/): Denial of service in canonical:ubuntu linux (medium 6.5)
- [CVE-2018-11654](https://insights.sbomify.com/CVE-2018-11654/): Information disclosure in seasofsolutions:ip camera firmware (high 7.5)
- [CVE-2018-11653](https://insights.sbomify.com/CVE-2018-11653/): Information disclosure in seasofsolutions:ip camera firmware (critical 9.8)
- [CVE-2018-11652](https://insights.sbomify.com/CVE-2018-11652/): Code injection in cirt.net:nikto (critical 9.8)
- [CVE-2018-11651](https://insights.sbomify.com/CVE-2018-11651/): Cross-site Scripting in Graylog (medium 6.1)
- [CVE-2018-11650](https://insights.sbomify.com/CVE-2018-11650/): Cross-site Scripting in Graylog Server (medium 6.1)
- [CVE-2018-1165](https://insights.sbomify.com/CVE-2018-1165/): Memory corruption in Joyent SmartOS (high 7.0)
- [CVE-2018-11649](https://insights.sbomify.com/CVE-2018-11649/): Cross-site scripting in gethue:hue (medium 6.1)
- [CVE-2018-11647](https://insights.sbomify.com/CVE-2018-11647/): oauth2orize-fprm XSS vulnerability (medium 6.1)
- [CVE-2018-11646](https://insights.sbomify.com/CVE-2018-11646/): Null dereference in webkitgtk:webkitgtk\+ (high 7.5)
- [CVE-2018-11645](https://insights.sbomify.com/CVE-2018-11645/): Security feature bypass in artifex:ghostscript (medium 5.3)
- [CVE-2018-11643](https://insights.sbomify.com/CVE-2018-11643/): SQL injection in dialogic:powermedia xms (high 8.8)
- [CVE-2018-11642](https://insights.sbomify.com/CVE-2018-11642/): Misconfiguration in dialogic:powermedia xms (high 7.8)
- [CVE-2018-11641](https://insights.sbomify.com/CVE-2018-11641/): Hardcoded credentials in dialogic:powermedia xms (critical 9.8)
- [CVE-2018-11640](https://insights.sbomify.com/CVE-2018-11640/): XML external entity in dialogic:powermedia xms (critical 9.1)
- [CVE-2018-1164](https://insights.sbomify.com/CVE-2018-1164/): Missing authorization in ZyXEL P-870H-51 DSL Router (critical 9.8)
- [CVE-2018-11639](https://insights.sbomify.com/CVE-2018-11639/): Information disclosure in dialogic:powermedia xms (high 8.1)
- [CVE-2018-11638](https://insights.sbomify.com/CVE-2018-11638/): File upload in dialogic:powermedia xms (high 7.2)
- [CVE-2018-11637](https://insights.sbomify.com/CVE-2018-11637/): Path traversal in dialogic:powermedia xms (high 7.5)
- [CVE-2018-11636](https://insights.sbomify.com/CVE-2018-11636/): Cross-site request forgery in dialogic:powermedia xms (high 8.8)
- [CVE-2018-11635](https://insights.sbomify.com/CVE-2018-11635/): Hardcoded credentials in dialogic:powermedia xms (critical 9.8)
- [CVE-2018-11634](https://insights.sbomify.com/CVE-2018-11634/): Information disclosure in dialogic:powermedia xms (high 7.8)
- [CVE-2018-11633](https://insights.sbomify.com/CVE-2018-11633/): Cross-site request forgery in multidots:woo checkout for digital goods (medium 6.5)
- [CVE-2018-11632](https://insights.sbomify.com/CVE-2018-11632/): Cross-site request forgery in multidots:add social share messenger buttons whatsapp and viber (medium 6.5)
- [CVE-2018-11631](https://insights.sbomify.com/CVE-2018-11631/): Auth bypass in rondaful project:rondaful m1 wristband smart band 1 firmware (medium 4.3)
- [CVE-2018-1163](https://insights.sbomify.com/CVE-2018-1163/): Auth bypass in Quest NetVault Backup (critical 9.8)
- [CVE-2018-11629](https://insights.sbomify.com/CVE-2018-11629/): Hardcoded credentials in lutron:homeworks qs firmware (critical 9.8)
- [CVE-2018-11628](https://insights.sbomify.com/CVE-2018-11628/): Cross-site scripting in emssoftware:ems master calendar (medium 6.1)
- [CVE-2018-11627](https://insights.sbomify.com/CVE-2018-11627/): Sinatra Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2018-11626](https://insights.sbomify.com/CVE-2018-11626/): Memory corruption in simple lossless audio project:simple lossless audio (high 7.5)
- [CVE-2018-11625](https://insights.sbomify.com/CVE-2018-11625/): Memory corruption in canonical:ubuntu linux (high 8.8)
- [CVE-2018-11624](https://insights.sbomify.com/CVE-2018-11624/): Use after free in imagemagick:imagemagick (high 8.8)
- [CVE-2018-11623](https://insights.sbomify.com/CVE-2018-11623/): Memory corruption in Foxit Reader (high 8.8)
- [CVE-2018-11622](https://insights.sbomify.com/CVE-2018-11622/): Memory corruption in Foxit Reader (high 8.8)
- [CVE-2018-11621](https://insights.sbomify.com/CVE-2018-11621/): Memory corruption in Foxit Reader (medium 6.5)
- [CVE-2018-11620](https://insights.sbomify.com/CVE-2018-11620/): Memory corruption in Foxit Reader (medium 6.5)
- [CVE-2018-1162](https://insights.sbomify.com/CVE-2018-1162/): Path traversal in Quest NetVault Backup (high 8.1)
- [CVE-2018-11619](https://insights.sbomify.com/CVE-2018-11619/): Use after free in Foxit Reader (high 8.8)
- [CVE-2018-11618](https://insights.sbomify.com/CVE-2018-11618/): Use after free in Foxit Reader (high 8.8)
- [CVE-2018-11617](https://insights.sbomify.com/CVE-2018-11617/): Use after free in Foxit Reader (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/135/