# Vulnerabilities published in 2018


- [CVE-2018-3902](https://insights.sbomify.com/CVE-2018-3902/): Memory corruption in SmartThings Hub STH-ETH-250 (critical 9.9)
- [CVE-2018-3900](https://insights.sbomify.com/CVE-2018-3900/): Memory corruption in Yi Technology (critical 9.1)
- [CVE-2018-3899](https://insights.sbomify.com/CVE-2018-3899/): Memory corruption in Yi Technology (high 8.3)
- [CVE-2018-3898](https://insights.sbomify.com/CVE-2018-3898/): Memory corruption in Yi Technology (high 8.3)
- [CVE-2018-3897](https://insights.sbomify.com/CVE-2018-3897/): Memory corruption in SmartThings Hub STH-ETH-250 (critical 9.9)
- [CVE-2018-3896](https://insights.sbomify.com/CVE-2018-3896/): Memory corruption in SmartThings Hub STH-ETH-250 (critical 9.9)
- [CVE-2018-3895](https://insights.sbomify.com/CVE-2018-3895/): Memory corruption in Samsung (critical 9.9)
- [CVE-2018-3894](https://insights.sbomify.com/CVE-2018-3894/): Memory corruption in SmartThings Hub STH-ETH-250 (critical 9.9)
- [CVE-2018-3893](https://insights.sbomify.com/CVE-2018-3893/): Memory corruption in samsung:sth-eth-250 firmware (critical 9.9)
- [CVE-2018-3892](https://insights.sbomify.com/CVE-2018-3892/): Memory corruption in Yi Technology (critical 9.6)
- [CVE-2018-3891](https://insights.sbomify.com/CVE-2018-3891/): Security feature bypass in Yi Technology (medium 5.7)
- [CVE-2018-3890](https://insights.sbomify.com/CVE-2018-3890/): Command injection in Yi Technology (high 7.6)
- [CVE-2018-3889](https://insights.sbomify.com/CVE-2018-3889/): Memory corruption in Computerinsel Photoline (high 8.8)
- [CVE-2018-3888](https://insights.sbomify.com/CVE-2018-3888/): Memory corruption in Computerinsel Photoline (high 8.8)
- [CVE-2018-3887](https://insights.sbomify.com/CVE-2018-3887/): Memory corruption in Computerinsel Photoline (high 8.8)
- [CVE-2018-3886](https://insights.sbomify.com/CVE-2018-3886/): Memory corruption in Computerinsel Photoline (high 8.8)
- [CVE-2018-3885](https://insights.sbomify.com/CVE-2018-3885/): SQL injection in ERPNext (medium 5.4)
- [CVE-2018-3884](https://insights.sbomify.com/CVE-2018-3884/): SQL injection in ERPNext (medium 5.4)
- [CVE-2018-3883](https://insights.sbomify.com/CVE-2018-3883/): SQL injection in ERPNext (medium 5.4)
- [CVE-2018-3882](https://insights.sbomify.com/CVE-2018-3882/): SQL injection in frappe:erpnext (medium 5.4)
- [CVE-2018-3881](https://insights.sbomify.com/CVE-2018-3881/): XML external entity in Focalscope (critical 9.4)
- [CVE-2018-3880](https://insights.sbomify.com/CVE-2018-3880/): Memory corruption in Samsung (high 8.2)
- [CVE-2018-3879](https://insights.sbomify.com/CVE-2018-3879/): SQL injection in SmartThings Hub STH-ETH-250 (high 8.8)
- [CVE-2018-3878](https://insights.sbomify.com/CVE-2018-3878/): Memory corruption in SmartThings Hub STH-ETH-250 (critical 9.9)
- [CVE-2018-3877](https://insights.sbomify.com/CVE-2018-3877/): Memory corruption in SmartThings Hub STH-ETH-250 (critical 9.9)
- [CVE-2018-3876](https://insights.sbomify.com/CVE-2018-3876/): Memory corruption in SmartThings Hub STH-ETH-250 (critical 9.9)
- [CVE-2018-3875](https://insights.sbomify.com/CVE-2018-3875/): Memory corruption in SmartThings Hub STH-ETH-250 (critical 9.9)
- [CVE-2018-3874](https://insights.sbomify.com/CVE-2018-3874/): Memory corruption in SmartThings Hub STH-ETH-250 (critical 9.9)
- [CVE-2018-3873](https://insights.sbomify.com/CVE-2018-3873/): Memory corruption in SmartThings Hub STH-ETH-250 (critical 9.9)
- [CVE-2018-3872](https://insights.sbomify.com/CVE-2018-3872/): Memory corruption in Samsung (critical 9.9)
- [CVE-2018-3871](https://insights.sbomify.com/CVE-2018-3871/): Memory corruption in Canvas Draw (high 8.8)
- [CVE-2018-3870](https://insights.sbomify.com/CVE-2018-3870/): Memory corruption in Canvas Draw (high 8.8)
- [CVE-2018-3868](https://insights.sbomify.com/CVE-2018-3868/): Memory corruption in Computerinsel Photoline (high 8.8)
- [CVE-2018-3867](https://insights.sbomify.com/CVE-2018-3867/): Memory corruption in SmartThings Hub STH-ETH-250 (critical 9.9)
- [CVE-2018-3866](https://insights.sbomify.com/CVE-2018-3866/): Memory corruption in Samsung (critical 9.9)
- [CVE-2018-3865](https://insights.sbomify.com/CVE-2018-3865/): Memory corruption in SmartThings Hub STH-ETH-250 (critical 9.9)
- [CVE-2018-3864](https://insights.sbomify.com/CVE-2018-3864/): Memory corruption in SmartThings Hub STH-ETH-250 (critical 9.9)
- [CVE-2018-3863](https://insights.sbomify.com/CVE-2018-3863/): Memory corruption in SmartThings Hub STH-ETH-250 (critical 9.9)
- [CVE-2018-3862](https://insights.sbomify.com/CVE-2018-3862/): Memory corruption in Computerinsel Photoline (high 8.8)
- [CVE-2018-3861](https://insights.sbomify.com/CVE-2018-3861/): Memory corruption in Computerinsel Photoline (high 8.8)
- [CVE-2018-3860](https://insights.sbomify.com/CVE-2018-3860/): Memory corruption in Canvas Draw (high 8.8)
- [CVE-2018-3859](https://insights.sbomify.com/CVE-2018-3859/): Memory corruption in Canvas Draw (high 8.8)
- [CVE-2018-3858](https://insights.sbomify.com/CVE-2018-3858/): Memory corruption in Canvas Draw (high 8.8)
- [CVE-2018-3857](https://insights.sbomify.com/CVE-2018-3857/): Memory corruption in Canvas Draw (high 8.8)
- [CVE-2018-3856](https://insights.sbomify.com/CVE-2018-3856/): Command injection in Samsung (critical 9.9)
- [CVE-2018-3855](https://insights.sbomify.com/CVE-2018-3855/): Memory corruption in Perceptive Document Filters (high 8.8)
- [CVE-2018-3854](https://insights.sbomify.com/CVE-2018-3854/): Security feature bypass in intuit:quicken 2018 (high 7.1)
- [CVE-2018-3853](https://insights.sbomify.com/CVE-2018-3853/): Use after free in Foxit (high 8.8)
- [CVE-2018-3852](https://insights.sbomify.com/CVE-2018-3852/): Denial of service in Ocularis (high 7.5)
- [CVE-2018-3851](https://insights.sbomify.com/CVE-2018-3851/): Memory corruption in Perceptive Document Filters (high 8.8)
- [CVE-2018-3850](https://insights.sbomify.com/CVE-2018-3850/): Use after free in Foxit (high 8.8)
- [CVE-2018-3849](https://insights.sbomify.com/CVE-2018-3849/): Memory corruption in NASA CFITSIO (high 8.8)
- [CVE-2018-3848](https://insights.sbomify.com/CVE-2018-3848/): Memory corruption in NASA CFITSIO (high 8.8)
- [CVE-2018-3847](https://insights.sbomify.com/CVE-2018-3847/): Memory corruption in CFITSIO (high 8.8)
- [CVE-2018-3846](https://insights.sbomify.com/CVE-2018-3846/): Memory corruption in NASA CFITSIO (high 8.8)
- [CVE-2018-3845](https://insights.sbomify.com/CVE-2018-3845/): Memory corruption in Perceptive Document Filters (high 8.8)
- [CVE-2018-3844](https://insights.sbomify.com/CVE-2018-3844/): Use after free in Perceptive Document Filters (high 8.8)
- [CVE-2018-3843](https://insights.sbomify.com/CVE-2018-3843/): Memory corruption in Foxit (medium 6.5)
- [CVE-2018-3842](https://insights.sbomify.com/CVE-2018-3842/): Memory corruption in Foxit (high 8.8)
- [CVE-2018-3841](https://insights.sbomify.com/CVE-2018-3841/): Null dereference in Pixar Renderman (medium 5.3)
- [CVE-2018-3840](https://insights.sbomify.com/CVE-2018-3840/): Null dereference in Pixar Renderman (medium 5.3)
- [CVE-2018-3839](https://insights.sbomify.com/CVE-2018-3839/): Memory corruption in Simple DirectMedia (high 7.5)
- [CVE-2018-3838](https://insights.sbomify.com/CVE-2018-3838/): Memory corruption in Simple DirectMedia (medium 5.3)
- [CVE-2018-3837](https://insights.sbomify.com/CVE-2018-3837/): Memory corruption in Simple Direct Media (medium 5.3)
- [CVE-2018-3836](https://insights.sbomify.com/CVE-2018-3836/): Command injection in Leptonica (high 7.0)
- [CVE-2018-3835](https://insights.sbomify.com/CVE-2018-3835/): Memory corruption in Walt Disney Animation Studios PTEX (high 8.8)
- [CVE-2018-3834](https://insights.sbomify.com/CVE-2018-3834/): Security feature bypass in Insteon (high 8.7)
- [CVE-2018-3833](https://insights.sbomify.com/CVE-2018-3833/): Security feature bypass in Insteon (high 8.6)
- [CVE-2018-3832](https://insights.sbomify.com/CVE-2018-3832/): File upload in Insteon (critical 9.9)
- [CVE-2018-3831](https://insights.sbomify.com/CVE-2018-3831/): Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch (high 8.8)
- [CVE-2018-3830](https://insights.sbomify.com/CVE-2018-3830/): Cross-site scripting in Kibana (medium 6.1)
- [CVE-2018-3829](https://insights.sbomify.com/CVE-2018-3829/): Auth bypass in Elastic Cloud Enterprise (medium 5.3)
- [CVE-2018-3828](https://insights.sbomify.com/CVE-2018-3828/): Information disclosure in Elastic Cloud Enterprise (high 7.5)
- [CVE-2018-3827](https://insights.sbomify.com/CVE-2018-3827/): Information disclosure in Elasticsearch (high 8.1)
- [CVE-2018-3826](https://insights.sbomify.com/CVE-2018-3826/): Information disclosure in Elasticsearch (medium 6.5)
- [CVE-2018-3825](https://insights.sbomify.com/CVE-2018-3825/): Hardcoded credentials in Elastic Cloud Enterprise (ECE) (medium 5.9)
- [CVE-2018-3824](https://insights.sbomify.com/CVE-2018-3824/): Elasticsearch subject to cross site scripting (medium 6.1)
- [CVE-2018-3823](https://insights.sbomify.com/CVE-2018-3823/): Cross-site scripting in Elasticsearch X-Pack Machine Learning (medium 5.4)
- [CVE-2018-3822](https://insights.sbomify.com/CVE-2018-3822/): Auth bypass in X-Pack Security (critical 9.8)
- [CVE-2018-3821](https://insights.sbomify.com/CVE-2018-3821/): Cross-site scripting in Kibana (medium 6.1)
- [CVE-2018-3820](https://insights.sbomify.com/CVE-2018-3820/): Cross-site scripting in Kibana (medium 6.1)
- [CVE-2018-3819](https://insights.sbomify.com/CVE-2018-3819/): Open redirect in Kibana (medium 6.1)
- [CVE-2018-3818](https://insights.sbomify.com/CVE-2018-3818/): Cross-site scripting in Kibana (medium 6.1)
- [CVE-2018-3817](https://insights.sbomify.com/CVE-2018-3817/): Information disclosure in Logstash (medium 6.5)
- [CVE-2018-3815](https://insights.sbomify.com/CVE-2018-3815/): Auth bypass in stalker:communigate pro (medium 5.7)
- [CVE-2018-3814](https://insights.sbomify.com/CVE-2018-3814/): Craft CMS PHP Code Injection Vulnerability (high 8.8)
- [CVE-2018-3813](https://insights.sbomify.com/CVE-2018-3813/): Missing authorization in flir:brickstream 2300 2d firmware (critical 9.8)
- [CVE-2018-3811](https://insights.sbomify.com/CVE-2018-3811/): SQL injection in oturia:smart google code inserter (critical 9.8)
- [CVE-2018-3810](https://insights.sbomify.com/CVE-2018-3810/): Auth bypass in oturia:smart google code inserter (critical 9.8)
- [CVE-2018-3809](https://insights.sbomify.com/CVE-2018-3809/): Information Exposure on Case Insensitive File Systems in serve (medium 5.3)
- [CVE-2018-3787](https://insights.sbomify.com/CVE-2018-3787/): simplehttpserver allows directory traversal and file listing (high 7.5)
- [CVE-2018-3786](https://insights.sbomify.com/CVE-2018-3786/): Command Injection in egg-scripts (critical 9.8)
- [CVE-2018-3785](https://insights.sbomify.com/CVE-2018-3785/): Command Injection in git-dummy-commit (critical 9.8)
- [CVE-2018-3784](https://insights.sbomify.com/CVE-2018-3784/): Code Injection in cryo (critical 9.8)
- [CVE-2018-3783](https://insights.sbomify.com/CVE-2018-3783/): Privilege Escalation due to Blind NoSQL Injection in flintcms (critical 9.8)
- [CVE-2018-3781](https://insights.sbomify.com/CVE-2018-3781/): Cross-site scripting in nextcloud/talk (medium 5.4)
- [CVE-2018-3780](https://insights.sbomify.com/CVE-2018-3780/): Cross-site scripting in nextcloud/server (medium 5.4)
- [CVE-2018-3779](https://insights.sbomify.com/CVE-2018-3779/): active-support impersonates 'activesupport' gem (critical 9.8)
- [CVE-2018-3778](https://insights.sbomify.com/CVE-2018-3778/): Improper Authorization in aedes (medium 5.3)
- [CVE-2018-3777](https://insights.sbomify.com/CVE-2018-3777/): restforce vulnerable to Improper Input Validation (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/44/