# Vulnerabilities published in 2018


- [CVE-2018-2419](https://insights.sbomify.com/CVE-2018-2419/): Missing authorization in SAP Enterprise Financial Services (EA-FINSERV) (low 3.7)
- [CVE-2018-2418](https://insights.sbomify.com/CVE-2018-2418/): Code injection in SAP MaxDB ODBC driver (medium 5.5)
- [CVE-2018-2417](https://insights.sbomify.com/CVE-2018-2417/): Information disclosure in SAP Identity Management (medium 5.3)
- [CVE-2018-2416](https://insights.sbomify.com/CVE-2018-2416/): XML external entity in SAP Identity Management (medium 5.4)
- [CVE-2018-2415](https://insights.sbomify.com/CVE-2018-2415/): Other in SAP NetWeaver Application Server (Engine API) (medium 4.7)
- [CVE-2018-2413](https://insights.sbomify.com/CVE-2018-2413/): Missing authorization in SAP Disclosure Management (medium 5.4)
- [CVE-2018-2412](https://insights.sbomify.com/CVE-2018-2412/): Missing authorization in SAP Disclosure Management (low 3.8)
- [CVE-2018-2410](https://insights.sbomify.com/CVE-2018-2410/): Cross-site scripting in SAP Business One (medium 5.4)
- [CVE-2018-2409](https://insights.sbomify.com/CVE-2018-2409/): Auth bypass in SAP Cloud Platform Connector (medium 6.3)
- [CVE-2018-2408](https://insights.sbomify.com/CVE-2018-2408/): Auth bypass in SAP Business Objects (high 7.3)
- [CVE-2018-2406](https://insights.sbomify.com/CVE-2018-2406/): Privilege escalation in SAP Crystal Reports Server, OEM Edition (medium 5.3)
- [CVE-2018-2405](https://insights.sbomify.com/CVE-2018-2405/): Cross-site scripting in SAP Solution Manager (medium 5.4)
- [CVE-2018-2404](https://insights.sbomify.com/CVE-2018-2404/): File upload in SAP Disclosure Management (medium 4.3)
- [CVE-2018-2403](https://insights.sbomify.com/CVE-2018-2403/): Missing authorization in SAP Disclosure Management (medium 5.4)
- [CVE-2018-2402](https://insights.sbomify.com/CVE-2018-2402/): Information disclosure in SAP HANA (high 7.6)
- [CVE-2018-2401](https://insights.sbomify.com/CVE-2018-2401/): XML external entity in SAP Business Process Automation (BPA) By Redwood (medium 5.4)
- [CVE-2018-2400](https://insights.sbomify.com/CVE-2018-2400/): Information disclosure in redwood:sap business process automation (high 7.5)
- [CVE-2018-2399](https://insights.sbomify.com/CVE-2018-2399/): Cross-site scripting in SAP Process Monitoring Infrastructure (medium 6.1)
- [CVE-2018-2398](https://insights.sbomify.com/CVE-2018-2398/): Information disclosure in SAP Business Client (medium 6.7)
- [CVE-2018-2397](https://insights.sbomify.com/CVE-2018-2397/): Cross-site scripting in SAP Business Objects Business Intelligence Platform (medium 5.4)
- [CVE-2018-2396](https://insights.sbomify.com/CVE-2018-2396/): Denial of service in SAP Internet Graphics Server (medium 6.5)
- [CVE-2018-2395](https://insights.sbomify.com/CVE-2018-2395/): Other in SAP Internet Graphics Server (high 8.8)
- [CVE-2018-2394](https://insights.sbomify.com/CVE-2018-2394/): Denial of service in SAP Internet Graphics Server (medium 6.5)
- [CVE-2018-2393](https://insights.sbomify.com/CVE-2018-2393/): XML external entity in SAP Internet Graphics Server (high 7.5)
- [CVE-2018-2392](https://insights.sbomify.com/CVE-2018-2392/): XML external entity in SAP Internet Graphics Server (high 7.5)
- [CVE-2018-2391](https://insights.sbomify.com/CVE-2018-2391/): Denial of service in sap:internet graphics server (medium 6.5)
- [CVE-2018-2390](https://insights.sbomify.com/CVE-2018-2390/): Denial of service in sap:internet graphics server (medium 6.5)
- [CVE-2018-2389](https://insights.sbomify.com/CVE-2018-2389/): Other in SAP Internet Graphics Server (medium 5.7)
- [CVE-2018-2388](https://insights.sbomify.com/CVE-2018-2388/): Cross-site scripting in SAP Internet Graphics Server (medium 6.1)
- [CVE-2018-2387](https://insights.sbomify.com/CVE-2018-2387/): Information disclosure in SAP Internet Graphics Server (medium 6.5)
- [CVE-2018-2386](https://insights.sbomify.com/CVE-2018-2386/): Memory corruption in SAP Internet Graphics Server (medium 6.5)
- [CVE-2018-2385](https://insights.sbomify.com/CVE-2018-2385/): Denial of service in SAP Internet Graphics Server (medium 6.5)
- [CVE-2018-2384](https://insights.sbomify.com/CVE-2018-2384/): Null dereference in SAP Internet Graphics Server (medium 6.5)
- [CVE-2018-2383](https://insights.sbomify.com/CVE-2018-2383/): Cross-site scripting in SAP Internet Graphics Server (medium 6.1)
- [CVE-2018-2382](https://insights.sbomify.com/CVE-2018-2382/): Information disclosure in SAP Internet Graphics Server (medium 6.5)
- [CVE-2018-2381](https://insights.sbomify.com/CVE-2018-2381/): Missing authorization in SAP ERP Financials Information System (high 8.8)
- [CVE-2018-2380](https://insights.sbomify.com/CVE-2018-2380/): SAP Customer Relationship Management (CRM) Path Traversal (medium 6.6, exploited in the wild)
- [CVE-2018-2379](https://insights.sbomify.com/CVE-2018-2379/): Information disclosure in SAP HANA Extended Application Services (medium 6.5)
- [CVE-2018-2378](https://insights.sbomify.com/CVE-2018-2378/): Missing authorization in SAP HANA Extended Application Services (medium 6.5)
- [CVE-2018-2377](https://insights.sbomify.com/CVE-2018-2377/): Information disclosure in SAP HANA Extended Application Services (medium 6.5)
- [CVE-2018-2376](https://insights.sbomify.com/CVE-2018-2376/): Missing authorization in SAP HANA Extended Application Services (high 8.1)
- [CVE-2018-2375](https://insights.sbomify.com/CVE-2018-2375/): Missing authorization in SAP HANA Extended Application Services (high 8.1)
- [CVE-2018-2374](https://insights.sbomify.com/CVE-2018-2374/): Missing authorization in SAP HANA Extended Application Services (medium 6.5)
- [CVE-2018-2373](https://insights.sbomify.com/CVE-2018-2373/): SQL injection in SAP HANA Extended Application Services (high 7.5)
- [CVE-2018-2372](https://insights.sbomify.com/CVE-2018-2372/): Information disclosure in SAP HANA Extended Application Services (medium 6.5)
- [CVE-2018-2371](https://insights.sbomify.com/CVE-2018-2371/): Cross-site scripting in SAP NetWeaver Java Web Application (medium 6.1)
- [CVE-2018-2370](https://insights.sbomify.com/CVE-2018-2370/): Server-side request forgery in SAP BI Launchpad (medium 5.3)
- [CVE-2018-2369](https://insights.sbomify.com/CVE-2018-2369/): Information disclosure in SAP HANA (medium 5.3)
- [CVE-2018-2368](https://insights.sbomify.com/CVE-2018-2368/): Missing authorization in SAP NetWeaver System Landscape Directory, LM-Core (critical 9.8)
- [CVE-2018-2367](https://insights.sbomify.com/CVE-2018-2367/): Path traversal in SAP BASIS (ABAP File Interface) (high 8.8)
- [CVE-2018-2366](https://insights.sbomify.com/CVE-2018-2366/): Path traversal in SAP Business Process Automation (BPA) By Redwood (medium 4.3)
- [CVE-2018-2365](https://insights.sbomify.com/CVE-2018-2365/): Cross-site scripting in SAP NetWeaver Portal WebDynpro RunTime (medium 6.1)
- [CVE-2018-2364](https://insights.sbomify.com/CVE-2018-2364/): Cross-site scripting in S4FND (medium 6.1)
- [CVE-2018-2363](https://insights.sbomify.com/CVE-2018-2363/): Code injection in SAP NetWeaver (high 8.8)
- [CVE-2018-2362](https://insights.sbomify.com/CVE-2018-2362/): Information disclosure in SAP HANA (medium 5.3)
- [CVE-2018-2361](https://insights.sbomify.com/CVE-2018-2361/): Privilege escalation in SAP Solution Manager (high 8.8)
- [CVE-2018-2360](https://insights.sbomify.com/CVE-2018-2360/): Missing authorization in SAP Startup Service (high 7.5)
- [CVE-2018-21270](https://insights.sbomify.com/CVE-2018-21270/): Out-of-bounds Read in stringstream (medium 6.5)
- [CVE-2018-21269](https://insights.sbomify.com/CVE-2018-21269/): Path traversal in openrc project:openrc (medium 5.5)
- [CVE-2018-21268](https://insights.sbomify.com/CVE-2018-21268/): Node-Traceroute RCE Vulnerability (critical 10.0)
- [CVE-2018-21265](https://insights.sbomify.com/CVE-2018-21265/): Security feature bypass in mattermost:mattermost desktop (medium 5.3)
- [CVE-2018-21264](https://insights.sbomify.com/CVE-2018-21264/): Security feature bypass in mattermost:mattermost server (high 8.8)
- [CVE-2018-21263](https://insights.sbomify.com/CVE-2018-21263/): Auth bypass in mattermost:mattermost server (high 8.8)
- [CVE-2018-21262](https://insights.sbomify.com/CVE-2018-21262/): Denial of service in mattermost:mattermost server (high 7.5)
- [CVE-2018-21261](https://insights.sbomify.com/CVE-2018-21261/): Business logic in mattermost:mattermost server (medium 4.3)
- [CVE-2018-21260](https://insights.sbomify.com/CVE-2018-21260/): Information disclosure in mattermost:mattermost server (low 2.7)
- [CVE-2018-21259](https://insights.sbomify.com/CVE-2018-21259/): Denial of service in mattermost:mattermost server (medium 5.3)
- [CVE-2018-21258](https://insights.sbomify.com/CVE-2018-21258/): Mattermost Server is vulnerable to a Denial of Service attack through `invite_people` command (high 7.5)
- [CVE-2018-21257](https://insights.sbomify.com/CVE-2018-21257/): Missing authorization in mattermost:mattermost server (medium 5.3)
- [CVE-2018-21256](https://insights.sbomify.com/CVE-2018-21256/): Missing authorization in mattermost:mattermost server (medium 4.3)
- [CVE-2018-21255](https://insights.sbomify.com/CVE-2018-21255/): Missing authorization in mattermost:mattermost server (medium 4.3)
- [CVE-2018-21254](https://insights.sbomify.com/CVE-2018-21254/): Missing authorization in mattermost:mattermost server (medium 4.3)
- [CVE-2018-21253](https://insights.sbomify.com/CVE-2018-21253/): Missing authorization in mattermost:mattermost server (medium 4.3)
- [CVE-2018-21252](https://insights.sbomify.com/CVE-2018-21252/): Security feature bypass in mattermost:mattermost server (medium 4.3)
- [CVE-2018-21251](https://insights.sbomify.com/CVE-2018-21251/): Missing authorization in mattermost:mattermost server (critical 9.8)
- [CVE-2018-21250](https://insights.sbomify.com/CVE-2018-21250/): Denial of service in mattermost:mattermost server (medium 6.5)
- [CVE-2018-21249](https://insights.sbomify.com/CVE-2018-21249/): Weak cryptography in mattermost:mattermost server (low 3.7)
- [CVE-2018-21248](https://insights.sbomify.com/CVE-2018-21248/): Information disclosure in mattermost:mattermost server (high 7.5)
- [CVE-2018-21247](https://insights.sbomify.com/CVE-2018-21247/): Information disclosure in canonical:ubuntu linux (high 7.5)
- [CVE-2018-21246](https://insights.sbomify.com/CVE-2018-21246/): Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication (critical 9.8)
- [CVE-2018-21245](https://insights.sbomify.com/CVE-2018-21245/): Other in apsis:pound (critical 9.1)
- [CVE-2018-21244](https://insights.sbomify.com/CVE-2018-21244/): File upload in foxitsoftware:phantompdf (critical 9.8)
- [CVE-2018-21243](https://insights.sbomify.com/CVE-2018-21243/): Other in foxitsoftware:phantompdf (medium 6.5)
- [CVE-2018-21242](https://insights.sbomify.com/CVE-2018-21242/): Code injection in foxitsoftware:phantompdf (critical 9.8)
- [CVE-2018-21241](https://insights.sbomify.com/CVE-2018-21241/): Other in foxitsoftware:phantompdf (high 7.8)
- [CVE-2018-21240](https://insights.sbomify.com/CVE-2018-21240/): Denial of service in foxitsoftware:phantompdf (high 7.5)
- [CVE-2018-21239](https://insights.sbomify.com/CVE-2018-21239/): Information disclosure in foxitsoftware:phantompdf (medium 5.3)
- [CVE-2018-21238](https://insights.sbomify.com/CVE-2018-21238/): Denial of service in foxitsoftware:phantompdf (high 7.5)
- [CVE-2018-21237](https://insights.sbomify.com/CVE-2018-21237/): Information disclosure in foxitsoftware:phantompdf (medium 5.3)
- [CVE-2018-21236](https://insights.sbomify.com/CVE-2018-21236/): Null dereference in foxitsoftware:reader (high 7.5)
- [CVE-2018-21235](https://insights.sbomify.com/CVE-2018-21235/): Auth bypass in foxitsoftware:e-mail advertising system (high 7.5)
- [CVE-2018-21234](https://insights.sbomify.com/CVE-2018-21234/): Deserialization of Untrusted Data in Jodd (critical 9.8)
- [CVE-2018-21233](https://insights.sbomify.com/CVE-2018-21233/): Out-of-bounds read in TensorFlow possibly causing disclosure of the contents of process memory. (medium 6.5)
- [CVE-2018-21232](https://insights.sbomify.com/CVE-2018-21232/): Denial of service in re2c:re2c (medium 5.5)
- [CVE-2018-21231](https://insights.sbomify.com/CVE-2018-21231/): Misconfiguration in netgear:d1500 firmware (medium 5.2)
- [CVE-2018-21230](https://insights.sbomify.com/CVE-2018-21230/): Misconfiguration in netgear:d1500 firmware (medium 5.2)
- [CVE-2018-21229](https://insights.sbomify.com/CVE-2018-21229/): Misconfiguration in netgear:r7500 firmware (medium 5.3)
- [CVE-2018-21228](https://insights.sbomify.com/CVE-2018-21228/): Command injection in netgear:d7800 firmware (medium 6.8)
- [CVE-2018-21227](https://insights.sbomify.com/CVE-2018-21227/): Command injection in netgear:d7800 firmware (medium 6.8)
- [CVE-2018-21226](https://insights.sbomify.com/CVE-2018-21226/): Auth bypass in netgear:jnr1010 firmware (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/59/