# Vulnerabilities published in 2018


- [CVE-2018-18728](https://insights.sbomify.com/CVE-2018-18728/): Command injection in tenda:ac15 firmware (critical 9.8)
- [CVE-2018-18727](https://insights.sbomify.com/CVE-2018-18727/): Memory corruption in tenda:ac10 firmware (high 7.5)
- [CVE-2018-18726](https://insights.sbomify.com/CVE-2018-18726/): Cross-site scripting in yunucms:yunucms (medium 4.8)
- [CVE-2018-18725](https://insights.sbomify.com/CVE-2018-18725/): Cross-site scripting in yunucms:yunucms (medium 4.8)
- [CVE-2018-18724](https://insights.sbomify.com/CVE-2018-18724/): Cross-site scripting in yunucms:yunucms (medium 4.8)
- [CVE-2018-18723](https://insights.sbomify.com/CVE-2018-18723/): Cross-site scripting in yunucms:yunucms (medium 4.8)
- [CVE-2018-18722](https://insights.sbomify.com/CVE-2018-18722/): Cross-site scripting in yunucms:yunucms (medium 4.8)
- [CVE-2018-18721](https://insights.sbomify.com/CVE-2018-18721/): Cross-site scripting in yunucms:yunucms (medium 4.8)
- [CVE-2018-18720](https://insights.sbomify.com/CVE-2018-18720/): Cross-site scripting in yunucms:yunucms (medium 4.8)
- [CVE-2018-1872](https://insights.sbomify.com/CVE-2018-1872/): Cross-site scripting in Maximo Asset Management (medium 5.4)
- [CVE-2018-18718](https://insights.sbomify.com/CVE-2018-18718/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2018-18717](https://insights.sbomify.com/CVE-2018-18717/): Cross-site scripting in eleanor-cms:eleanor cms (medium 4.8)
- [CVE-2018-18716](https://insights.sbomify.com/CVE-2018-18716/): Cross-site scripting in zohocorp:manageengine opmanager (medium 6.1)
- [CVE-2018-18715](https://insights.sbomify.com/CVE-2018-18715/): Cross-site scripting in zohocorp:manageengine opmanager (medium 6.1)
- [CVE-2018-18714](https://insights.sbomify.com/CVE-2018-18714/): Memory corruption in iobit:malware fighter (high 7.8)
- [CVE-2018-18713](https://insights.sbomify.com/CVE-2018-18713/): Path traversal in phpyun:phpyun (high 7.5)
- [CVE-2018-18712](https://insights.sbomify.com/CVE-2018-18712/): Cross-site request forgery in wuzhicms:wuzhicms (high 8.8)
- [CVE-2018-18711](https://insights.sbomify.com/CVE-2018-18711/): Cross-site request forgery in wuzhicms:wuzhicms (high 8.8)
- [CVE-2018-18710](https://insights.sbomify.com/CVE-2018-18710/): Information disclosure in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-1871](https://insights.sbomify.com/CVE-2018-1871/): Cross-site scripting in Financial Transaction Manager (medium 5.4)
- [CVE-2018-18709](https://insights.sbomify.com/CVE-2018-18709/): Memory corruption in tenda:ac10 firmware (high 7.5)
- [CVE-2018-18708](https://insights.sbomify.com/CVE-2018-18708/): Memory corruption in tenda:ac10 firmware (high 7.5)
- [CVE-2018-18707](https://insights.sbomify.com/CVE-2018-18707/): Memory corruption in tenda:ac10 firmware (high 7.5)
- [CVE-2018-18706](https://insights.sbomify.com/CVE-2018-18706/): Memory corruption in tenda:ac10 firmware (high 7.5)
- [CVE-2018-18705](https://insights.sbomify.com/CVE-2018-18705/): SQL injection in phptpoint:hospital management system (critical 9.8)
- [CVE-2018-18704](https://insights.sbomify.com/CVE-2018-18704/): SQL injection in phptpoint:pharmacy management system (critical 9.8)
- [CVE-2018-18703](https://insights.sbomify.com/CVE-2018-18703/): Path traversal in phptpoint:mailing server using file handling (high 7.5)
- [CVE-2018-18702](https://insights.sbomify.com/CVE-2018-18702/): Deserialization in icmsdev:icms (critical 9.8)
- [CVE-2018-18701](https://insights.sbomify.com/CVE-2018-18701/): Denial of service in gnu:binutils (medium 5.5)
- [CVE-2018-18700](https://insights.sbomify.com/CVE-2018-18700/): Denial of service in gnu:binutils (medium 5.5)
- [CVE-2018-18699](https://insights.sbomify.com/CVE-2018-18699/): Memory corruption in gopro:gpmf-parser (high 8.8)
- [CVE-2018-18698](https://insights.sbomify.com/CVE-2018-18698/): Information disclosure in mi:xiaomi mi-a1 firmware (critical 9.8)
- [CVE-2018-18696](https://insights.sbomify.com/CVE-2018-18696/): Cross-site request forgery in microstrategy:microstrategy (high 8.8)
- [CVE-2018-18695](https://insights.sbomify.com/CVE-2018-18695/): Memory corruption in m2soft:report designer (high 7.8)
- [CVE-2018-18694](https://insights.sbomify.com/CVE-2018-18694/): Cross-site scripting in monstra:monstra (medium 4.8)
- [CVE-2018-18692](https://insights.sbomify.com/CVE-2018-18692/): Cross-site scripting in semcosoft:semcosoft (medium 6.1)
- [CVE-2018-18690](https://insights.sbomify.com/CVE-2018-18690/): Denial of service in canonical:ubuntu linux (medium 5.5)
- [CVE-2018-18689](https://insights.sbomify.com/CVE-2018-18689/): Security feature bypass in avanquest:expert pdf ultimate (medium 5.3)
- [CVE-2018-18688](https://insights.sbomify.com/CVE-2018-18688/): Security feature bypass in code-industry:master pdf editor (medium 5.3)
- [CVE-2018-18678](https://insights.sbomify.com/CVE-2018-18678/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2018-18676](https://insights.sbomify.com/CVE-2018-18676/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2018-18675](https://insights.sbomify.com/CVE-2018-18675/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2018-18674](https://insights.sbomify.com/CVE-2018-18674/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2018-18673](https://insights.sbomify.com/CVE-2018-18673/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2018-18672](https://insights.sbomify.com/CVE-2018-18672/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2018-18671](https://insights.sbomify.com/CVE-2018-18671/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2018-18670](https://insights.sbomify.com/CVE-2018-18670/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2018-18669](https://insights.sbomify.com/CVE-2018-18669/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2018-18668](https://insights.sbomify.com/CVE-2018-18668/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2018-18667](https://insights.sbomify.com/CVE-2018-18667/): Integer overflow in pylon-network:pylontoken (high 7.5)
- [CVE-2018-18666](https://insights.sbomify.com/CVE-2018-18666/): Integer overflow in swft:swftcoin (high 7.5)
- [CVE-2018-18665](https://insights.sbomify.com/CVE-2018-18665/): Integer overflow in nexxuscoin:nexxustoken (high 7.5)
- [CVE-2018-18662](https://insights.sbomify.com/CVE-2018-18662/): Memory corruption in artifex:mupdf (medium 5.5)
- [CVE-2018-18661](https://insights.sbomify.com/CVE-2018-18661/): Null dereference in canonical:ubuntu linux (medium 6.5)
- [CVE-2018-18660](https://insights.sbomify.com/CVE-2018-18660/): Cross-site scripting in arcserve:udp (medium 6.1)
- [CVE-2018-18659](https://insights.sbomify.com/CVE-2018-18659/): XML external entity in arcserve:udp (high 7.5)
- [CVE-2018-18658](https://insights.sbomify.com/CVE-2018-18658/): Information disclosure in arcserve:udp (high 7.5)
- [CVE-2018-18657](https://insights.sbomify.com/CVE-2018-18657/): Information disclosure in arcserve:udp (high 7.5)
- [CVE-2018-18656](https://insights.sbomify.com/CVE-2018-18656/): Information disclosure in purevpn:purevpn (high 7.8)
- [CVE-2018-18655](https://insights.sbomify.com/CVE-2018-18655/): Information disclosure in prayer project:prayer (medium 4.3)
- [CVE-2018-18654](https://insights.sbomify.com/CVE-2018-18654/): Race condition in debian:crossroads (high 7.8)
- [CVE-2018-18653](https://insights.sbomify.com/CVE-2018-18653/): Security feature bypass in canonical:ubuntu linux (high 7.8)
- [CVE-2018-18652](https://insights.sbomify.com/CVE-2018-18652/): Command injection in veritas:netbackup appliance (high 7.2)
- [CVE-2018-18651](https://insights.sbomify.com/CVE-2018-18651/): Denial of service in xpdfreader:xpdf (medium 5.5)
- [CVE-2018-18650](https://insights.sbomify.com/CVE-2018-18650/): Integer overflow in xpdfreader:xpdf (medium 5.5)
- [CVE-2018-18649](https://insights.sbomify.com/CVE-2018-18649/): Code injection in gitlab:gitlab (critical 9.8)
- [CVE-2018-18648](https://insights.sbomify.com/CVE-2018-18648/): Information disclosure in gitlab:gitlab (high 7.5)
- [CVE-2018-18647](https://insights.sbomify.com/CVE-2018-18647/): Missing authorization in gitlab:gitlab (medium 6.5)
- [CVE-2018-18646](https://insights.sbomify.com/CVE-2018-18646/): Server-side request forgery in gitlab:gitlab (high 8.8)
- [CVE-2018-18645](https://insights.sbomify.com/CVE-2018-18645/): Information disclosure in gitlab:gitlab (medium 4.3)
- [CVE-2018-18644](https://insights.sbomify.com/CVE-2018-18644/): Information disclosure in gitlab:gitlab (medium 6.5)
- [CVE-2018-18643](https://insights.sbomify.com/CVE-2018-18643/): Cross-site scripting in gitlab:gitlab (medium 6.1)
- [CVE-2018-18642](https://insights.sbomify.com/CVE-2018-18642/): Cross-site scripting in gitlab:gitlab (medium 6.1)
- [CVE-2018-18641](https://insights.sbomify.com/CVE-2018-18641/): Information disclosure in gitlab:gitlab (critical 9.8)
- [CVE-2018-18640](https://insights.sbomify.com/CVE-2018-18640/): Information disclosure in gitlab:gitlab (medium 6.5)
- [CVE-2018-18638](https://insights.sbomify.com/CVE-2018-18638/): Command injection in neatorobotics:botvac connected firmware (high 8.1)
- [CVE-2018-18636](https://insights.sbomify.com/CVE-2018-18636/): Cross-site scripting in d-link:dsl-2640t firmware (medium 6.1)
- [CVE-2018-18635](https://insights.sbomify.com/CVE-2018-18635/): Cross-site scripting in mailcleaner:mailcleaner (medium 6.1)
- [CVE-2018-18631](https://insights.sbomify.com/CVE-2018-18631/): Cross-site scripting in synacor:zimbra collaboration suite (medium 6.1)
- [CVE-2018-18630](https://insights.sbomify.com/CVE-2018-18630/): Misconfiguration in changehealthcare:cardiology firmware (high 7.8)
- [CVE-2018-18629](https://insights.sbomify.com/CVE-2018-18629/): Privilege escalation in keybase:keybase (high 7.8)
- [CVE-2018-18628](https://insights.sbomify.com/CVE-2018-18628/): Deserialization of Untrusted Data in Pippo (critical 9.8)
- [CVE-2018-18626](https://insights.sbomify.com/CVE-2018-18626/): Path traversal in phpyun:phpyun (high 7.5)
- [CVE-2018-18625](https://insights.sbomify.com/CVE-2018-18625/): Grafana XSS via adding a link in General feature (medium 6.1)
- [CVE-2018-18624](https://insights.sbomify.com/CVE-2018-18624/): Grafana XSS via a column style (medium 6.1)
- [CVE-2018-18623](https://insights.sbomify.com/CVE-2018-18623/): Grafana XSS in Dashboard Text Panel (medium 6.1)
- [CVE-2018-18622](https://insights.sbomify.com/CVE-2018-18622/): Cross-site scripting in bijiadao:waimai super cms (medium 6.1)
- [CVE-2018-18621](https://insights.sbomify.com/CVE-2018-18621/): Cross-site scripting in communigate:communigate pro (medium 6.1)
- [CVE-2018-18619](https://insights.sbomify.com/CVE-2018-18619/): SQL injection in advanced comment system project:advanced comment system (critical 9.8)
- [CVE-2018-18608](https://insights.sbomify.com/CVE-2018-18608/): Cross-site scripting in dedecms:dedecms (medium 6.1)
- [CVE-2018-18607](https://insights.sbomify.com/CVE-2018-18607/): Null dereference in debian:debian linux (medium 5.5)
- [CVE-2018-18606](https://insights.sbomify.com/CVE-2018-18606/): Null dereference in debian:debian linux (medium 5.5)
- [CVE-2018-18605](https://insights.sbomify.com/CVE-2018-18605/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2018-18603](https://insights.sbomify.com/CVE-2018-18603/): Security feature bypass in 360totalsecurity:360 total security (medium 6.3)
- [CVE-2018-18602](https://insights.sbomify.com/CVE-2018-18602/): Information disclosure in guardzilla:180 indoor firmware (critical 9.8)
- [CVE-2018-18601](https://insights.sbomify.com/CVE-2018-18601/): Memory corruption in guardzilla:gz621w firmware (high 8.1)
- [CVE-2018-18600](https://insights.sbomify.com/CVE-2018-18600/): Command injection in guardzilla:180 indoor firmware (high 8.1)
- [CVE-2018-18599](https://insights.sbomify.com/CVE-2018-18599/): Memory corruption in guardianproject:stegdetect (high 8.8)
- [CVE-2018-18593](https://insights.sbomify.com/CVE-2018-18593/): MFSBGN03838 rev.1 - UCMDB Configuration Management Service, Multiple Vulnerabilities (medium 6.5)
- [CVE-2018-18591](https://insights.sbomify.com/CVE-2018-18591/): MFSBGN03823 rev.1 - Micro Focus Service Manager, unauthorized disclosure of data (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/81/