# Vulnerabilities published in 2018 - [CVE-2018-18461](https://insights.sbomify.com/CVE-2018-18461/): Code injection in kibokolabs:arigato autoresponder and newsletter (critical 9.8) - [CVE-2018-18460](https://insights.sbomify.com/CVE-2018-18460/): Cross-site scripting in 3cx:live chat (medium 6.1) - [CVE-2018-1846](https://insights.sbomify.com/CVE-2018-1846/): XML external entity in Rational Engineering Lifecycle Manager (high 7.1) - [CVE-2018-18459](https://insights.sbomify.com/CVE-2018-18459/): Null dereference in xpdfreader:xpdf (medium 5.5) - [CVE-2018-18458](https://insights.sbomify.com/CVE-2018-18458/): Null dereference in xpdfreader:xpdf (medium 5.5) - [CVE-2018-18457](https://insights.sbomify.com/CVE-2018-18457/): Null dereference in xpdfreader:xpdf (medium 5.5) - [CVE-2018-18456](https://insights.sbomify.com/CVE-2018-18456/): Memory corruption in xpdfreader:xpdf (medium 5.5) - [CVE-2018-18455](https://insights.sbomify.com/CVE-2018-18455/): Memory corruption in xpdfreader:xpdf (medium 5.5) - [CVE-2018-18454](https://insights.sbomify.com/CVE-2018-18454/): Memory corruption in xpdfreader:xpdf (medium 5.5) - [CVE-2018-18450](https://insights.sbomify.com/CVE-2018-18450/): SQL injection in pbootcms:pbootcms (critical 9.8) - [CVE-2018-1845](https://insights.sbomify.com/CVE-2018-1845/): XML external entity in InfoSphere Information Server (high 7.1) - [CVE-2018-18449](https://insights.sbomify.com/CVE-2018-18449/): Cross-site request forgery in phome:empirecms (high 8.8) - [CVE-2018-18447](https://insights.sbomify.com/CVE-2018-18447/): Deserialization in dotpdn:paint.net (critical 9.8) - [CVE-2018-18446](https://insights.sbomify.com/CVE-2018-18446/): Deserialization in dotpdn:paint.net (critical 9.8) - [CVE-2018-18445](https://insights.sbomify.com/CVE-2018-18445/): Memory corruption in canonical:ubuntu linux (high 7.8) - [CVE-2018-18444](https://insights.sbomify.com/CVE-2018-18444/): Memory corruption in ilm:openexr (high 8.8) - [CVE-2018-18443](https://insights.sbomify.com/CVE-2018-18443/): Denial of service in ilm:openexr (medium 4.3) - [CVE-2018-18442](https://insights.sbomify.com/CVE-2018-18442/): Denial of service in d-link:dcs-825l firmware (high 7.5) - [CVE-2018-18441](https://insights.sbomify.com/CVE-2018-18441/): Information disclosure in d-link:dcs-2102 firmware (high 7.5) - [CVE-2018-18440](https://insights.sbomify.com/CVE-2018-18440/): Memory corruption in denx:u-boot (high 7.8) - [CVE-2018-1844](https://insights.sbomify.com/CVE-2018-1844/): XML external entity in FileNet Content Manager (high 7.1) - [CVE-2018-18439](https://insights.sbomify.com/CVE-2018-18439/): Memory corruption in denx:u-boot (critical 9.8) - [CVE-2018-18438](https://insights.sbomify.com/CVE-2018-18438/): Integer overflow in qemu:qemu (medium 5.5) - [CVE-2018-18437](https://insights.sbomify.com/CVE-2018-18437/): Cross-site scripting in axiositalia:registro elettronico (medium 6.1) - [CVE-2018-18436](https://insights.sbomify.com/CVE-2018-18436/): Cross-site request forgery in jtbc:jtbc php (high 8.8) - [CVE-2018-18435](https://insights.sbomify.com/CVE-2018-18435/): Misconfiguration in kioware:kioware server (high 7.8) - [CVE-2018-18434](https://insights.sbomify.com/CVE-2018-18434/): Path traversal in linlinjava:litemall (high 7.5) - [CVE-2018-18433](https://insights.sbomify.com/CVE-2018-18433/): Cross-site scripting in destoon:destoon b2b (medium 4.8) - [CVE-2018-18432](https://insights.sbomify.com/CVE-2018-18432/): Cross-site request forgery in destoon:destoon b2b (high 8.8) - [CVE-2018-18431](https://insights.sbomify.com/CVE-2018-18431/): Cross-site scripting in destoon:destoon b2b (medium 4.8) - [CVE-2018-18430](https://insights.sbomify.com/CVE-2018-18430/): Cross-site scripting in destoon:destoon b2b (medium 4.8) - [CVE-2018-1843](https://insights.sbomify.com/CVE-2018-1843/): Information disclosure in Cloud Private (medium 4.1) - [CVE-2018-18428](https://insights.sbomify.com/CVE-2018-18428/): Missing authorization in tp-link:tl-sc3130 firmware (high 7.5) - [CVE-2018-18427](https://insights.sbomify.com/CVE-2018-18427/): SQL injection in s-cms:s-cms (critical 9.8) - [CVE-2018-18426](https://insights.sbomify.com/CVE-2018-18426/): Code injection in s-cms:s-cms (high 8.8) - [CVE-2018-18425](https://insights.sbomify.com/CVE-2018-18425/): Business logic in primeo project:primeo (medium 6.5) - [CVE-2018-18422](https://insights.sbomify.com/CVE-2018-18422/): Cross-site request forgery in usualtool:usualtoolcms (high 8.8) - [CVE-2018-18420](https://insights.sbomify.com/CVE-2018-18420/): Zenario CMS vulnerable to CSRF (high 8.8) - [CVE-2018-1842](https://insights.sbomify.com/CVE-2018-1842/): Security feature bypass in Cognos Analytics (low 3.6) - [CVE-2018-18419](https://insights.sbomify.com/CVE-2018-18419/): Cross-site scripting in ardawan:user management (medium 5.4) - [CVE-2018-18417](https://insights.sbomify.com/CVE-2018-18417/): Cross-site scripting in creativeitem:ekushey project manager (medium 5.4) - [CVE-2018-18416](https://insights.sbomify.com/CVE-2018-18416/): Cross-site scripting in pokkho:lango (medium 4.8) - [CVE-2018-1841](https://insights.sbomify.com/CVE-2018-1841/): Information disclosure in Cloud Private (medium 6.2) - [CVE-2018-18409](https://insights.sbomify.com/CVE-2018-18409/): Memory corruption in canonical:ubuntu linux (medium 5.5) - [CVE-2018-18408](https://insights.sbomify.com/CVE-2018-18408/): Use after free in broadcom:tcpreplay (critical 9.8) - [CVE-2018-18407](https://insights.sbomify.com/CVE-2018-18407/): Memory corruption in broadcom:tcpreplay (medium 5.5) - [CVE-2018-18406](https://insights.sbomify.com/CVE-2018-18406/): XML external entity in tufin:securetrack (critical 9.9) - [CVE-2018-18405](https://insights.sbomify.com/CVE-2018-18405/): Cross-site scripting in jquery:jquery (medium 6.1) - [CVE-2018-1840](https://insights.sbomify.com/CVE-2018-1840/): Privilege escalation in WebSphere Application Server (medium 6.0) - [CVE-2018-18399](https://insights.sbomify.com/CVE-2018-18399/): SQL injection in jco:karma (critical 9.8) - [CVE-2018-18398](https://insights.sbomify.com/CVE-2018-18398/): Memory corruption in xfce:thunar (medium 4.7) - [CVE-2018-18397](https://insights.sbomify.com/CVE-2018-18397/): Missing authorization in canonical:ubuntu linux (medium 5.5) - [CVE-2018-18396](https://insights.sbomify.com/CVE-2018-18396/): Other in ThingsPro IIoT Gateway and Device Management Software Solutions (critical 9.8) - [CVE-2018-18395](https://insights.sbomify.com/CVE-2018-18395/): Hardcoded credentials in ThingsPro IIoT Gateway and Device Management Software Solutions (critical 9.8) - [CVE-2018-18394](https://insights.sbomify.com/CVE-2018-18394/): Information disclosure in ThingsPro IIoT Gateway and Device Management Software Solutions (critical 9.8) - [CVE-2018-18393](https://insights.sbomify.com/CVE-2018-18393/): Other in ThingsPro IIoT Gateway and Device Management Software Solutions (critical 9.8) - [CVE-2018-18392](https://insights.sbomify.com/CVE-2018-18392/): Privilege escalation in ThingsPro IIoT Gateway and Device Management Software Solutions (high 8.8) - [CVE-2018-18391](https://insights.sbomify.com/CVE-2018-18391/): Privilege escalation in ThingsPro IIoT Gateway and Device Management Software Solutions (high 8.8) - [CVE-2018-18390](https://insights.sbomify.com/CVE-2018-18390/): Information disclosure in ThingsPro IIoT Gateway and Device Management Software Solutions (high 7.5) - [CVE-2018-18389](https://insights.sbomify.com/CVE-2018-18389/): Incorrect access control in Neo4j Enterprise Database Server via LDAP authentication (critical 9.8) - [CVE-2018-18388](https://insights.sbomify.com/CVE-2018-18388/): Command injection in escanav:escan anti-virus (critical 9.8) - [CVE-2018-18387](https://insights.sbomify.com/CVE-2018-18387/): Privilege escalation in playsms project:playsms (high 8.8) - [CVE-2018-18386](https://insights.sbomify.com/CVE-2018-18386/): Denial of service in canonical:ubuntu linux (low 3.3) - [CVE-2018-18385](https://insights.sbomify.com/CVE-2018-18385/): Asciidoctor Infinite Loop vulnerability (high 7.5) - [CVE-2018-18384](https://insights.sbomify.com/CVE-2018-18384/): Memory corruption in unzip project:unzip (medium 5.5) - [CVE-2018-18382](https://insights.sbomify.com/CVE-2018-18382/): File upload in coderpixel:advanced hrm (high 8.8) - [CVE-2018-18381](https://insights.sbomify.com/CVE-2018-18381/): Cross-site scripting in zblogcn:z-blogphp (medium 5.4) - [CVE-2018-18380](https://insights.sbomify.com/CVE-2018-18380/): Auth bypass in bigtreecms:bigtree cms (medium 5.4) - [CVE-2018-1838](https://insights.sbomify.com/CVE-2018-1838/): Information disclosure in WebSphere Application Server (medium 5.3) - [CVE-2018-18379](https://insights.sbomify.com/CVE-2018-18379/): Cross-site scripting in elementor:elementor page builder (medium 6.1) - [CVE-2018-18377](https://insights.sbomify.com/CVE-2018-18377/): Missing authorization in orange:airbox firmware (high 7.5) - [CVE-2018-18376](https://insights.sbomify.com/CVE-2018-18376/): Information disclosure in orange:airbox firmware (high 7.5) - [CVE-2018-18375](https://insights.sbomify.com/CVE-2018-18375/): Information disclosure in orange:airbox firmware (critical 9.8) - [CVE-2018-18374](https://insights.sbomify.com/CVE-2018-18374/): Cross-site scripting in metinfo:metinfo (medium 5.4) - [CVE-2018-18373](https://insights.sbomify.com/CVE-2018-18373/): Cross-site scripting in schiocco:support board - chat and help desk (medium 5.4) - [CVE-2018-18372](https://insights.sbomify.com/CVE-2018-18372/): Cross-site scripting in kaasoft:library cms (medium 6.1) - [CVE-2018-18371](https://insights.sbomify.com/CVE-2018-18371/): Information disclosure in Symantec Advanced Secure Gateway (ASG) (medium 6.5) - [CVE-2018-18370](https://insights.sbomify.com/CVE-2018-18370/): Cross-site scripting in Symantec Advanced Secure Gateway (ASG) (medium 6.1) - [CVE-2018-18369](https://insights.sbomify.com/CVE-2018-18369/): Other in Norton Security (high 7.8) - [CVE-2018-18368](https://insights.sbomify.com/CVE-2018-18368/): Privilege escalation in Symantec Endpoint Protection Manager (SEPM) (high 7.8) - [CVE-2018-18367](https://insights.sbomify.com/CVE-2018-18367/): Other in Symantec Endpoint Protection Manager (high 7.8) - [CVE-2018-18366](https://insights.sbomify.com/CVE-2018-18366/): Information disclosure in Norton Security (medium 6.5) - [CVE-2018-18365](https://insights.sbomify.com/CVE-2018-18365/): Other in Norton Password Manager (high 7.5) - [CVE-2018-18364](https://insights.sbomify.com/CVE-2018-18364/): Other in Ghost Solution Suite (GSS) (high 7.3) - [CVE-2018-18363](https://insights.sbomify.com/CVE-2018-18363/): Security feature bypass in Norton App Lock (medium 6.2) - [CVE-2018-18362](https://insights.sbomify.com/CVE-2018-18362/): Cross-site scripting in Norton Password Manager (medium 6.1) - [CVE-2018-18361](https://insights.sbomify.com/CVE-2018-18361/): Cross-site scripting in nconsulting:nc-cms (medium 6.1) - [CVE-2018-1836](https://insights.sbomify.com/CVE-2018-1836/): Cross-site scripting in MQ (medium 5.4) - [CVE-2018-18359](https://insights.sbomify.com/CVE-2018-18359/): Memory corruption in Chrome (high 8.8) - [CVE-2018-18358](https://insights.sbomify.com/CVE-2018-18358/): Security feature bypass in Chrome (medium 5.7) - [CVE-2018-18357](https://insights.sbomify.com/CVE-2018-18357/): Security feature bypass in Chrome (medium 4.3) - [CVE-2018-18356](https://insights.sbomify.com/CVE-2018-18356/): Use after free in Chrome (high 8.8) - [CVE-2018-18355](https://insights.sbomify.com/CVE-2018-18355/): Security feature bypass in Chrome (medium 4.3) - [CVE-2018-18354](https://insights.sbomify.com/CVE-2018-18354/): Security feature bypass in Chrome (high 8.8) - [CVE-2018-18353](https://insights.sbomify.com/CVE-2018-18353/): Other in Chrome (medium 6.5) - [CVE-2018-18352](https://insights.sbomify.com/CVE-2018-18352/): Security feature bypass in Chrome (medium 6.5) - [CVE-2018-18351](https://insights.sbomify.com/CVE-2018-18351/): Security feature bypass in Chrome (medium 6.5) - [CVE-2018-18350](https://insights.sbomify.com/CVE-2018-18350/): Security feature bypass in Chrome (medium 6.5) - [CVE-2018-1835](https://insights.sbomify.com/CVE-2018-1835/): XML external entity in Daeja ViewONE (high 7.1) - [CVE-2018-18349](https://insights.sbomify.com/CVE-2018-18349/): Security feature bypass in Chrome (medium 6.5) --- From sbomify Insights: https://insights.sbomify.com/years/2018/page/83/