# Vulnerabilities published in 2018


- [CVE-2018-1745](https://insights.sbomify.com/CVE-2018-1745/): Missing authorization in Security Key Lifecycle Manager (high 7.5)
- [CVE-2018-17449](https://insights.sbomify.com/CVE-2018-17449/): Missing authorization in gitlab:gitlab (high 7.5)
- [CVE-2018-17448](https://insights.sbomify.com/CVE-2018-17448/): Missing authorization in citrix:netscaler sd-wan (critical 9.8)
- [CVE-2018-17447](https://insights.sbomify.com/CVE-2018-17447/): Information disclosure in citrix:netscaler sd-wan (high 7.5)
- [CVE-2018-17446](https://insights.sbomify.com/CVE-2018-17446/): SQL injection in citrix:netscaler sd-wan (critical 9.8)
- [CVE-2018-17445](https://insights.sbomify.com/CVE-2018-17445/): Command injection in citrix:netscaler sd-wan (critical 9.8)
- [CVE-2018-17444](https://insights.sbomify.com/CVE-2018-17444/): Path traversal in citrix:netscaler sd-wan (high 7.5)
- [CVE-2018-17443](https://insights.sbomify.com/CVE-2018-17443/): Cross-site scripting in dlink:central wifimanager (medium 6.1)
- [CVE-2018-17442](https://insights.sbomify.com/CVE-2018-17442/): File upload in dlink:central wifimanager (high 8.8)
- [CVE-2018-17441](https://insights.sbomify.com/CVE-2018-17441/): Cross-site scripting in dlink:central wifimanager (medium 6.1)
- [CVE-2018-17440](https://insights.sbomify.com/CVE-2018-17440/): File upload in dlink:central wifimanager (critical 9.8)
- [CVE-2018-1744](https://insights.sbomify.com/CVE-2018-1744/): Path traversal in Security Key Lifecycle Manager (high 7.7)
- [CVE-2018-17439](https://insights.sbomify.com/CVE-2018-17439/): Memory corruption in hdfgroup:hdf5 (medium 6.5)
- [CVE-2018-17438](https://insights.sbomify.com/CVE-2018-17438/): Denial of service in hdfgroup:hdf5 (medium 6.5)
- [CVE-2018-17437](https://insights.sbomify.com/CVE-2018-17437/): Denial of service in hdfgroup:hdf5 (medium 6.5)
- [CVE-2018-17436](https://insights.sbomify.com/CVE-2018-17436/): Memory corruption in hdfgroup:hdf5 (medium 6.5)
- [CVE-2018-17435](https://insights.sbomify.com/CVE-2018-17435/): Memory corruption in hdfgroup:hdf5 (medium 6.5)
- [CVE-2018-17434](https://insights.sbomify.com/CVE-2018-17434/): Denial of service in hdfgroup:hdf5 (medium 6.5)
- [CVE-2018-17433](https://insights.sbomify.com/CVE-2018-17433/): Memory corruption in hdfgroup:hdf5 (medium 6.5)
- [CVE-2018-17432](https://insights.sbomify.com/CVE-2018-17432/): Null dereference in hdfgroup:hdf5 (medium 6.5)
- [CVE-2018-17431](https://insights.sbomify.com/CVE-2018-17431/): Auth bypass in comodo:unified threat management firewall (critical 9.8)
- [CVE-2018-1743](https://insights.sbomify.com/CVE-2018-1743/): Information disclosure in Security Key Lifecycle Manager (medium 5.3)
- [CVE-2018-17429](https://insights.sbomify.com/CVE-2018-17429/): Cross-site request forgery in jtbc:jtbc (high 8.8)
- [CVE-2018-17428](https://insights.sbomify.com/CVE-2018-17428/): SQL injection in nexusfi:opac easyweb five (critical 9.8)
- [CVE-2018-17427](https://insights.sbomify.com/CVE-2018-17427/): Memory corruption in simdcomp project:simdcomp (medium 6.5)
- [CVE-2018-17426](https://insights.sbomify.com/CVE-2018-17426/): Cross-site scripting in wuzhicms:wuzhicms (medium 5.4)
- [CVE-2018-17425](https://insights.sbomify.com/CVE-2018-17425/): Cross-site scripting in wuzhicms:wuzhicms (medium 5.4)
- [CVE-2018-17423](https://insights.sbomify.com/CVE-2018-17423/): Cross-site scripting in e107:e107 (medium 4.8)
- [CVE-2018-17422](https://insights.sbomify.com/CVE-2018-17422/): Open redirect in dotcms:dotcms (medium 6.1)
- [CVE-2018-17421](https://insights.sbomify.com/CVE-2018-17421/): Cross-site scripting in zrlog:zrlog (medium 6.1)
- [CVE-2018-17420](https://insights.sbomify.com/CVE-2018-17420/): SQL injection in zrlog:zrlog (high 7.2)
- [CVE-2018-1742](https://insights.sbomify.com/CVE-2018-1742/): Hardcoded credentials in Security Key Lifecycle Manager (medium 5.9)
- [CVE-2018-17419](https://insights.sbomify.com/CVE-2018-17419/): miekg/dns parsing error leads to nil pointer dereference and DoS (high 7.5)
- [CVE-2018-17418](https://insights.sbomify.com/CVE-2018-17418/): File upload in monstra:monstra (high 7.2)
- [CVE-2018-17416](https://insights.sbomify.com/CVE-2018-17416/): SQL injection in zzcms:zzcms (high 7.2)
- [CVE-2018-17415](https://insights.sbomify.com/CVE-2018-17415/): SQL injection in zzcms:zzcms (high 8.8)
- [CVE-2018-17414](https://insights.sbomify.com/CVE-2018-17414/): SQL injection in zzcms:zzcms (high 8.8)
- [CVE-2018-17413](https://insights.sbomify.com/CVE-2018-17413/): Cross-site scripting in zzcms:zzcms (medium 6.1)
- [CVE-2018-17412](https://insights.sbomify.com/CVE-2018-17412/): SQL injection in zzcms:zzcms (critical 9.8)
- [CVE-2018-17411](https://insights.sbomify.com/CVE-2018-17411/): XML external entity in informationbuilders:data quality suite (critical 9.8)
- [CVE-2018-17410](https://insights.sbomify.com/CVE-2018-17410/): SQL injection in horus cms project:horus cms (critical 9.8)
- [CVE-2018-1741](https://insights.sbomify.com/CVE-2018-1741/): Denial of service in Security Key Lifecycle Manager (medium 6.5)
- [CVE-2018-17408](https://insights.sbomify.com/CVE-2018-17408/): Memory corruption in zahiraccounting:zahir enterprise plus (high 7.8)
- [CVE-2018-17407](https://insights.sbomify.com/CVE-2018-17407/): Memory corruption in canonical:ubuntu linux (high 7.8)
- [CVE-2018-17404](https://insights.sbomify.com/CVE-2018-17404/): Information disclosure in sbi:sbi buddy (medium 5.3)
- [CVE-2018-17403](https://insights.sbomify.com/CVE-2018-17403/): Auth bypass in phonepe:phonepe (high 8.8)
- [CVE-2018-17402](https://insights.sbomify.com/CVE-2018-17402/): Information disclosure in phonepe:phonepe (medium 5.3)
- [CVE-2018-17401](https://insights.sbomify.com/CVE-2018-17401/): Auth bypass in phonepe:phonepe (high 8.8)
- [CVE-2018-17400](https://insights.sbomify.com/CVE-2018-17400/): Information disclosure in phonepe:phonepe (high 7.0)
- [CVE-2018-1740](https://insights.sbomify.com/CVE-2018-1740/): Cross-site scripting in Security Access Manager Appliance (medium 5.4)
- [CVE-2018-17399](https://insights.sbomify.com/CVE-2018-17399/): SQL injection in jimtawl project:jimtawl (critical 9.8)
- [CVE-2018-17398](https://insights.sbomify.com/CVE-2018-17398/): SQL injection in arenam:amgallery (critical 9.8)
- [CVE-2018-17397](https://insights.sbomify.com/CVE-2018-17397/): SQL injection in multiplanet:alphaindex dictionaries (critical 9.8)
- [CVE-2018-17394](https://insights.sbomify.com/CVE-2018-17394/): SQL injection in osthemeclub:timetable schedule (critical 9.8)
- [CVE-2018-17393](https://insights.sbomify.com/CVE-2018-17393/): SQL injection in healthnode hospital management system project:healthnode hospital management system (critical 9.8)
- [CVE-2018-17391](https://insights.sbomify.com/CVE-2018-17391/): SQL injection in super cms blog pro project:super cms blog pro (critical 9.8)
- [CVE-2018-17389](https://insights.sbomify.com/CVE-2018-17389/): Cross-site request forgery in ranksol:live call support (high 8.8)
- [CVE-2018-17388](https://insights.sbomify.com/CVE-2018-17388/): SQL injection in ranksol:twilio web to fax machine system (critical 9.8)
- [CVE-2018-17387](https://insights.sbomify.com/CVE-2018-17387/): Cross-site request forgery in ranksol:nimble professional (high 8.8)
- [CVE-2018-17386](https://insights.sbomify.com/CVE-2018-17386/): SQL injection in thephpfactory:micro deal factory (critical 9.8)
- [CVE-2018-17385](https://insights.sbomify.com/CVE-2018-17385/): SQL injection in thephpfactory:social factory (critical 9.8)
- [CVE-2018-17384](https://insights.sbomify.com/CVE-2018-17384/): SQL injection in thephpfactory:swap factory (critical 9.8)
- [CVE-2018-17383](https://insights.sbomify.com/CVE-2018-17383/): SQL injection in thephpfactory:collection factory (critical 9.8)
- [CVE-2018-17382](https://insights.sbomify.com/CVE-2018-17382/): SQL injection in thephpfactory:jobs factory (critical 9.8)
- [CVE-2018-17381](https://insights.sbomify.com/CVE-2018-17381/): SQL injection in thephpfactory:dutch auction factory (critical 9.8)
- [CVE-2018-17380](https://insights.sbomify.com/CVE-2018-17380/): SQL injection in thephpfactory:article factory manager (critical 9.8)
- [CVE-2018-1738](https://insights.sbomify.com/CVE-2018-1738/): Auth bypass in Security Key Lifecycle Manager (high 7.1)
- [CVE-2018-17379](https://insights.sbomify.com/CVE-2018-17379/): SQL injection in thephpfactory:raffle factory (critical 9.8)
- [CVE-2018-17378](https://insights.sbomify.com/CVE-2018-17378/): SQL injection in thephpfactory:penny auction factory (critical 9.8)
- [CVE-2018-17377](https://insights.sbomify.com/CVE-2018-17377/): SQL injection in extensiondeveloper:questions (critical 9.8)
- [CVE-2018-17376](https://insights.sbomify.com/CVE-2018-17376/): SQL injection in thephpfactory:reverse auction factory (critical 9.8)
- [CVE-2018-17375](https://insights.sbomify.com/CVE-2018-17375/): SQL injection in joomlathat:music collection (critical 9.8)
- [CVE-2018-17374](https://insights.sbomify.com/CVE-2018-17374/): SQL injection in thephpfactory:auction factory (critical 9.8)
- [CVE-2018-17369](https://insights.sbomify.com/CVE-2018-17369/): Cross-site scripting in springboot authority project:springboot authority (medium 4.8)
- [CVE-2018-17368](https://insights.sbomify.com/CVE-2018-17368/): Information disclosure in publiccms:publiccms (medium 5.3)
- [CVE-2018-17366](https://insights.sbomify.com/CVE-2018-17366/): Mingsoft MCMS CSRF vulnerability (high 8.8)
- [CVE-2018-17365](https://insights.sbomify.com/CVE-2018-17365/): Path traversal in seacms:seacms (high 7.5)
- [CVE-2018-17364](https://insights.sbomify.com/CVE-2018-17364/): Code injection in otcms:otcms (high 8.1)
- [CVE-2018-17361](https://insights.sbomify.com/CVE-2018-17361/): Cross-site scripting in weaselcms project:weaselcms (medium 6.1)
- [CVE-2018-17360](https://insights.sbomify.com/CVE-2018-17360/): Memory corruption in gnu:binutils (medium 5.5)
- [CVE-2018-1736](https://insights.sbomify.com/CVE-2018-1736/): Open redirect in WebSphere Portal (high 7.4)
- [CVE-2018-17359](https://insights.sbomify.com/CVE-2018-17359/): Memory corruption in gnu:binutils (medium 5.5)
- [CVE-2018-17358](https://insights.sbomify.com/CVE-2018-17358/): Memory corruption in gnu:binutils (medium 5.5)
- [CVE-2018-17341](https://insights.sbomify.com/CVE-2018-17341/): Auth bypass in bigtreecms:bigtree cms (high 8.1)
- [CVE-2018-1734](https://insights.sbomify.com/CVE-2018-1734/): Information disclosure in Rational Collaborative Lifecycle Management (medium 4.3)
- [CVE-2018-17338](https://insights.sbomify.com/CVE-2018-17338/): Memory corruption in pdfalto project:pdfalto (high 7.8)
- [CVE-2018-17337](https://insights.sbomify.com/CVE-2018-17337/): Cross-site scripting in intelbras:nplug firmware (medium 6.1)
- [CVE-2018-17336](https://insights.sbomify.com/CVE-2018-17336/): Memory corruption in canonical:ubuntu linux (high 7.8)
- [CVE-2018-17334](https://insights.sbomify.com/CVE-2018-17334/): Memory corruption in libsvg2 project:libsvg2 (critical 9.8)
- [CVE-2018-17333](https://insights.sbomify.com/CVE-2018-17333/): Memory corruption in libsvg2 project:libsvg2 (critical 9.8)
- [CVE-2018-17332](https://insights.sbomify.com/CVE-2018-17332/): Denial of service in libsvg2 project:libsvg2 (high 7.5)
- [CVE-2018-1733](https://insights.sbomify.com/CVE-2018-1733/): Other in QRadar SIEM (medium 5.3)
- [CVE-2018-17322](https://insights.sbomify.com/CVE-2018-17322/): Cross-site scripting in yunucms:yunucms (medium 6.1)
- [CVE-2018-17321](https://insights.sbomify.com/CVE-2018-17321/): Cross-site scripting in seacms:seacms (medium 6.1)
- [CVE-2018-17320](https://insights.sbomify.com/CVE-2018-17320/): Cross-site scripting in ucms project:ucms (medium 6.1)
- [CVE-2018-1732](https://insights.sbomify.com/CVE-2018-1732/): Information disclosure in QRadar SIEM (medium 5.3)
- [CVE-2018-17317](https://insights.sbomify.com/CVE-2018-17317/): Command injection in fruitywifi project:fruitywifi (critical 9.8)
- [CVE-2018-17316](https://insights.sbomify.com/CVE-2018-17316/): Cross-site scripting in ricoh:mp c6003 firmware (medium 6.1)
- [CVE-2018-17315](https://insights.sbomify.com/CVE-2018-17315/): Cross-site scripting in ricoh:mp c2003sp firmware (medium 6.1)
- [CVE-2018-17314](https://insights.sbomify.com/CVE-2018-17314/): Cross-site scripting in ricoh:mp 305\+ firmware (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/90/