# Vulnerabilities published in 2018


- [CVE-2018-17313](https://insights.sbomify.com/CVE-2018-17313/): Cross-site scripting in ricoh:mp c307 firmware (medium 6.1)
- [CVE-2018-17312](https://insights.sbomify.com/CVE-2018-17312/): Cross-site scripting in ricoh:aficio mp 301spf firmware (medium 6.1)
- [CVE-2018-17311](https://insights.sbomify.com/CVE-2018-17311/): Cross-site scripting in ricoh:mp c6503 firmware (medium 6.1)
- [CVE-2018-17310](https://insights.sbomify.com/CVE-2018-17310/): Cross-site scripting in ricoh:mp c1803 jpn firmware (medium 6.1)
- [CVE-2018-1731](https://insights.sbomify.com/CVE-2018-1731/): Cross-site scripting in Rational DOORS Next Generation (medium 4.8)
- [CVE-2018-17309](https://insights.sbomify.com/CVE-2018-17309/): Cross-site scripting in ricoh:mp c406zspf firmware (medium 6.1)
- [CVE-2018-17305](https://insights.sbomify.com/CVE-2018-17305/): Privilege escalation in uipath:orchestrator (high 8.8)
- [CVE-2018-17302](https://insights.sbomify.com/CVE-2018-17302/): Cross-site scripting in espocrm:espocrm (medium 5.4)
- [CVE-2018-17301](https://insights.sbomify.com/CVE-2018-17301/): Cross-site scripting in espocrm:espocrm (medium 5.4)
- [CVE-2018-17300](https://insights.sbomify.com/CVE-2018-17300/): Cross-site scripting in cuppacms:cuppacms (medium 4.8)
- [CVE-2018-1730](https://insights.sbomify.com/CVE-2018-1730/): XML external entity in QRadar SIEM (high 7.1)
- [CVE-2018-17298](https://insights.sbomify.com/CVE-2018-17298/): Auth bypass in enalean:tuleap (critical 9.8)
- [CVE-2018-17297](https://insights.sbomify.com/CVE-2018-17297/): Unzip function in ZipUtil.java in Hutool allows remote attackers to overwrite arbitrary files via directory traversal (high 7.5)
- [CVE-2018-17294](https://insights.sbomify.com/CVE-2018-17294/): Memory corruption in canonical:ubuntu linux (medium 6.5)
- [CVE-2018-17293](https://insights.sbomify.com/CVE-2018-17293/): Null dereference in webassembly virtual machine project:webassembly virtual machine (high 8.8)
- [CVE-2018-17292](https://insights.sbomify.com/CVE-2018-17292/): Memory corruption in webassembly virtual machine project:webassembly virtual machine (medium 6.5)
- [CVE-2018-1729](https://insights.sbomify.com/CVE-2018-1729/): Information disclosure in QRadar SIEM (medium 5.3)
- [CVE-2018-17289](https://insights.sbomify.com/CVE-2018-17289/): XML external entity in kofax:front office server (medium 6.5)
- [CVE-2018-17288](https://insights.sbomify.com/CVE-2018-17288/): Cross-site scripting in kofax:front office server (medium 5.4)
- [CVE-2018-17287](https://insights.sbomify.com/CVE-2018-17287/): Information disclosure in kofax:front office server (medium 4.9)
- [CVE-2018-17283](https://insights.sbomify.com/CVE-2018-17283/): Missing authorization in zohocorp:manageengine opmanager (high 7.5)
- [CVE-2018-17282](https://insights.sbomify.com/CVE-2018-17282/): Null dereference in exiv2:exiv2 (medium 6.5)
- [CVE-2018-17281](https://insights.sbomify.com/CVE-2018-17281/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2018-1728](https://insights.sbomify.com/CVE-2018-1728/): Cross-site scripting in QRadar SIEM (medium 5.4)
- [CVE-2018-1727](https://insights.sbomify.com/CVE-2018-1727/): XML external entity in InfoSphere Information Server (high 7.1)
- [CVE-2018-17256](https://insights.sbomify.com/CVE-2018-17256/): Umbraco CMS vulnerable to stored XSS (medium 4.8)
- [CVE-2018-17254](https://insights.sbomify.com/CVE-2018-17254/): SQL injection in arkextensions:jck editor (critical 9.8)
- [CVE-2018-1725](https://insights.sbomify.com/CVE-2018-1725/): Information disclosure in QRadar SIEM (low 3.2)
- [CVE-2018-17247](https://insights.sbomify.com/CVE-2018-17247/): Improper Restriction of XML External Entity Reference in Elasticsearch (medium 5.9)
- [CVE-2018-17246](https://insights.sbomify.com/CVE-2018-17246/): Code injection in Kibana (critical 9.8)
- [CVE-2018-17245](https://insights.sbomify.com/CVE-2018-17245/): Information disclosure in Kibana (critical 9.8)
- [CVE-2018-17244](https://insights.sbomify.com/CVE-2018-17244/): Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch (medium 6.5)
- [CVE-2018-17243](https://insights.sbomify.com/CVE-2018-17243/): SQL injection in zohocorp:manageengine opmanager (critical 9.8)
- [CVE-2018-17240](https://insights.sbomify.com/CVE-2018-17240/): Information disclosure in netwavepr:indoor ip camera firmware (high 7.5)
- [CVE-2018-1724](https://insights.sbomify.com/CVE-2018-1724/): Misconfiguration in Spectrum LSF (medium 5.9)
- [CVE-2018-17237](https://insights.sbomify.com/CVE-2018-17237/): Denial of service in hdfgroup:hdf5 (medium 6.5)
- [CVE-2018-17236](https://insights.sbomify.com/CVE-2018-17236/): Memory corruption in mp4v2 project:mp4v2 (medium 6.5)
- [CVE-2018-17235](https://insights.sbomify.com/CVE-2018-17235/): Memory corruption in mp4v2 project:mp4v2 (medium 6.5)
- [CVE-2018-17234](https://insights.sbomify.com/CVE-2018-17234/): Denial of service in hdfgroup:hdf5 (medium 6.5)
- [CVE-2018-17233](https://insights.sbomify.com/CVE-2018-17233/): Denial of service in hdfgroup:hdf5 (medium 6.5)
- [CVE-2018-17232](https://insights.sbomify.com/CVE-2018-17232/): SQL injection in slack archivebot project:slack archivebot (critical 9.8)
- [CVE-2018-17231](https://insights.sbomify.com/CVE-2018-17231/): Denial of service in telegram:telegram desktop (high 7.5)
- [CVE-2018-17230](https://insights.sbomify.com/CVE-2018-17230/): Memory corruption in exiv2:exiv2 (medium 6.5)
- [CVE-2018-1723](https://insights.sbomify.com/CVE-2018-1723/): Information disclosure in Spectrum Scale (medium 6.2)
- [CVE-2018-17229](https://insights.sbomify.com/CVE-2018-17229/): Memory corruption in exiv2:exiv2 (medium 6.5)
- [CVE-2018-17228](https://insights.sbomify.com/CVE-2018-17228/): Command injection in nmap4j project:nmap4j (critical 9.8)
- [CVE-2018-1722](https://insights.sbomify.com/CVE-2018-1722/): Other in Security Access Manager Appliance (critical 10.0)
- [CVE-2018-17218](https://insights.sbomify.com/CVE-2018-17218/): Cross-site scripting in ptc:thingworx platform (medium 5.4)
- [CVE-2018-17217](https://insights.sbomify.com/CVE-2018-17217/): Hardcoded credentials in ptc:thingworx platform (high 7.5)
- [CVE-2018-17216](https://insights.sbomify.com/CVE-2018-17216/): Information disclosure in ptc:thingworx platform (medium 6.5)
- [CVE-2018-17215](https://insights.sbomify.com/CVE-2018-17215/): Information disclosure in postman:postman (high 8.1)
- [CVE-2018-17213](https://insights.sbomify.com/CVE-2018-17213/): Auth bypass in printeron:central print services (high 8.8)
- [CVE-2018-17211](https://insights.sbomify.com/CVE-2018-17211/): Information disclosure in printeron:central print services (medium 5.3)
- [CVE-2018-17210](https://insights.sbomify.com/CVE-2018-17210/): Auth bypass in printeron:central print services (high 8.8)
- [CVE-2018-1721](https://insights.sbomify.com/CVE-2018-1721/): XML external entity in Cognos Analytics (high 8.3)
- [CVE-2018-17208](https://insights.sbomify.com/CVE-2018-17208/): Command injection in linksys:velop firmware (high 8.8)
- [CVE-2018-17207](https://insights.sbomify.com/CVE-2018-17207/): Code injection in awesomemotive:duplicator (critical 9.8)
- [CVE-2018-17206](https://insights.sbomify.com/CVE-2018-17206/): Memory corruption in canonical:ubuntu linux (medium 4.9)
- [CVE-2018-17205](https://insights.sbomify.com/CVE-2018-17205/): Denial of service in canonical:ubuntu linux (high 7.5)
- [CVE-2018-17204](https://insights.sbomify.com/CVE-2018-17204/): Denial of service in canonical:ubuntu linux (medium 4.3)
- [CVE-2018-17202](https://insights.sbomify.com/CVE-2018-17202/): Infinite Loop in Apache Sanselan (high 7.5)
- [CVE-2018-17201](https://insights.sbomify.com/CVE-2018-17201/): Improper Input Validation in Apache Sanselan (high 7.5)
- [CVE-2018-17200](https://insights.sbomify.com/CVE-2018-17200/): Deserialization in OFBiz (critical 9.8)
- [CVE-2018-1720](https://insights.sbomify.com/CVE-2018-1720/): Weak cryptography in Sterling B2B Integrator (medium 5.9)
- [CVE-2018-17199](https://insights.sbomify.com/CVE-2018-17199/): Security feature bypass in Apache HTTP Server (high 7.5)
- [CVE-2018-17198](https://insights.sbomify.com/CVE-2018-17198/): XML external entity in Apache Roller (critical 9.8)
- [CVE-2018-17197](https://insights.sbomify.com/CVE-2018-17197/): Apache Tika Denial of Service due to Infinite Loop in Tika's SQLite3Parser (medium 6.5)
- [CVE-2018-17196](https://insights.sbomify.com/CVE-2018-17196/): Improper Input Validation in Apache Kafka (high 8.8)
- [CVE-2018-17195](https://insights.sbomify.com/CVE-2018-17195/): Cleartext Transmission of Sensitive Information in Apache nifi (high 7.5)
- [CVE-2018-17194](https://insights.sbomify.com/CVE-2018-17194/): Apache NiFi Improper Input Validation vulnerability (high 7.5)
- [CVE-2018-17193](https://insights.sbomify.com/CVE-2018-17193/): Cross site scripting in org.apache.nifi:nifi (medium 6.1)
- [CVE-2018-17192](https://insights.sbomify.com/CVE-2018-17192/): Improper Restriction of Rendered UI Layers or Frames in Apache nifif (medium 6.5)
- [CVE-2018-17191](https://insights.sbomify.com/CVE-2018-17191/): Code injection in Apache NetBeans (critical 9.8)
- [CVE-2018-17190](https://insights.sbomify.com/CVE-2018-17190/): Remote Code Execution in spark-core (critical 9.8)
- [CVE-2018-1719](https://insights.sbomify.com/CVE-2018-1719/): Weak cryptography in WebSphere Application Server (medium 5.9)
- [CVE-2018-17189](https://insights.sbomify.com/CVE-2018-17189/): Denial of service in Apache HTTP Server (medium 5.3)
- [CVE-2018-17188](https://insights.sbomify.com/CVE-2018-17188/): Privilege escalation in Apache CouchDB (high 7.2)
- [CVE-2018-17187](https://insights.sbomify.com/CVE-2018-17187/): Improper Certificate Validation in proton-j (high 7.4)
- [CVE-2018-17186](https://insights.sbomify.com/CVE-2018-17186/): Improper Restriction of XML External Entity Reference in org.apache.syncope:syncope-core (high 7.2)
- [CVE-2018-17184](https://insights.sbomify.com/CVE-2018-17184/): Improper Control of Interaction Frequency in Apache syncope-core (medium 5.4)
- [CVE-2018-17183](https://insights.sbomify.com/CVE-2018-17183/): Code injection in artifex:ghostscript (high 7.8)
- [CVE-2018-17182](https://insights.sbomify.com/CVE-2018-17182/): Use after free in canonical:ubuntu linux (high 7.8)
- [CVE-2018-17181](https://insights.sbomify.com/CVE-2018-17181/): SQL injection in open-emr:openemr (critical 9.8)
- [CVE-2018-17180](https://insights.sbomify.com/CVE-2018-17180/): Path traversal in open-emr:openemr (medium 5.3)
- [CVE-2018-1718](https://insights.sbomify.com/CVE-2018-1718/): Cross-site scripting in Sterling B2B Integrator (medium 5.4)
- [CVE-2018-17179](https://insights.sbomify.com/CVE-2018-17179/): SQL injection in open-emr:openemr (critical 9.8)
- [CVE-2018-17178](https://insights.sbomify.com/CVE-2018-17178/): Auth bypass in neatorobotics:botvac d3 connected firmware (medium 5.3)
- [CVE-2018-17177](https://insights.sbomify.com/CVE-2018-17177/): Hardcoded credentials in neatorobotics:botvac 85 firmware (low 2.4)
- [CVE-2018-17176](https://insights.sbomify.com/CVE-2018-17176/): Auth bypass in neatorobotics:botvac d4 connected firmware (high 7.5)
- [CVE-2018-17175](https://insights.sbomify.com/CVE-2018-17175/): In marshmallow library the schema "only" option treats an empty list as implying no "only" option (medium 5.3)
- [CVE-2018-17174](https://insights.sbomify.com/CVE-2018-17174/): Memory corruption in nmealib project:nmealib (critical 9.8)
- [CVE-2018-17173](https://insights.sbomify.com/CVE-2018-17173/): Code injection in lg:supersign cms (critical 9.8)
- [CVE-2018-17172](https://insights.sbomify.com/CVE-2018-17172/): Command injection in xerox:altalink b8045 firmware (critical 9.8)
- [CVE-2018-17170](https://insights.sbomify.com/CVE-2018-17170/): Code injection in teamwire:teamwire (high 8.1)
- [CVE-2018-17169](https://insights.sbomify.com/CVE-2018-17169/): XML external entity in printeron:printeron (high 7.7)
- [CVE-2018-17168](https://insights.sbomify.com/CVE-2018-17168/): Cross-site request forgery in printeron:printeron (medium 6.5)
- [CVE-2018-17167](https://insights.sbomify.com/CVE-2018-17167/): Cross-site scripting in printeron:printeron (medium 5.4)
- [CVE-2018-17161](https://insights.sbomify.com/CVE-2018-17161/): Memory corruption in FreeBSD (critical 9.8)
- [CVE-2018-17160](https://insights.sbomify.com/CVE-2018-17160/): Memory corruption in FreeBSD (critical 10.0)
- [CVE-2018-1716](https://insights.sbomify.com/CVE-2018-1716/): Cross-site scripting in WebSphere Portal (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/91/