# Vulnerabilities published in 2018


- [CVE-2018-17036](https://insights.sbomify.com/CVE-2018-17036/): Code injection in ucms project:ucms (critical 9.8)
- [CVE-2018-17035](https://insights.sbomify.com/CVE-2018-17035/): SQL injection in ucms project:ucms (critical 9.8)
- [CVE-2018-17034](https://insights.sbomify.com/CVE-2018-17034/): Cross-site scripting in ucms project:ucms (medium 6.1)
- [CVE-2018-17031](https://insights.sbomify.com/CVE-2018-17031/): Gogs XSS Vulnerability (medium 6.1)
- [CVE-2018-17030](https://insights.sbomify.com/CVE-2018-17030/): Code injection in bigtreecms:bigtree cms (high 7.5)
- [CVE-2018-17026](https://insights.sbomify.com/CVE-2018-17026/): Cross-site scripting in monstra:monstra (medium 4.8)
- [CVE-2018-17025](https://insights.sbomify.com/CVE-2018-17025/): Cross-site scripting in monstra:monstra (medium 6.1)
- [CVE-2018-17024](https://insights.sbomify.com/CVE-2018-17024/): Cross-site scripting in monstra:monstra (medium 4.8)
- [CVE-2018-17023](https://insights.sbomify.com/CVE-2018-17023/): Cross-site request forgery in asus:gt-ac5300 firmware (high 8.8)
- [CVE-2018-17022](https://insights.sbomify.com/CVE-2018-17022/): Memory corruption in asus:gt-ac5300 firmware (high 7.2)
- [CVE-2018-17021](https://insights.sbomify.com/CVE-2018-17021/): Cross-site scripting in asus:gt-ac5300 firmware (medium 6.1)
- [CVE-2018-17020](https://insights.sbomify.com/CVE-2018-17020/): Denial of service in asus:gt-ac5300 firmware (high 7.5)
- [CVE-2018-1702](https://insights.sbomify.com/CVE-2018-1702/): XML external entity in Platform Symphony (high 7.1)
- [CVE-2018-17019](https://insights.sbomify.com/CVE-2018-17019/): Denial of service in bro:bro (high 7.5)
- [CVE-2018-17018](https://insights.sbomify.com/CVE-2018-17018/): Denial of service in tp-link:tl-wr886n firmware (medium 6.5)
- [CVE-2018-17017](https://insights.sbomify.com/CVE-2018-17017/): Denial of service in tp-link:tl-wr886n firmware (medium 6.5)
- [CVE-2018-17016](https://insights.sbomify.com/CVE-2018-17016/): Denial of service in tp-link:tl-wr886n firmware (medium 6.5)
- [CVE-2018-17015](https://insights.sbomify.com/CVE-2018-17015/): Denial of service in tp-link:tl-wr886n firmware (medium 6.5)
- [CVE-2018-17014](https://insights.sbomify.com/CVE-2018-17014/): Denial of service in tp-link:tl-wr886n firmware (medium 6.5)
- [CVE-2018-17013](https://insights.sbomify.com/CVE-2018-17013/): Denial of service in tp-link:tl-wr886n firmware (medium 6.5)
- [CVE-2018-17012](https://insights.sbomify.com/CVE-2018-17012/): Denial of service in tp-link:tl-wr886n firmware (medium 6.5)
- [CVE-2018-17011](https://insights.sbomify.com/CVE-2018-17011/): Denial of service in tp-link:tl-wr886n firmware (medium 6.5)
- [CVE-2018-17010](https://insights.sbomify.com/CVE-2018-17010/): Denial of service in tp-link:tl-wr886n firmware (medium 6.5)
- [CVE-2018-1701](https://insights.sbomify.com/CVE-2018-1701/): Command injection in InfoSphere Information Server (high 8.5)
- [CVE-2018-17009](https://insights.sbomify.com/CVE-2018-17009/): Denial of service in tp-link:tl-wr886n firmware (medium 6.5)
- [CVE-2018-17008](https://insights.sbomify.com/CVE-2018-17008/): Denial of service in tp-link:tl-wr886n firmware (medium 6.5)
- [CVE-2018-17007](https://insights.sbomify.com/CVE-2018-17007/): Denial of service in tp-link:tl-wr886n firmware (medium 6.5)
- [CVE-2018-17006](https://insights.sbomify.com/CVE-2018-17006/): Denial of service in tp-link:tl-wr886n firmware (medium 6.5)
- [CVE-2018-17005](https://insights.sbomify.com/CVE-2018-17005/): Denial of service in tp-link:tl-wr886n firmware (medium 6.5)
- [CVE-2018-17004](https://insights.sbomify.com/CVE-2018-17004/): Denial of service in tp-link:tl-wr886n firmware (medium 6.5)
- [CVE-2018-17003](https://insights.sbomify.com/CVE-2018-17003/): Cross-site scripting in limesurvey:limesurvey (medium 6.1)
- [CVE-2018-17002](https://insights.sbomify.com/CVE-2018-17002/): Cross-site scripting in ricoh:mp 2001sp firmware (medium 6.1)
- [CVE-2018-17001](https://insights.sbomify.com/CVE-2018-17001/): Cross-site scripting in ricoh:sp 4510sf firmware (medium 6.1)
- [CVE-2018-17000](https://insights.sbomify.com/CVE-2018-17000/): Null dereference in canonical:ubuntu linux (medium 6.5)
- [CVE-2018-16999](https://insights.sbomify.com/CVE-2018-16999/): Memory corruption in nasm:netwide assembler (medium 5.5)
- [CVE-2018-16994](https://insights.sbomify.com/CVE-2018-16994/): Denial of service in phoenixcontact:axl f bk eth firmware (high 7.5)
- [CVE-2018-1699](https://insights.sbomify.com/CVE-2018-1699/): SQL injection in Maximo Asset Management (medium 6.3)
- [CVE-2018-16988](https://insights.sbomify.com/CVE-2018-16988/): Auth bypass in buffalo:open xdmod (critical 9.8)
- [CVE-2018-16987](https://insights.sbomify.com/CVE-2018-16987/): Information disclosure in squashtest:squash tm (high 7.2)
- [CVE-2018-16986](https://insights.sbomify.com/CVE-2018-16986/): Memory corruption in ti:ble-stack (high 8.8)
- [CVE-2018-16985](https://insights.sbomify.com/CVE-2018-16985/): Memory corruption in lizard project:lizard (high 7.5)
- [CVE-2018-16984](https://insights.sbomify.com/CVE-2018-16984/): Django allows unprivileged users to read the password hashes of arbitrary accounts (medium 4.9)
- [CVE-2018-16983](https://insights.sbomify.com/CVE-2018-16983/): Security feature bypass in noscript:noscript (critical 9.8)
- [CVE-2018-16982](https://insights.sbomify.com/CVE-2018-16982/): Open Chinese Convert subject to Denial of Service via Out-of-bounds Read (medium 5.5)
- [CVE-2018-16981](https://insights.sbomify.com/CVE-2018-16981/): Memory corruption in debian:debian linux (high 8.8)
- [CVE-2018-16980](https://insights.sbomify.com/CVE-2018-16980/): Cross-site scripting in dotcms:dotcms (medium 6.1)
- [CVE-2018-1698](https://insights.sbomify.com/CVE-2018-1698/): Information disclosure in Maximo Asset Management (medium 5.3)
- [CVE-2018-16979](https://insights.sbomify.com/CVE-2018-16979/): Other in monstra:monstra (medium 6.1)
- [CVE-2018-16978](https://insights.sbomify.com/CVE-2018-16978/): Cross-site scripting in monstra:monstra (medium 6.1)
- [CVE-2018-16977](https://insights.sbomify.com/CVE-2018-16977/): Information disclosure in monstra:monstra (medium 5.3)
- [CVE-2018-16976](https://insights.sbomify.com/CVE-2018-16976/): Race condition in gitolite:gitolite (high 8.1)
- [CVE-2018-16975](https://insights.sbomify.com/CVE-2018-16975/): Elefant CMS PHP Code Execution Vulnerability (critical 9.8)
- [CVE-2018-16974](https://insights.sbomify.com/CVE-2018-16974/): Elefant CMS Code Execution Vulnerability (critical 9.8)
- [CVE-2018-16971](https://insights.sbomify.com/CVE-2018-16971/): Missing authorization in wisetail:learning management system (medium 4.3)
- [CVE-2018-16970](https://insights.sbomify.com/CVE-2018-16970/): Missing authorization in wisetail:learning management system (medium 4.3)
- [CVE-2018-1697](https://insights.sbomify.com/CVE-2018-1697/): Information disclosure in Maximo Asset Management (medium 4.3)
- [CVE-2018-16969](https://insights.sbomify.com/CVE-2018-16969/): Information disclosure in citrix:sharefile storagezones controller (medium 4.3)
- [CVE-2018-16968](https://insights.sbomify.com/CVE-2018-16968/): Path traversal in citrix:sharefile storagezones controller (low 3.1)
- [CVE-2018-16967](https://insights.sbomify.com/CVE-2018-16967/): Cross-site scripting in filemanagerpro:file manager (medium 6.1)
- [CVE-2018-16966](https://insights.sbomify.com/CVE-2018-16966/): Cross-site request forgery in filemanagerpro:file manager (high 8.8)
- [CVE-2018-16965](https://insights.sbomify.com/CVE-2018-16965/): Cross-site scripting in zohocorp:manageengine supportcenter plus (medium 6.1)
- [CVE-2018-16962](https://insights.sbomify.com/CVE-2018-16962/): Privilege escalation in webroot:secureanywhere (high 7.8)
- [CVE-2018-16961](https://insights.sbomify.com/CVE-2018-16961/): Path traversal in buffalo:open xdmod (high 7.5)
- [CVE-2018-16960](https://insights.sbomify.com/CVE-2018-16960/): Cross-site scripting in buffalo:open xdmod (medium 6.1)
- [CVE-2018-16959](https://insights.sbomify.com/CVE-2018-16959/): Information disclosure in oracle:webcenter interaction (medium 5.3)
- [CVE-2018-16958](https://insights.sbomify.com/CVE-2018-16958/): Misconfiguration in oracle:webcenter interaction (medium 5.4)
- [CVE-2018-16957](https://insights.sbomify.com/CVE-2018-16957/): Hardcoded credentials in oracle:webcenter interaction (critical 9.8)
- [CVE-2018-16956](https://insights.sbomify.com/CVE-2018-16956/): Denial of service in oracle:webcenter interaction (medium 6.5)
- [CVE-2018-16955](https://insights.sbomify.com/CVE-2018-16955/): Cross-site scripting in oracle:webcenter interaction (medium 6.1)
- [CVE-2018-16954](https://insights.sbomify.com/CVE-2018-16954/): Open redirect in oracle:webcenter interaction (medium 6.1)
- [CVE-2018-16953](https://insights.sbomify.com/CVE-2018-16953/): Cross-site scripting in oracle:webcenter interaction (medium 6.1)
- [CVE-2018-16952](https://insights.sbomify.com/CVE-2018-16952/): Cross-site request forgery in oracle:webcenter interaction (high 8.8)
- [CVE-2018-16951](https://insights.sbomify.com/CVE-2018-16951/): Command injection in xunfeng project:xunfeng (high 8.0)
- [CVE-2018-16950](https://insights.sbomify.com/CVE-2018-16950/): Denial of service in inteno:dg400 firmware (medium 6.5)
- [CVE-2018-1695](https://insights.sbomify.com/CVE-2018-1695/): Auth bypass in WebSphere Application Server (high 7.3)
- [CVE-2018-16949](https://insights.sbomify.com/CVE-2018-16949/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2018-16948](https://insights.sbomify.com/CVE-2018-16948/): Information disclosure in debian:debian linux (high 7.5)
- [CVE-2018-16947](https://insights.sbomify.com/CVE-2018-16947/): Auth bypass in debian:debian linux (critical 9.8)
- [CVE-2018-16946](https://insights.sbomify.com/CVE-2018-16946/): Missing authorization in lg:lnb5110 firmware (high 7.5)
- [CVE-2018-1694](https://insights.sbomify.com/CVE-2018-1694/): Misconfiguration in Rational Collaborative Lifecycle Management (medium 5.9)
- [CVE-2018-1692](https://insights.sbomify.com/CVE-2018-1692/): Cross-site scripting in Rational Quality Manager (medium 5.4)
- [CVE-2018-1691](https://insights.sbomify.com/CVE-2018-1691/): Cross-site scripting in Rational Quality Manager (medium 5.4)
- [CVE-2018-1690](https://insights.sbomify.com/CVE-2018-1690/): Cross-site scripting in Rhapsody Model Manager (medium 5.4)
- [CVE-2018-16890](https://insights.sbomify.com/CVE-2018-16890/): Memory corruption in curl (medium 5.4)
- [CVE-2018-16889](https://insights.sbomify.com/CVE-2018-16889/): Information disclosure in ceph (medium 5.5)
- [CVE-2018-16888](https://insights.sbomify.com/CVE-2018-16888/): Privilege escalation in systemd (medium 4.4)
- [CVE-2018-16887](https://insights.sbomify.com/CVE-2018-16887/): katello Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2018-16886](https://insights.sbomify.com/CVE-2018-16886/): go.etcd.io/etcd Authentication Bypass (medium 6.8)
- [CVE-2018-16885](https://insights.sbomify.com/CVE-2018-16885/): Memory corruption in kernel (medium 4.7)
- [CVE-2018-16884](https://insights.sbomify.com/CVE-2018-16884/): Use after free in kernel: (medium 6.5)
- [CVE-2018-16883](https://insights.sbomify.com/CVE-2018-16883/): Information disclosure in sssd (low 2.5)
- [CVE-2018-16882](https://insights.sbomify.com/CVE-2018-16882/): Use after free in kernel: (medium 6.1)
- [CVE-2018-16881](https://insights.sbomify.com/CVE-2018-16881/): Integer overflow in rsyslog: (medium 5.3)
- [CVE-2018-16880](https://insights.sbomify.com/CVE-2018-16880/): Memory corruption in kernel (medium 5.9)
- [CVE-2018-1688](https://insights.sbomify.com/CVE-2018-1688/): Cross-site scripting in Rational Collaborative Lifecycle Management (medium 5.4)
- [CVE-2018-16879](https://insights.sbomify.com/CVE-2018-16879/): Misconfiguration in Tower (high 7.3)
- [CVE-2018-16878](https://insights.sbomify.com/CVE-2018-16878/): Denial of service in pacemaker (medium 6.2)
- [CVE-2018-16877](https://insights.sbomify.com/CVE-2018-16877/): Auth bypass in pacemaker (high 8.8)
- [CVE-2018-16876](https://insights.sbomify.com/CVE-2018-16876/): Ansible sensitive information disclosure (low 3.1)
- [CVE-2018-16875](https://insights.sbomify.com/CVE-2018-16875/): Denial of service in golang (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/93/