CVE-2018-4008

CRITICAL Year: 2018
CVSS v3 Score
9.3
Critical
CVSS v2 Score
7.2
High
Weakness Type
CWE-269
View all →

Vulnerability Description

An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the RunVpncScript command. The command takes a user-supplied script argument and executes it under root context. A user with local access can use this vulnerability to raise their privileges to root. An attacker would need local access to the machine to successfully exploit this bug.

Related Vulnerabilities

CVE-2020-27352

CRITICAL
CVSS:9.3(Critical)

When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and m...

CWE-2692020

CVE-2022-3405

CRITICAL
CVSS:9.3(Critical)

Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 2...

CWE-2692022

CVE-2024-36439

CRITICAL
CVSS:9.4(Critical)

Swissphone DiCal-RED 4009 devices allow a remote attacker to gain access to the administrative web interface via the device password's hash value, without knowing the actual device password.

CWE-2692024

CVE-2017-5142

CRITICAL
CVSS:9.1(Critical)

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user with low privileges is able to open and change the par...

CWE-2692017

CVE-2018-1000141

CRITICAL
CVSS:9.1(Critical)

I, Librarian version 4.9 and earlier contains an Incorrect Access Control vulnerability in ajaxdiscussion.php that can result in any users gaining unauthorized access (read, write and delete) to proje...

CWE-2692018

CVE-2018-13799

CRITICAL
CVSS:9.1(Critical)

A vulnerability has been identified in SIMATIC WinCC OA V3.14 and prior (All versions < V3.14-P021). Improper access control to a data point of the affected product could allow an unauthenticated remo...

CWE-2692018