CVE-2018-0664

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability in NoMachine App for Android 5.0.63 and earlier allows attackers to alter environment variables via unspecified vectors.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
NoMachine S.a r.l.NoMachine App for Android5.0.63 and earlier

References

Timeline

Published
Sep 4, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-06656.8Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlieCVE-2018-06666.8Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlieCVE-2018-06677.8Untrusted search path vulnerability in Installer of INplc SDK Express 3.08 and earlier and Installer of INplc SDK Pro+ 3.08 and earlier alloCVE-2018-06689.8Buffer overflow in INplc-RT 3.08 and earlier allows remote attackers to cause denial-of-service (DoS) condition that may result in executingCVE-2018-06699.8INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant trCVE-2018-06709.8INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant trCVE-2018-06716.7Privilege escalation vulnerability in INplc-RT 3.08 and earlier allows an attacker with administrator rights to execute arbitrary code on thCVE-2018-06726.1Cross-site scripting vulnerability in Movable Type versions prior to Ver. 6.3.1 allows remote attackers to inject arbitrary web script or HTCVE-2018-06738.1Directory traversal vulnerability in Cybozu Garoon 3.5.0 to 4.6.3 allows authenticated attackers to read arbitrary files via unspecified vecCVE-2018-06747.8AttacheCase ver.2.8.4.0 and earlier allows an arbitrary script execution via unspecified vectors.CVE-2018-06757.8AttacheCase ver.3.3.0.0 and earlier allows an arbitrary script execution via unspecified vectors.CVE-2018-06768.8BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to bypass authentication to access to the manage
CVE-2018-0664: Critical severity, CVSS 9.8 | Vulnix