CVE-2018-10286

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS admin credentials and the PostgreSQL database credentials to logged-in users via the responses to certain HTTP POST requests. In order to be able to see the credentials in cleartext, an attacker needs to be authenticated.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/berkgoksel/fde102503c457c0344e2e53b7971437aThird Party Advisory
https://www.exploit-db.com/exploits/44515/Third Party Advisory, VDB Entry
https://gist.github.com/berkgoksel/fde102503c457c0344e2e53b7971437aThird Party Advisory
https://www.exploit-db.com/exploits/44515/Third Party Advisory, VDB Entry

Timeline

Published: Apr 22, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-102895.5In MuPDF 1.13.0, there is an infinite loop in the fz_skip_space function of the pdf/pdf-xref.c file. A remote adversary could leverage this CVE-2018-10297.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "CVE-2018-102946.1Flexense DiskBoss Enterprise v7.4.28 to v9.1.16 has XSS.CVE-2018-102958.8ChemCMS v1.0.6 has CSRF by using public/admin/user/addpost.html to add an administrator account.CVE-2018-102966.1MiniCMS V1.10 has XSS via the mc-admin/post-edit.php title parameter.CVE-2018-102975.4Discuz! DiscuzX through X3.4 has stored XSS via the portal.php?mod=portalcp&ac=article URI, related to mishandling of IMG elements associate CVE-2018-102985.4Discuz! DiscuzX through X3.4 has reflected XSS via forum.php?mod=post&action=newthread because data/template/1_diy_portal_view.tpl.php does CVE-2018-102997.5An integer overflow in the batchTransfer function of a smart contract implementation for Beauty Ecosystem Coin (BEC), the Ethereum ERC20 tok CVE-2018-10308.8A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka CVE-2018-103006.1Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to in CVE-2018-103016.1Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attacke CVE-2018-103027.8A use-after-free in Foxit Reader before 9.1 and PhantomPDF before 9.1 allows remote attackers to execute arbitrary code, aka iDefense ID V-j