CVE-2018-1237

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent (LIA). This component is deployed on every server in the ScaleIO cluster and is used for central management of ScaleIO nodes. A remote malicious user, having network access to LIA, could potentially exploit this vulnerability to launch brute force guessing of user names and passwords of user accounts on the LIA.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-123708.8In Reader View SameSite cookie protections are not checked on exiting. This allows for a payload to be triggered when Reader View is exited CVE-2018-123718.8An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. T CVE-2018-123726.5Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward. This vulner CVE-2018-123736.5dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. This vulnerabili CVE-2018-123744.3Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vul CVE-2018-123758.8Memory safety bugs present in Firefox 61. Some of these bugs showed evidence of memory corruption and we presume that with enough effort tha CVE-2018-123769.8Memory safety bugs present in Firefox 61 and Firefox ESR 60.1. Some of these bugs showed evidence of memory corruption and we presume that w CVE-2018-123779.8A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is de CVE-2018-123789.8A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload CVE-2018-123797.8When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading CVE-2018-12387.5Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent (LIA). This component is u CVE-2018-123815.3Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message's mail columns are