CVE-2018-1240

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Dell EMC ViPR Controller, versions after 3.0.0.38, contain an information exposure vulnerability in the VRRP. VRRP defaults to an insecure configuration in Linux's keepalived component which sends the cluster password in plaintext through multicast. A malicious user, having access to the vCloud subnet where ViPR is deployed, could potentially sniff the password and use it to take over the cluster's virtual IP and cause a denial of service on that ViPR Controller system.

Metrics

CVSS 3.0 8.0/10CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Apr 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-124005.3In private browsing mode on Firefox for Android, favicons are cached in the cache/icons folder as they are in non-private mode. This allows CVE-2018-124017.5Some special resource URIs will cause a non-exploitable crash if loaded with optional parameters following a '?' in the parsed string. This CVE-2018-124026.5The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are lo CVE-2018-124035.3If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users. Thi CVE-2018-124045.9A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant o CVE-2018-124059.8Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some of these bugs showed e CVE-2018-124068.8Mozilla developers and community members reported memory safety bugs present in Firefox 63. Some of these bugs showed evidence of memory cor CVE-2018-124079.8A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with the CVE-2018-124087.5The BusinessWorks engine component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks, TIBCO ActiveMatrix BusinessWorks for z/Linux, CVE-2018-124096.1The SOAP Admin API component of TIBCO Software Inc.'s TIBCO Silver Fabric contains a vulnerability that may allow reflected cross-site scrip CVE-2018-12418.8Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, under certain conditions, may leak LDAP pa CVE-2018-124109.8The web server component of TIBCO Software Inc's Spotfire Statistics Services contains multiple vulnerabilities that may allow the remote ex