CVE-2018-12463

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An XML external entity (XXE) vulnerability in Fortify Software Security Center (SSC), version 17.1, 17.2, 18.1 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published: Jul 12, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-124649.8A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthen CVE-2018-124657.2An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote atta CVE-2018-124666.5openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.CVE-2018-124676.5Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:Ini CVE-2018-124687.2A vulnerability in the administration console of Micro Focus GroupWise prior to version 18.0.2 may allow a remote attacker authenticated as CVE-2018-124697.5Incorrect handling of an invalid value for an HTTP request parameter by Directory Server (aka Enterprise Server Administration web UI) in Mi CVE-2018-12477.1RSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External Entity (XXE) vulnerability. This could potenti CVE-2018-124709.8A SQL Injection in the RegistrationSharing module of SUSE Linux SMT allows remote attackers to cause execute arbitrary SQL statements. Affec CVE-2018-124718.1A External Entity Reference ('XXE') vulnerability in SUSE Linux SMT allows remote attackers to read data from the server or cause DoS by ref CVE-2018-124729.1A improper authentication using the HOST header in SUSE Linux SMT allows remote attackers to spoof a sibling server. Affected releases are S CVE-2018-124737.5A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause access files not in t CVE-2018-124749.8Improper input validation in obs-service-tar_scm of Open Build Service allows remote attackers to cause access and extract information outsi