CVE-2018-1292

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, a hacker could inject SQL to read/update data for which he doesn't have authorization for by way of the 'reportName' parameter.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Apr 20, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-129207.5Brickstream 2300 devices allow remote attackers to obtain potentially sensitive information via a direct request for the basic.html#ipsettin CVE-2018-129217.5Electro Industries GaugeTech Nexus devices allow remote attackers to obtain potentially sensitive information via a direct request for the m CVE-2018-129227.5Emerson Liebert IntelliSlot Web Card devices allow remote attackers to reconfigure access control via the config/configUser.htm or config/co CVE-2018-129237.5BWS Systems HA-Bridge devices allow remote attackers to obtain potentially sensitive information via a direct request for the #!/system URI.CVE-2018-129249.8Sollae Serial-Ethernet-Module and Remote-I/O-Device-Server devices have a default password of sollae for the TELNET service.CVE-2018-129259.8Baseon Lantronix MSS devices do not require a password for TELNET access.CVE-2018-129267.5Pharos Controls devices allow remote attackers to obtain potentially sensitive information via a direct request for the default/index.lsp or CVE-2018-129277.5Northern Electric & Power (NEP) inverter devices allow remote attackers to obtain potentially sensitive information via a direct request for CVE-2018-129285.5In the Linux kernel 4.15.0, a NULL pointer dereference was discovered in hfs_ext_read_extent in hfs.ko. This can occur during a mount of a c CVE-2018-129295.5ntfs_read_locked_inode in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a use-after-free read and pos CVE-2018-129307.8ntfs_end_buffer_async_read in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-boun CVE-2018-129317.8ntfs_attr_find in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and