CVE-2018-1342

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A Vulnerability exists on Admin Console where an attacker can upload files to the Admin Console server, and potentially execute them. This impacts NetIQ Access Manager versions 4.3 and 4.4 as well as the Administrative console.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Micro Focus	NetIQ Access Manager, Administrative Console	4.3; 4.4

References

Timeline

Published: Jan 26, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-134207.5Google gperftools 2.7 has a memory leak in malloc_extension.cc, related to MallocExtension::Register and InitModule. NOTE: the software main CVE-2018-134219.8Fast C++ CSV Parser (aka fast-cpp-csv-parser) before 2018-07-06 has a heap-based buffer over-read in io::trim_chars in csv.h.CVE-2018-134226.1TCExam before 14.1.2 has XSS via an ff_ or xl_ field.CVE-2018-134236.1admin/themes/default/items/tag-form.php in Omeka before 2.6.1 allows XSS by adding or editing a tag.CVE-2018-13439.8PAM exposure enabling unauthenticated access to remote host CVE-2018-134336.1Boostnote v0.11.7 allows XSS during highlighting of Markdown text, as demonstrated by an onerror attribute of an IMG element.CVE-2018-134346.3An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The LAContext class for Biometric (TouchID) validation allows a CVE-2018-134357.0An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The Passcode feature allows authentication bypass via runtime m CVE-2018-134397.5WXPayUtil in WeChat Pay Java SDK allows XXE attacks involving a merchant notification URL.CVE-2018-13448.6Addresses potential communication downgrade attack in NetIQ iManager versions prior to 3.1 CVE-2018-134406.5The audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in modules/ModuleState.cpp, which allows an CVE-2018-134415.5qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a loca