CVE-2018-1409

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could be tricked into executing an executable chosen by the attacker. IBM X-Force ID: 138708.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
IBM	Client Application Access	1.0.0.1; 1.0.1; 1.0.1.2
IBM	Notes	8.5.3.6; 8.5.1.5; 8.5.2.4; 9.0; 9.0.1.9

References

http://www.ibm.com/support/docview.wss?uid=swg22010766Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22010767Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/138708VDB Entry
http://www.ibm.com/support/docview.wss?uid=swg22010766Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22010767Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/138708VDB Entry

Timeline

Published: Feb 19, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-14107.8IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting CVE-2018-14117.8IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting CVE-2018-14135.4IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the W CVE-2018-14148.8IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which CVE-2018-14155.4IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in CVE-2018-14166.1IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaSc CVE-2018-14178.1Under certain circumstances, a flaw in the J9 JVM (IBM SDK, Java Technology Edition 7.1 and 8.0) allows untrusted code running under a secur CVE-2018-14188.8IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. IBM X-Force ID: 138824.CVE-2018-14195.3IBM WebSphere MQ 8.0 and 9.0, when configured to use a PAM module for authentication, could allow a user to cause a deadlock in the IBM MQ P CVE-2018-14206.5IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 resets access control settings to the out of the box configuration during Combined Cumulative Fi CVE-2018-14217.1IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML External Entity Injection (XXE) attack when p CVE-2018-14225.4IBM Jazz Foundation products (IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.5) are vulnerable to cross-site scrip