CVE-2018-1437

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

IBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by an error related to multiple untrusted search path. A local attacker could exploit this vulnerability to DLL hijacking to execute arbitrary code on the system or cause the application to crash. IBM X-Force ID: 139565.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

No affected versions have been published.

Timeline

Published: Mar 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-143707.5In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/airpdcap.c CVE-2018-143717.5The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc paramete CVE-2018-143798.8MP4Atom::factory in mp4atom.cpp in MP4v2 2.0.0 incorrectly uses the MP4ItemAtom data type in a certain case where MP4DataAtom is required, w CVE-2018-14387.5IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5,CVE-2018-143806.1In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/Que CVE-2018-143816.1Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability.CVE-2018-143826.1InstantCMS 2.10.1 has /redirect?url= XSS.CVE-2018-143837.5The Transition Technologies "The Scheduler" app 5.1.3 for Jira allows XXE due to a weakly configured/parameterized XML parser. It was fixed CVE-2018-143844.8The Website Manager module in SEO Panel 3.13.0 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability, allowing remote CVE-2018-143878.8An issue was discovered in WonderCMS before 2.5.2. An attacker can create a new session on a web application and record the associated sessi CVE-2018-143885.4joyplus-cms 1.6.0 has XSS via the manager/admin_ajax.php can_search_device array parameter.CVE-2018-143899.8joyplus-cms 1.6.0 has SQL Injection via the manager/admin_ajax.php val parameter.