CVE-2018-14398

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue was discovered in Creme CRM 1.6.12. The value of the cancel button uses the content of the HTTP Referer header, and could be used to trick a user into visiting a fake login page in order to steal credentials.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Sep 7, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-143999.8libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php#.jpg URI CVE-2018-14405.4IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows CVE-2018-144017.5CopyData in AxmlParser.c in AXML Parser through 2018-01-04 has an out-of-bounds read.CVE-2018-144027.5axmldec 1.2.0 has an out-of-bounds write in the jitana::axml_parser::parse_start_namespace function in lib/jitana/util/axml_parser.cpp.CVE-2018-144039.8MP4NameFirstMatches in mp4util.cpp in MP4v2 2.0.0 mishandles substrings of atom names, leading to use of an inappropriate data type for asso CVE-2018-144046.5A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invali CVE-2018-14416.1IBM Application Performance Management - Response Time Monitoring Agent (IBM Monitoring 8.1.3 and 8.1.4) is vulnerable to cross-site scripti CVE-2018-144156.1An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=CVE-2018-144179.8A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particular, the snserv scrip CVE-2018-144189.8In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI.CVE-2018-144194.8MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page.CVE-2018-14428.8IBM Application Performance Management - Response Time Monitoring Agent (IBM Monitoring 8.1.4) is vulnerable to cross-site request forgery w