CVE-2018-1447

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to ensure the new password is stored more securely. Products should encourage customers to take this step as a high priority action. IBM X-Force ID: 139972.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-916

Affected software

No affected versions have been published.

Timeline

Published
Apr 4, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-144707.5The Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2().CVE-2018-144716.5dwg_obj_block_control_get_block_headers in dwg_api.c in GNU LibreDWG 0.5.1048 allows remote attackers to cause a denial of service (NULL poiCVE-2018-144727.2An issue was discovered in WUZHI CMS 4.1.0. The vulnerable file is coreframe/app/order/admin/goods.php. The $keywords parameter is taken dirCVE-2018-144739.1OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities. This issue can be exploited by an attacCVE-2018-144746.1views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup.CVE-2018-144766.1GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation.CVE-2018-144786.1ecard.php in Coppermine Photo Gallery (CPG) 1.5.46 has XSS via the sender_name, recipient_email, greetings, or recipient_name parameter.CVE-2018-14487.1IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) contains a vulnerability that could allow a locaCVE-2018-144816.1Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280.CVE-2018-144859.8BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.CVE-2018-144866.1DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML.CVE-2018-14495.5IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a loca
CVE-2018-1447: High severity, CVSS 8.1 | Vulnix