CVE-2018-16097

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

LXCI for VMware versions prior to 5.5 and LXCI for Microsoft System Center versions prior to 3.5, allow an authenticated user to write to any system file due to insufficient sanitization during the upload of a certificate.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Lenovo	LXCI for VMware	>= unspecified, < 5.5
Lenovo	LXCI for Microsoft System Center	>= unspecified, < 3.5

References

https://support.lenovo.com/us/en/solutions/LEN-23800Patch, Vendor Advisory
https://support.lenovo.com/us/en/solutions/LEN-23800Patch, Vendor Advisory

Timeline

Published: Nov 30, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-160987.8In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which CVE-2018-16105.4IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows CVE-2018-161159.1Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in CVE-2018-161168.8SQL injection vulnerability in AccountStatus.jsp in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to e CVE-2018-161178.8A shell escape vulnerability in /webconsole/Controller in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attacker CVE-2018-161188.1A shell escape vulnerability in /webconsole/APIController in the API Configuration component of Sophos XG firewall 17.0.8 MR-8 allows remote CVE-2018-161197.2Stack-based buffer overflow in the httpd server of TP-Link WR1043nd (Firmware Version 3) allows remote attackers to execute arbitrary code v CVE-2018-16125.8IBM QRadar Incident Forensics (IBM QRadar SIEM 7.2, and 7.3) could allow a remote attacker to bypass authentication and obtain sensitive inf CVE-2018-161308.8System command injection in request_mitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary system commands via the CVE-2018-161317.5The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote atta CVE-2018-161328.6The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably l CVE-2018-161335.3Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.