CVE-2018-16494

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In VOS and overly permissive "umask" may allow for authorized users of the server to gain unauthorized access through insecure file permissions that can result in an arbitrary read, write, or execution of newly created files and directories. Insecure umask setting was present throughout the Versa servers.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-377 CWE-668

Affected software

No affected versions have been published.

Timeline

Published: May 26, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-164958.8In VOS user session identifier (authentication token) is issued to the browser prior to authentication but is not changed after the user suc CVE-2018-164965.3In Versa Director, the un-authentication request found.CVE-2018-164977.8In Versa Analytics, the cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server. If the job CVE-2018-164985.5In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within configuration files. These CVE-2018-164995.9In VOS compromised, an attacker at network endpoints can possibly view communications between an unsuspecting user and the service using man CVE-2018-16505.5IBM QRadar SIEM 7.2 and 7.3 uses hard-coded credentials which could allow an attacker to bypass the authentication configured by the adminis CVE-2018-165097.8An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess CVE-2018-165107.8An issue was discovered in Artifex Ghostscript before 9.24. Incorrect exec stack handling in the "CS" and "SC" PDF primitives could be used CVE-2018-165117.8An issue was discovered in Artifex Ghostscript before 9.24. A type confusion in "ztype" could be used by remote attackers able to supply cra CVE-2018-165137.8In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the setcolor function to CVE-2018-165144.7A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) and Edit Filter page (manage_filter_edit_page.ph CVE-2018-165158.8Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper tr