CVE-2018-16495

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In VOS user session identifier (authentication token) is issued to the browser prior to authentication but is not changed after the user successfully logs into the application. Failing to issue a new session ID following a successful login introduces the possibility for an attacker to set up a trap session on the device the victim is likely to login with.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-384

Affected software

No affected versions have been published.

Timeline

Published: May 26, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-164965.3In Versa Director, the un-authentication request found.CVE-2018-164977.8In Versa Analytics, the cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server. If the job CVE-2018-164985.5In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within configuration files. These CVE-2018-164995.9In VOS compromised, an attacker at network endpoints can possibly view communications between an unsuspecting user and the service using man CVE-2018-16505.5IBM QRadar SIEM 7.2 and 7.3 uses hard-coded credentials which could allow an attacker to bypass the authentication configured by the adminis CVE-2018-165097.8An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess CVE-2018-165107.8An issue was discovered in Artifex Ghostscript before 9.24. Incorrect exec stack handling in the "CS" and "SC" PDF primitives could be used CVE-2018-165117.8An issue was discovered in Artifex Ghostscript before 9.24. A type confusion in "ztype" could be used by remote attackers able to supply cra CVE-2018-165137.8In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the setcolor function to CVE-2018-165144.7A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) and Edit Filter page (manage_filter_edit_page.ph CVE-2018-165158.8Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper tr CVE-2018-165166.1helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL.