CVE-2018-16497

HighCVSS 7.8/10Last modified Aug 31, 2026

Description

In Versa Analytics, the cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server. If the job is run as the user root, there is a potential privilege escalation vulnerability. In this case, the job runs a script as root that is writable by users who are members of the versa group.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: May 26, 2021
Last modified: Aug 31, 2026
NVD status: Analyzed

Related CVEs from 2018

CVE-2018-164985.5In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within configuration files. These CVE-2018-164995.9In VOS compromised, an attacker at network endpoints can possibly view communications between an unsuspecting user and the service using man CVE-2018-16505.5IBM QRadar SIEM 7.2 and 7.3 uses hard-coded credentials which could allow an attacker to bypass the authentication configured by the adminis CVE-2018-165097.8An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess CVE-2018-165107.8An issue was discovered in Artifex Ghostscript before 9.24. Incorrect exec stack handling in the "CS" and "SC" PDF primitives could be used CVE-2018-165117.8An issue was discovered in Artifex Ghostscript before 9.24. A type confusion in "ztype" could be used by remote attackers able to supply cra CVE-2018-165137.8In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the setcolor function to CVE-2018-165144.7A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) and Edit Filter page (manage_filter_edit_page.ph CVE-2018-165158.8Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper tr CVE-2018-165166.1helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL.CVE-2018-165175.5asm/labels.c in Netwide Assembler (NASM) is prone to NULL Pointer Dereference, which allows the attacker to cause a denial of service via a CVE-2018-165189.8A directory traversal vulnerability with remote code execution in Prim'X Zed! FREE through 1.0 build 186 and Zed! Limited Edition through 6.