CVE-2018-16716

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A path traversal vulnerability exists in viewcgi.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox, which may result in reading of arbitrary files (i.e., significant information disclosure) or file deletion via the nph-viewgif.cgi query string.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/grymer/CVE/blob/master/CVE-2018-16716.mdThird Party Advisory
https://github.com/grymer/CVE/blob/master/CVE-2018-16716.mdThird Party Advisory

Timeline

Published: May 2, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-167179.8A heap-based buffer overflow exists in nph-viewgif.cgi in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox.CVE-2018-167186.1An XSS vulnerability exists in wwwblast.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox via a crafted -z1 argument.CVE-2018-167197.8In Jingyun Antivirus v2.4.2.39, the driver file (hookbody.sys) allows local users to cause a denial of service (BSOD) or possibly have unspe CVE-2018-16726.3IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 may fail to set the correct user context in certain impersonation scenarios, which can allow a u CVE-2018-167207.8In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unsp CVE-2018-167217.8In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unsp CVE-2018-167227.8In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unsp CVE-2018-167237.8In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unsp CVE-2018-167249.8An issue is discovered in baijiacms V4. Blind SQL Injection exists via the order parameter in an index.php?act=index request.CVE-2018-167256.1An issue is discovered in baijiacms V4. XSS exists via the assets/weengine/components/zclip/ZeroClipboard.swf id parameter, aka "Non-standar CVE-2018-167265.4razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.CVE-2018-167275.4razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.