CVE-2018-16792

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attacker to exfiltrate data.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published
Dec 5, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-167938.6Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username parameter in /owa/auth/logCVE-2018-167948.6Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parCVE-2018-167958.8OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as demonstrated by use of interface/super/manCVE-2018-167968.8HiScout GRC Suite before 3.1.5 allows Unrestricted Upload of Files with Dangerous Types.CVE-2018-167977.8A heap-based buffer overflow in PotPlayerMini.exe in PotPlayer 1.7.8556 allows remote attackers to execute arbitrary code via a .wav file wiCVE-2018-16807.5IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not require that users should have strong passwords by default, which CVE-2018-168027.8An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during eCVE-2018-168039.8In CIMTechniques CIMScan 6.x through 6.2, the SOAP WSDL parser allows attackers to execute SQL code.CVE-2018-168046.1An issue was discovered in UCMS 1.4.6. There is XSS in the title bar, as demonstrated by a do=list request.CVE-2018-168054.8In b3log Solo 2.9.3, XSS in the Input page under the Publish Articles menu, with an ID of linkAddress stored in the link JSON field, allows CVE-2018-168066.5A Pektron Passive Keyless Entry and Start (PKES) system, as used on the Tesla Model S and possibly other vehicles, relies on the DST40 cipheCVE-2018-168077.5In Bro through 2.5.5, there is a memory leak potentially leading to DoS in scripts/base/protocols/krb/main.bro in the Kerberos protocol pars
CVE-2018-16792: Critical severity, CVSS 9.1 | Vulnix