CVE-2018-17489

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

EasyLobby Solo could allow a local attacker to obtain sensitive information, caused by the storing of the social security number in plaintext. By visiting the kiosk and viewing the Visitor table of the database, an attacker could exploit this vulnerability to view stored social security numbers.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

VendorProductVersions
HID GlobalEasyLobby Solo11.0.4563

References

Timeline

Published
Mar 21, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-17496.5IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attackers to bypass applicCVE-2018-174907.1EasyLobby Solo is vulnerable to a denial of service. By visiting the kiosk and accessing the task manager, a local attacker could exploit thCVE-2018-174917.8EasyLobby Solo could allow a local attacker to gain elevated privileges on the system. By visiting the kiosk and typing "esc" to exit the prCVE-2018-174927.8EasyLobby Solo contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the applicatCVE-2018-174937.8eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Fullscreen button. By visitCVE-2018-174947.8eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Virtual Keyboard Start MenuCVE-2018-174957.8eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Virtual Keyboard Help DialoCVE-2018-174967.8eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error while in kiosk mode. By visiting theCVE-2018-174977.8eVisitorPass contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the applicatioCVE-2018-174995.5Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storingCVE-2018-17508.1IBM Security Key Lifecycle Manager 3.0 specifies permissions for a security-critical resource in a way that allows that resource to be read CVE-2018-175007.8Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing