CVE-2018-17494

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Virtual Keyboard Start Menu. By visiting the kiosk and pressing windows key twice, an attacker could exploit this vulnerability to close the program and launch other processes on the system.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
VisitorPass	eVisitorPass	1.5.5.2

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/149654Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/149654Third Party Advisory, VDB Entry

Timeline

Published: Mar 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-174957.8eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Virtual Keyboard Help Dialo CVE-2018-174967.8eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error while in kiosk mode. By visiting the CVE-2018-174977.8eVisitorPass contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the applicatio CVE-2018-174995.5Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing CVE-2018-17508.1IBM Security Key Lifecycle Manager 3.0 specifies permissions for a security-critical resource in a way that allows that resource to be read CVE-2018-175007.8Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing CVE-2018-175023.3The Receptionist for iPad could allow a local attacker to obtain sensitive information, caused by an error in the contact.json file. An atta CVE-2018-17517.5IBM Security Key Lifecycle Manager 3.0 through 3.0.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to de CVE-2018-17534.3IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 generates an error message that includes sensitive information about its environment, use CVE-2018-175329.8Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autolo CVE-2018-175336.1Teltonika RUT9XX routers with firmware before 00.05.01.1 are prone to cross-site scripting vulnerabilities in hotspotlogin.cgi due to insuff CVE-2018-175346.8Teltonika RUT9XX routers with firmware before 00.04.233 provide a root terminal on a serial interface without proper access control. This al