CVE-2018-17983

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Oct 4, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-179847.8An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code executiCVE-2018-179855.5An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption problem caused CVE-2018-179868.8rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user.CVE-2018-179877.5The determineWinner function of a smart contract implementation for HashHeroes Tiles, an Ethereum game, uses a certain blockhash value in anCVE-2018-179889.8LayerBB 1.1.1 and 1.1.3 has SQL Injection via the search.php search_query parameter.CVE-2018-179895.4A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to CVE-2018-17995.5IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local unprivileged user to overwriCVE-2018-179908.8An issue was discovered on D-Link DSL-3782 devices with firmware 1.01. An OS command injection vulnerability in Acl.asp allows a remote authCVE-2018-179966.5LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_user/, and deleting CVE-2018-179976.1LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).CVE-2018-18004.7IBM Sterling B2B Integrator Standard Edition 5.2.6.0 and 6.2.6.1 could allow a local user to obtain highly sensitive information during a shCVE-2018-180045.3Incorrect Access Control in mod_inetd.cgi in VIVOTEK Network Camera Series products with firmware before XXXXXX-VVTK-0X09a allows remote att
CVE-2018-17983: Critical severity, CVSS 9.1 | Vulnix