CVE-2018-18999

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

WebAccess/SCADA, WebAccess/SCADA Version 8.3.2 installed on Windows 2008 R2 SP1. Lack of proper validation of user supplied input may allow an attacker to cause the overflow of a buffer on the stack.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-20 CWE-787

Affected software

Vendor	Product	Versions
n/a	WebAccess/SCADA	WebAccess/SCADA Version 8.3.2 installed on Windows 2008 R2 SP1

References

http://www.securityfocus.com/bid/106245Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-352-02Third Party Advisory, US Government Resource
https://www.tenable.com/security/research/tra-2018-45Third Party Advisory
http://www.securityfocus.com/bid/106245Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-352-02Third Party Advisory, US Government Resource
https://www.tenable.com/security/research/tra-2018-45Third Party Advisory

Timeline

Published: Dec 19, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-19005.4IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross-site scripting. This vulnerability allows u CVE-2018-190005.3LCDS Laquis SCADA prior to version 4.1.0.4150 allows an authentication bypass, which may allow an attacker access to sensitive data.CVE-2018-190014.3Philips HealthSuite Health Android App, all versions. The software uses simple encryption that is not strong enough for the level of protect CVE-2018-190027.8LCDS Laquis SCADA prior to version 4.1.0.4150 allows improper control of generation of code when opening a specially crafted project file, w CVE-2018-190037.5GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e Versions 03.03.28C to 05.02.04C, EX2100e All versions prior to v04.09.00C, EX2100e_Reg All ve CVE-2018-190043.3LCDS Laquis SCADA prior to version 4.1.0.4150 allows out of bounds read when opening a specially crafted project file, which may allow data CVE-2018-190057.8Cscape, Version 9.80.75.3 SP3 and prior. An improper input validation vulnerability has been identified that may be exploited by processing CVE-2018-190064.8OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where displ CVE-2018-190079.8In Geutebrueck GmbH E2 Camera Series versions prior to 1.12.0.25 the DDNS configuration (in the Network Configuration panel) is vulnerable t CVE-2018-190087.8The TextEditor 2.0 in ABB CP400 Panel Builder versions 2.0.7.05 and earlier contain a vulnerability in the file parser of the Text Editor wh CVE-2018-190097.8Pilz PNOZmulti Configurator prior to version 10.9 allows an authenticated attacker with local access to the system containing the PNOZmulti CVE-2018-19018.8IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to temporarily gain elevated privileges on the system, caused by