CVE-2018-1903

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, and 6.0.0 could allow a user with restricted sudo access on a system to manipulate CD UNIX to gain full sudo access. IBM X-Force ID: 152532.

Metrics

CVSS 3.0 6.7/10CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
IBM	Sterling Connect:Direct for UNIX	4.2.0; 4.3.0; 6.0.0

References

http://www.ibm.com/support/docview.wss?uid=ibm10875386Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/152532VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10875386Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/152532VDB Entry, Vendor Advisory

Timeline

Published: Apr 10, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-190318.8A command injection vulnerability exists when the authorized user passes crafted parameter to background process in the router. This affects CVE-2018-190369.8An issue was discovered in several Bosch IP cameras for firmware versions 6.32 and higher. A malicious client could potentially succeed in t CVE-2018-190377.5On Virgin Media wireless router 3.0 hub devices, the web interface is vulnerable to denial of service. When POST requests are sent and keep CVE-2018-190396.5Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permission CVE-2018-19049.8IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through an administrativ CVE-2018-190405.3The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocat CVE-2018-190416.1The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax CVE-2018-190425.3The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to pa CVE-2018-190435.3The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory CVE-2018-190444.7keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This CVE-2018-190457.5keepalived 2.0.8 used mode 0666 when creating new temporary files upon a call to PrintData or PrintStats, potentially leaking sensitive info CVE-2018-190464.7keepalived 2.0.8 didn't check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats. If a lo