CVE-2018-20221

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Secure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code execution via deserialization of untrusted user input from an authenticated user. The executed code will run as the IIS Application Pool that is running the application.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Mar 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-202229.8XXE issue in Airsonic before 10.1.2 during parse.CVE-2018-202257.8An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended CVE-2018-202267.2An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.to CVE-2018-202277.5RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive.CVE-2018-202288.0Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF.CVE-2018-202297.5GitLab Community and Enterprise Edition before 11.3.14, 11.4.x before 11.4.12, and 11.5.x before 11.5.5 allows Directory Traversal.CVE-2018-202307.8An issue was discovered in PSPP 1.2.0. There is a heap-based buffer overflow at the function read_bytes_internal in utilities/pspp-dump-sav.CVE-2018-202318.8Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA CVE-2018-202325.4The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inj CVE-2018-202336.5The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrato CVE-2018-202348.8There was an argument injection vulnerability in Atlassian Sourcetree for macOS from version 1.2 before version 3.1.1 via filenames in Mercu CVE-2018-202358.8There was an argument injection vulnerability in Atlassian Sourcetree for Windows from version 0.5a before version 3.0.15 via filenames in M