CVE-2018-20770

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. There is Blind SQL Injection.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Feb 10, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-207719.8An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC783 CVE-2018-207727.2Frog CMS 0.9.5 allows PHP code execution via <?php to the admin/?/layout/edit/1 URI.CVE-2018-207737.2Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional <?php lines.CVE-2018-207745.4Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field.CVE-2018-207757.2admin/?/plugin/file_manager in Frog CMS 0.9.5 allows PHP code execution by creating a new .php file containing PHP code, and then visiting t CVE-2018-207767.5Frog CMS 0.9.5 provides a directory listing for a /public request.CVE-2018-207775.4Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field.CVE-2018-207786.1admin/?/plugin/file_manager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element.CVE-2018-207799.8Traq 3.7.1 allows SQL Injection via a tickets?search= URI.CVE-2018-207808.8Traq 3.7.1 allows admin/users/new CSRF to create an admin account (aka group_id=1).CVE-2018-207817.8In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daem CVE-2018-207827.5The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages.