CVE-2018-4031

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

An exploitable vulnerability exists in the safe browsing function of the CUJO Smart Firewall, version 7003. The flaw lies in the way the safe browsing function parses HTTP requests. The server hostname is extracted from captured HTTP/HTTPS requests and inserted as part of a Lua statement without prior sanitization, which results in arbitrary Lua script execution in the kernel. An attacker could send an HTTP request to exploit this vulnerability.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Oct 31, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-40325.5An exploitable privilege escalation vulnerability exists in the way the CleanMyMac X software improperly validates inputs. An attacker with CVE-2018-40335.5The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with loca CVE-2018-40345.5The CleanMyMac X software contains an exploitable privilege escalation vulnerability that exists due to improper input validation. An attack CVE-2018-40355.5The CleanMyMac X software contains an exploitable privilege escalation vulnerability that exists due to improper input validation. An attack CVE-2018-40365.5The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with loca CVE-2018-40375.5The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with loca CVE-2018-40387.8An exploitable arbitrary write vulnerability exists in the open document format parser of the Atlantis Word Processor, version 3.2.7.2, whil CVE-2018-40397.8An exploitable out-of-bounds write vulnerability exists in the PNG implementation of Atlantis Word Processor, version 3.2.7.2. This can allo CVE-2018-40407.8An exploitable uninitialized pointer vulnerability exists in the rich text format parser of Atlantis Word Processor, version 3.2.7.2. A spec CVE-2018-40415.5An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input valida CVE-2018-40425.5An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input valida CVE-2018-40435.5An exploitable privilege escalation vulnerability exists in the Clean My Mac X, version 4.04, helper service due to improper input validatio