CVE-2018-5204

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

ML Report version Between 2.00.000.0000 and 2.18.628.5980 contains a vulnerability that could allow remote attacker to download and execute remote arbitrary file by setting the arguments to the activex method. this can be leveraged for code execution.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Dec 28, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-52057.5When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string.CVE-2018-52069.8When the channel topic is set without specifying a sender, Irssi before 1.0.6 may dereference a NULL pointer.CVE-2018-52077.5When using an incomplete variable argument, Irssi before 1.0.6 may access data beyond the end of the string.CVE-2018-52089.8In Irssi before 1.0.6, a calculation error in the completion code could cause a heap buffer overflow when completing certain strings.CVE-2018-52108.1On Samsung mobile devices with N(7.x) software and Exynos chipsets, attackers can conduct a Trustlet stack overflow attack for arbitrary TEECVE-2018-52119.8PHP Melody version 2.7.1 suffer from SQL Injection Time-based attack on the page ajax.php with the parameter playlist.CVE-2018-52125.4The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an editCVE-2018-52135.4The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit actionCVE-2018-52145.4The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via the al2fb_facebook_id parameter to wp-admin/profile.php.CVE-2018-52155.4Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title parameter.CVE-2018-52165.4Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content parameter to an admin/pages/*/edit resource.CVE-2018-52177.8In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie
CVE-2018-5204: Critical severity, CVSS 9.8 | Vulnix