CVE-2018-5470

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an unquoted search path or element vulnerability that has been identified, which may allow an authorized local user to execute arbitrary code and escalate their level of privileges.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428 CWE-426

Affected software

Vendor	Product	Versions
Philips	Philips IntelliSpace Portal	8.0.x; 7.0.x

References

http://www.securityfocus.com/bid/103182Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02Third Party Advisory, US Government Resource
https://www.usa.philips.com/healthcare/about/customer-support/product-securityVendor Advisory
http://www.securityfocus.com/bid/103182Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02Third Party Advisory, US Government Resource
https://www.usa.philips.com/healthcare/about/customer-support/product-securityVendor Advisory

Timeline

Published: Mar 26, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-54715.9A Cleartext Transmission of Sensitive Information issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, a CVE-2018-54729.8Philips Intellispace Portal all versions 7.0.x and 8.0.x have an insecure windows permissions vulnerability that could allow an attacker to CVE-2018-54739.8An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in GE D60 Line Distance Relay devices runnin CVE-2018-54749.8Philips Intellispace Portal all versions 7.0.x and 8.0.x have an input validation vulnerability that could allow a remote attacker to execut CVE-2018-54759.8A Stack-based Buffer Overflow issue was discovered in GE D60 Line Distance Relay devices running firmware Version 7.11 and prior. Multiple s CVE-2018-54767.8A Stack-based Buffer Overflow issue was discovered in Delta Electronics Delta Industrial Automation DOPSoft, Version 4.00.01 or prior. Stack CVE-2018-54775.8An Information Exposure issue was discovered in ABB netCADOPS Web Application Version 3.4 and prior, netCADOPS Web Application Version 7.1 a CVE-2018-54786.1Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.CVE-2018-54796.1FoxSash ImgHosting 1.5 (according to footer information) is vulnerable to XSS attacks. The affected function is its search engine via the se CVE-2018-54817.4OnCommand Unified Manager for 7-Mode (core package) prior to 5.2.4 uses cookies that lack the secure attribute in certain circumstances maki CVE-2018-54825.3NetApp SnapCenter Server prior to 4.1 does not set the secure flag for a sensitive cookie in an HTTPS session which can allow the transmissi CVE-2018-54857.8NetApp OnCommand Unified Manager for Windows versions 7.2 through 7.3 are susceptible to a vulnerability which could lead to a privilege esc