CVE-2018-7259

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The FSX / P3Dv4 installer 2.0.1.231 for Flight Sim Labs A320-X sends a user's Google account credentials to http://installLog.flightsimlabs.com/LogHandler3.ashx if a pirated serial number has been entered, which allows remote attackers to obtain sensitive information, e.g., by sniffing the network for cleartext HTTP traffic. This behavior was removed in 2.0.1.232.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published
Feb 20, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-72605.4Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arCVE-2018-72615.4There are multiple Persistent XSS vulnerabilities in Radiant CMS 1.1.4. They affect Personal Preferences (Name and Username) and ConfiguratiCVE-2018-72627.5In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP hCVE-2018-72639.8The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denial of service (SIGABRTCVE-2018-72649.8The Pictview image processing library embedded in the ActivePDF toolkit through 2018.1.0.18321 is prone to multiple out of bounds write and CVE-2018-72656.1Shimmie 2 2.6.0 allows an attacker to upload a crafted SVG file that enables stored XSS.CVE-2018-72685.5MagniComp SysInfo before 10-H81, as shipped with BMC BladeLogic Automation and other products, contains an information exposure vulnerabilitCVE-2018-72699.8The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attaCVE-2018-72718.1An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/config_db.php configuration file fiCVE-2018-72726.5The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information bCVE-2018-72735.5In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls withCVE-2018-72746.1Yab Quarx through 2.4.3 is prone to multiple persistent cross-site scripting vulnerabilities: Blog (Title), FAQ (Question), Pages (Title), W
CVE-2018-7259: Critical severity, CVSS 9.8 | Vulnix