CVE-2018-7664

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in ClipBucket before 4.0.0 Release 4902. Any OS commands can be injected via shell metacharacters in the file_name parameter to /api/file_uploader.php or /actions/file_downloader.php.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Mar 5, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-76659.8An issue was discovered in ClipBucket before 4.0.0 Release 4902. A malicious file can be uploaded via the name parameter to actions/beats_up CVE-2018-76669.8An issue was discovered in ClipBucket before 4.0.0 Release 4902. SQL injection vulnerabilities exist in the actions/vote_channel.php channel CVE-2018-76679.8Adminer through 4.3.1 has SSRF via the server parameter.CVE-2018-76687.5TestLink through 1.9.16 allows remote attackers to read arbitrary attachments via a modified ID field to /lib/attachments/attachmentdownload CVE-2018-76697.5An issue was discovered in Sitecore Sitecore.NET 8.1 rev. 151207 Hotfix 141178-1 and above. The 'Log Viewer' application is vulnerable to a CVE-2018-76737.5The NetIQ Identity Manager communication channel, in versions prior to 4.7, is susceptible to a DoS attack.CVE-2018-76746.1The NetIQ Identity Manager user console, in versions prior to 4.7, is susceptible to URL redirection.CVE-2018-76755.3In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. After performing some tasks within Sentinel the u CVE-2018-76765.9The NetIQ Identity Manager, in versions prior to 4.7, userapp with log / trace enabled may leak sensitive information.CVE-2018-76778.8A CSRF exposure exists in NetIQ Access Manager (NAM) 4.4 Identity Server component.CVE-2018-76784.8A cross site scripting vulnerability exist in the Administration Console in NetIQ Access Manager (NAM) 4.3 and 4.4.CVE-2018-76799.8Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories