CVE-2018-9059

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code via a malicious login request to forum.ghp. NOTE: this may overlap CVE-2014-3791.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published
Apr 20, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-90626.8In some Lenovo ThinkPad products, one BIOS region is not properly included in the checks, allowing injection of arbitrary code.CVE-2018-90637.8MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerabiCVE-2018-90648.8In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the credCVE-2018-90657.5In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be aCVE-2018-90668.8In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additionaCVE-2018-90677.5The Lenovo Help Android app versions earlier than 6.1.2.0327 had insufficient access control for some functions which, if exploited, could hCVE-2018-90687.5The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. TCVE-2018-90695.9In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected agaCVE-2018-90706.4For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by presCVE-2018-90715.3Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current auCVE-2018-90726.5In versions prior to 5.5, LXCI for VMware allows an authenticated user to download any system file due to insufficient input sanitization duCVE-2018-90735.9Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of
CVE-2018-9059: Critical severity, CVSS 9.8 | Vulnix