CVE-2018-9116

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to access local files and internal resources and potentially cause a Denial of Service.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published
Mar 29, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-91175.3WireMock before 2.16.0 contains a vulnerability that allows a remote unauthenticated attacker to access local files beyond the application dCVE-2018-91187.5exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a CVE-2018-91196.1An attacker with physical access to a BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4) can unlock the card, extract credit caCVE-2018-91205.4In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post.CVE-2018-91215.4In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment.CVE-2018-91225.4In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI.CVE-2018-91235.4In Crea8social 2018.2, there is Stored Cross-Site Scripting via a User Profile.CVE-2018-91269.8The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover databaCVE-2018-91279.8Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames wCVE-2018-91287.8DVD X Player Standard 5.5.3.9 has a Buffer Overflow via a crafted .plf file, a related issue to CVE-2007-3068.CVE-2018-91295.9ZyXEL ZyWALL/USG series devices have a Bleichenbacher vulnerability in their Internet Key Exchange (IKE) handshake implementation used for ICVE-2018-91306.1IBOS 4.4.3 has XSS via a company full name.