How severe is CVE-2018-4031?

This vulnerability has a severity rating of CRITICAL with a CVSS score of 9 out of 10.

What type of vulnerability is CVE-2018-4031?

This is classified as CWE-94, which is a common weakness in software security.

CVE-2018-4031 - CRITICAL Severity | CVSS 9

Vulnerability Description

An exploitable vulnerability exists in the safe browsing function of the CUJO Smart Firewall, version 7003. The flaw lies in the way the safe browsing function parses HTTP requests. The server hostname is extracted from captured HTTP/HTTPS requests and inserted as part of a Lua statement without prior sanitization, which results in arbitrary Lua script execution in the kernel. An attacker could send an HTTP request to exploit this vulnerability.

Related Vulnerabilities

CVE-2015-8351

CRITICAL

CVSS:9.0(Critical)

PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticated users to execute arbitrary PHP code vi...

CWE-942015

CVE-2015-8761

CRITICAL

CVSS:9.0(Critical)

The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import value sets" permission to execute arbitrary PHP code via th...

CWE-942015

CVE-2019-7610

CRITICAL

CVSS:9.0(Critical)

Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could sen...

CWE-942019

CVE-2020-15142

CRITICAL

CVSS:9.0(Critical)

In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitr...

CWE-942020

CVE-2020-9406

CRITICAL

CVSS:9.0(Critical)

IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service.

CWE-942020

CVE-2023-25953

CRITICAL

CVSS:9.0(Critical)

Code injection vulnerability in Drive Explorer for macOS versions 3.5.4 and earlier allows an attacker who can login to the client where the affected product is installed to inject arbitrary code whil...

CWE-942023