CVE-2018-0010
published 2018-01-10CVE-2018-0010: A vulnerability in the Juniper Networks Junos Space Security Director allows a user who does not have SSH access to a device to reuse the URL that was created…
PriorityP433medium6.5CVSS 3.0
AVNACLPRLUINSUCNIHAN
EPSS
0.61%
45.4th percentile
A vulnerability in the Juniper Networks Junos Space Security Director allows a user who does not have SSH access to a device to reuse the URL that was created for another user to perform SSH access. Affected releases are all versions of Junos Space Security Director prior to 17.2R1.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | junos_os | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| juniper | junos_space | — | — |
| linux | linux_kernel | >= 3.8.0 < 6.17.2 | 6.17.2 |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
f2fs: fix to do sanity check on node footer for non inode dnode
osv·2025-10-28
CVE-2025-40025 f2fs: fix to do sanity check on node footer for non inode dnode
f2fs: fix to do sanity check on node footer for non inode dnode
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on node footer for non inode dnode
As syzbot reported below:
------------[ cut here ]------------
kernel BUG at fs/f2fs/file.c:1243!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5354 Comm: syz.0.0 Not tainted 6.17.0-rc1-syzkaller-00211-g90d970cade8e #0 PREEMPT(full)
RIP: 0010:f2fs_truncate_hole+0x69e/0x6c0 fs/f2fs/file.c:1243
Call Trace:
f2fs_punch_hole+0x2db/0x330 fs/f2fs/file.c:1306
f2fs_fallocate+0x546/0x990 fs/f2fs/file.c:2018
vfs_fallocate+0x666/0x7e0 fs/open.c:342
ksys_fallocate fs/open.c:366 [inline]
__do_sys_fallocate fs/open.c:371 [inline]
__se_sys_fallocate fs/open.c:369 [inline]
__x64_sys_fallo
GHSA
GHSA-mqj9-7x6g-mr5p: A vulnerability in the Juniper Networks Junos Space Security Director allows a user who does not have SSH access to a device to reuse the URL that was
ghsa_unreviewed·2022-05-13
CVE-2018-0010 [MEDIUM] CWE-269 GHSA-mqj9-7x6g-mr5p: A vulnerability in the Juniper Networks Junos Space Security Director allows a user who does not have SSH access to a device to reuse the URL that was
A vulnerability in the Juniper Networks Junos Space Security Director allows a user who does not have SSH access to a device to reuse the URL that was created for another user to perform SSH access. Affected releases are all versions of Junos Space Security Director prior to 17.2R1.
Red Hat
kernel: netfs: Call `invalidate_cache` only if implemented
vendor_redhat·2025-04-03·CVSS 5.5
CVE-2025-22002 [MEDIUM] CWE-476 kernel: netfs: Call `invalidate_cache` only if implemented
kernel: netfs: Call `invalidate_cache` only if implemented
In the Linux kernel, the following vulnerability has been resolved:
netfs: Call `invalidate_cache` only if implemented
Many filesystems such as NFS and Ceph do not implement the
`invalidate_cache` method. On those filesystems, if writing to the
cache (`NETFS_WRITE_TO_CACHE`) fails for some reason, the kernel
crashes like this:
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 0 P4D 0
Oops: Oops: 0010 [#1] SMP PTI
CPU: 9 UID: 0 PID: 3380 Comm: kworker/u193:11 Not tainted 6.13.3-cm4all1-hp #437
Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 10/17/2018
Workqueue: events_unbound netfs_write_collection_work
Red Hat
kernel: fs/netfs/fscache_cookie: add missing "n_accesses" check
vendor_redhat·2024-09-04·CVSS 5.5
CVE-2024-45000 [MEDIUM] CWE-476 kernel: fs/netfs/fscache_cookie: add missing "n_accesses" check
kernel: fs/netfs/fscache_cookie: add missing "n_accesses" check
In the Linux kernel, the following vulnerability has been resolved:
fs/netfs/fscache_cookie: add missing "n_accesses" check
This fixes a NULL pointer dereference bug due to a data race which
looks like this:
BUG: kernel NULL pointer dereference, address: 0000000000000008
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] SMP PTI
CPU: 33 PID: 16573 Comm: kworker/u97:799 Not tainted 6.8.7-cm4all1-hp+ #43
Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 10/17/2018
Workqueue: events_unbound netfs_rreq_write_to_cache_work
RIP: 0010:cachefiles_prepare_write+0x30/0xa0
Code: 57 41 56 45 89 ce 41 55 49 89 cd 41 54 49 89 d4 55 53 48 89 fb 48 83 ec 08 48 8
Red Hat
kernel: hwmon: (nct6775) Fix crash in clear_caseopen
vendor_redhat·2024-06-20·CVSS 5.5
CVE-2022-48750 [MEDIUM] kernel: hwmon: (nct6775) Fix crash in clear_caseopen
kernel: hwmon: (nct6775) Fix crash in clear_caseopen
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (nct6775) Fix crash in clear_caseopen
Paweł Marciniak reports the following crash, observed when clearing
the chassis intrusion alarm.
BUG: kernel NULL pointer dereference, address: 0000000000000028
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 3 PID: 4815 Comm: bash Tainted: G S 5.16.2-200.fc35.x86_64 #1
Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./Z97 Extreme4, BIOS P2.60A 05/03/2018
RIP: 0010:clear_caseopen+0x5a/0x120 [nct6775]
Code: 68 70 e8 e9 32 b1 e3 85 c0 0f 85 d2 00 00 00 48 83 7c 24 ...
RSP: 0018:ffffabcb02803dd8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000
RDX: ffff8e8808192880 RSI: 0000000000000
Red Hat
kernel: drm/dp: Fix divide-by-zero regression on DP MST unplug with nouveau
vendor_redhat·2024-05-01·CVSS 5.5
CVE-2024-26941 [MEDIUM] kernel: drm/dp: Fix divide-by-zero regression on DP MST unplug with nouveau
kernel: drm/dp: Fix divide-by-zero regression on DP MST unplug with nouveau
In the Linux kernel, the following vulnerability has been resolved:
drm/dp: Fix divide-by-zero regression on DP MST unplug with nouveau
Fix a regression when using nouveau and unplugging a StarTech MSTDP122DP
DisplayPort 1.2 MST hub (the same regression does not appear when using
a Cable Matters DisplayPort 1.4 MST hub). Trace:
divide error: 0000 [#1] PREEMPT SMP PTI
CPU: 7 PID: 2962 Comm: Xorg Not tainted 6.8.0-rc3+ #744
Hardware name: Razer Blade/DANA_MB, BIOS 01.01 08/31/2018
RIP: 0010:drm_dp_bw_overhead+0xb4/0x110 [drm_display_helper]
Code: c6 b8 01 00 00 00 75 61 01 c6 41 0f af f3 41 0f af f1 c1 e1 04 48 63 c7 31 d2 89 ff 48 8b 5d f8 c9 48 0f af f1 48 8d 44 06 ff f7 f7 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c
Juniper
CVE-2018-0010: A vulnerability in the Juniper Networks Junos Space Security Director allows a user who does not have SSH access to a device to reuse the URL that was
vendor_juniper·2018-01-10·CVSS 6.5
CVE-2018-0010 [MEDIUM] CWE-269 CVE-2018-0010: A vulnerability in the Juniper Networks Junos Space Security Director allows a user who does not have SSH access to a device to reuse the URL that was
CVE-2018-0010: A vulnerability in the Juniper Networks Junos Space Security Director allows a user who does not have SSH access to a device to reuse the URL that was created for another user to perform SSH access. Affected releases are all versions of Junos Space Security Director prior to 17.2R1.
No detection rules found.
Exploit-DB
D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities
exploitdb·2018-10-05·CVSS 9.8
CVE-2018-17443 [CRITICAL] D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities
D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities
---
Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/
D-Link Central WiFiManager Software Controller Multiple Vulnerabilities
1. *Advisory Information*
Title: D-Link Central WiFiManager Software Controller Multiple
Vulnerabilities
Advisory ID: CORE-2018-0010
Advisory URL: http://www.coresecurity.com/advisories/d-link-central-wifimanager-software-controller-multiple-vulnerabilities
Date published: 2018-10-04
Date of last update: 2018-10-04
Vendors contacted: D-Link
Release mode: Coordinated release
2. *Vulnerability Information*
Class: Unrestricted Upload of File with Dangerous Type [CWE-434],
Improper Authorization [CWE-285], Improper Neutralization of Input
During Web Page Generation ('
Exploit-DB
BMC BladeLogic 8.3.00.64 - Remote Command Execution
exploitdb·2018-01-26·CVSS 7.5
CVE-2016-1543 [HIGH] BMC BladeLogic 8.3.00.64 - Remote Command Execution
BMC BladeLogic 8.3.00.64 - Remote Command Execution
---
# Exploit Title: BMC BladeLogic RSCD agent remote exec - XMLRPC version
# Filename: BMC_rexec.py
# Github: https://github.com/bao7uo/bmc_bladelogic
# Date: 2018-01-24
# Exploit Author: Paul Taylor / Foregenix Ltd
# Website: http://www.foregenix.com/blog
# Version: BMC RSCD agent 8.3.00.64
# CVE: CVE-2016-1542 (BMC-2015-0010), CVE-2016-1543 (BMC-2015-0011)
# Vendor Advisory: https://docs.bmc.com/docs/ServerAutomation/87/release-notes-and-notices/flashes/notification-of-critical-security-issue-in-bmc-server-automation-cve-2016-1542-cve-2016-1543
# Tested on: 8.3.00.64
#!/usr/bin/python
# BMC BladeLogic RSCD agent remote exec - XMLRPC version
# CVE: CVE-2016-1542 (BMC-2015-0010), CVE-2016-1543 (BMC-2015-0011)
# By Paul Taylor / Fore
2018-01-10
Published