CVE-2018-1004

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Internet Explorer 9, Windows RT 8.1, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10.

• CWE-787

• http://www.securityfocus.com/bid/103657Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040655Third Party Advisory, VDB Entry
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1004Patch, Vendor Advisory
• http://www.securityfocus.com/bid/103657Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040655Third Party Advisory, VDB Entry
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1004Patch, Vendor Advisory

Published

Apr 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10029CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin…
• CVE-2018-1003A buffer overflow vulnerability exists in the Microsoft JET …
• CVE-2018-10030CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/sitepref…
• CVE-2018-10031CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/modulein…
• CVE-2018-10032CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin…
• CVE-2018-10033CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/si…
• CVE-2018-10048iScripts eSwap v2.4 has CSRF via "registration_settings.php"…
• CVE-2018-10049iScripts eSwap v2.4 has XSS via the "registration_settings.p…
• CVE-2018-1005An elevation of privilege vulnerability exists when Microsof…
• CVE-2018-10050iScripts eSwap v2.4 has SQL injection via the "registration_…
• CVE-2018-10051iScripts SupportDesk v4.3 has XSS via the staff/inteligentse…
• CVE-2018-10052iScripts SupportDesk v4.3 has XSS via the admin/inteligentse…