CVE-2018-10472

An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users (in certain configurations) to read arbitrary dom0 files via QMP live insertion of a CDROM, in conjunction with specifying the target file as the backing file of a snapshot.

• CWE-200

• http://www.securityfocus.com/bid/104002Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2018/10/msg00021.html
• https://security.gentoo.org/glsa/201810-06
• https://www.debian.org/security/2018/dsa-4201Third Party Advisory
• https://xenbits.xen.org/xsa/advisory-258.htmlMitigation, Vendor Advisory
• http://www.securityfocus.com/bid/104002Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2018/10/msg00021.html
• https://security.gentoo.org/glsa/201810-06
• https://www.debian.org/security/2018/dsa-4201Third Party Advisory
• https://xenbits.xen.org/xsa/advisory-258.htmlMitigation, Vendor Advisory

Published

Apr 27, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10466Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allow…
• CVE-2018-10468The transferFrom function of a smart contract implementation…
• CVE-2018-10469b3log Symphony (aka Sym) 2.6.0 allows remote attackers to up…
• CVE-2018-1047A flaw was found in Wildfly 9.x. A path traversal vulnerabil…
• CVE-2018-10470Little Snitch versions 4.0 to 4.0.6 use the SecStaticCodeChe…5.3
• CVE-2018-10471An issue was discovered in Xen through 4.10.x allowing x86 P…
• CVE-2018-10473This vulnerability allows remote attackers to execute arbitr…
• CVE-2018-10474This vulnerability allows remote attackers to execute arbitr…
• CVE-2018-10475This vulnerability allows remote attackers to disclose sensi…6.5
• CVE-2018-10476This vulnerability allows remote attackers to disclose sensi…6.5
• CVE-2018-10477This vulnerability allows remote attackers to execute arbitr…
• CVE-2018-10478This vulnerability allows remote attackers to disclose sensi…6.5