CVE-2018-1240

Dell EMC ViPR Controller, versions after 3.0.0.38, contain an information exposure vulnerability in the VRRP. VRRP defaults to an insecure configuration in Linux's keepalived component which sends the cluster password in plaintext through multicast. A malicious user, having access to the vCloud subnet where ViPR is deployed, could potentially sniff the password and use it to take over the cluster's virtual IP and cause a denial of service on that ViPR Controller system.

• CWE-200

• http://seclists.org/fulldisclosure/2018/Apr/29Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2018/Apr/29Mailing List, Third Party Advisory

Published

Apr 18, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12393A potential vulnerability was found in 32-bit builds where a…
• CVE-2018-12395By rewriting the Host: request headers using the webRequest …
• CVE-2018-12396A vulnerability where a WebExtension can run content scripts…
• CVE-2018-12397A WebExtension can request access to local files without the…
• CVE-2018-12398By using the reflected URL in some special resource URIs, su…
• CVE-2018-12399When a new protocol handler is registered, the API accepts a…
• CVE-2018-12400In private browsing mode on Firefox for Android, favicons ar…
• CVE-2018-12401Some special resource URIs will cause a non-exploitable cras…
• CVE-2018-12402The internal WebBrowserPersist code does not use correct ori…
• CVE-2018-12403If a site is loaded over a HTTPS connection but loads a favi…
• CVE-2018-12404A cached side channel attack during handshakes using RSA enc…
• CVE-2018-12405Mozilla developers and community members reported memory saf…