CVE-2018-17191

Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation is vulnerable for remote command execution (RCE). Using the nashorn script engine the environment of the javascript execution for the Proxy Auto-Configuration leaks privileged objects, that can be used to circumvent the execution limits. If a different script engine was used, no execution limits were in place. Both vectors allow remote code execution.

• http://www.securityfocus.com/bid/106352Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/d1c37966a316a326ab4ff4d4bc056322e8adcbe984e8145c0ecda7fa%40%3Cdev.netbeans.apache.org%3E
• http://www.securityfocus.com/bid/106352Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/d1c37966a316a326ab4ff4d4bc056322e8adcbe984e8145c0ecda7fa%40%3Cdev.netbeans.apache.org%3E

Published

Dec 31, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-17186An administrator with workflow definition entitlements can u…
• CVE-2018-17187The Apache Qpid Proton-J transport includes an optional wrap…
• CVE-2018-17188Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-…
• CVE-2018-17189In Apache HTTP server versions 2.4.37 and prior, by sending …5.3
• CVE-2018-1719IBM WebSphere Application Server 8.5 and 9.0 could provide w…5.9
• CVE-2018-17190In all versions of Apache Spark, its standalone resource man…
• CVE-2018-17192The X-Frame-Options headers were applied inconsistently on s…
• CVE-2018-17193The message-page.jsp error page used the value of the HTTP r…
• CVE-2018-17194When a client request to a cluster node was replicated to ot…
• CVE-2018-17195The template upload API endpoint accepted requests from diff…
• CVE-2018-17196In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is p…
• CVE-2018-17197A carefully crafted or corrupt sqlite file can cause an infi…