CVE-2018-9078

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the ability to upload files to shares and this image was rendered in the browser in the device's origin instead of prompting to download the asset. The application does not prevent the user from uploading SVG images and returns these images within their origin. As a result, malicious users can upload SVG images that contain arbitrary JavaScript that is evaluated when the victim issues a request to download the file.

• CWE-79

• https://support.lenovo.com/us/en/solutions/LEN-24224Vendor Advisory
• https://support.lenovo.com/us/en/solutions/LEN-24224Vendor Advisory

Published

Sep 28, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-9072In versions prior to 5.5, LXCI for VMware allows an authenti…
• CVE-2018-9073Lenovo Chassis Management Module (CMM) prior to version 2.0.…
• CVE-2018-9074For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.…
• CVE-2018-9075For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.…
• CVE-2018-9076For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.…
• CVE-2018-9077For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.…
• CVE-2018-9079For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.…
• CVE-2018-9080For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.…
• CVE-2018-9081For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.…
• CVE-2018-9082For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.…
• CVE-2018-9083In System Management Module (SMM) versions prior to 1.06, th…
• CVE-2018-9084In System Management Module (SMM) versions prior to 1.06, if…