CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2014-2935
https://notcve.org/view.php?id=CVE-2014-2935
costview3/xmlrpc_server/xmlrpc.php in CostView in Caldera 9.20 allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP XMLRPC request. costview3/xmlrpc_server/xmlrpc.php en CostView en Caldera 9.20 permite a atacantes remotos ejecutar comandos arbitrarios a través de metacaracteres de shell en un elemento methodCall en una solicitud PHP XMLRPC. • http://www.kb.cert.org/vuls/id/693092 http://www.securityfocus.com/bid/67252 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2014-2936
https://notcve.org/view.php?id=CVE-2014-2936
The directory manager in Caldera 9.20 allows remote attackers to conduct variable-injection attacks in the global scope via (1) the maindir_hotfolder parameter to dirmng/index.php, or an unspecified parameter to (2) PPD/index.php, (3) dirmng/docmd.php, or (4) dirmng/param.php. El gestor de directorio en Caldera 9.20 permite a atacantes remotos realizar ataques de inyección variable en el ámbito global a través de (1) el parámetro maindir_hotfolder hacia dirmng/index.php, o un parámetro no especificado hacia (2) PPD/index.php, (3) dirmng/docmd.php o (4) dirmng/param.php. • http://www.kb.cert.org/vuls/id/693092 http://www.securityfocus.com/bid/67254 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2014-2933
https://notcve.org/view.php?id=CVE-2014-2933
Directory traversal vulnerability in dirmng/index.php in Caldera 9.20 allows remote attackers to access arbitrary directories via a crafted pathname. Vulnerabilidad de salto de directorio en dirmng/index.php en Caldera 9.20 permite a atacantes remotos acceder a directorios arbitrarios a través de un nombre de ruta manipulado. • http://www.kb.cert.org/vuls/id/693092 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 3CVE-2014-2934 – Caldera - '/costview2/jobs.php?tr' SQL Injection
https://notcve.org/view.php?id=CVE-2014-2934
Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the tr parameter to (1) costview2/jobs.php or (2) costview2/printers.php. Múltiples vulnerabilidades de inyección SQL en Caldera 9.20 permiten a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro tr hacia (1) costview2/jobs.php o (2) costview2/printers.php. • https://www.exploit-db.com/exploits/39173 https://www.exploit-db.com/exploits/39174 http://www.kb.cert.org/vuls/id/693092 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •