CVE-2014-0170

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Teiid before 8.4.3 and before 8.7 and Red Hat JBoss Data Virtualization 6.0.0 before patch 3 allows remote attackers to read arbitrary files via a crafted request to a REST endpoint, related to an XML External Entity (XXE) issue.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2014-1284.htmlVendor Advisory
http://secunia.com/advisories/61530
http://www.securitytracker.com/id/1030886
https://exchange.xforce.ibmcloud.com/vulnerabilities/96192
https://issues.jboss.org/browse/TEIID-2911Patch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-1284.htmlVendor Advisory
http://secunia.com/advisories/61530
http://www.securitytracker.com/id/1030886
https://exchange.xforce.ibmcloud.com/vulnerabilities/96192
https://issues.jboss.org/browse/TEIID-2911Patch, Vendor Advisory

Timeline

Published: Sep 30, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-01715.0XML external entity (XXE) vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 pat CVE-2014-01726.8Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.1 CVE-2014-01735.8The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4 CVE-2014-01744.3Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the CVE-2014-01759.8mcollective has a default password set at install CVE-2014-01764.3Cross-site scripting (XSS) vulnerability in application/panel_control in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remot CVE-2014-01773.6The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a tempor CVE-2014-01783.5Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration is enabled, does not p CVE-2014-01791.9libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and hang) via a crafted XML document co CVE-2014-01805.0The wait_for_task function in app/controllers/application_controller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 al CVE-2014-01812.1The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the op CVE-2014-01827.5Heap-based buffer overflow in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute ar