CVE-2014-0468

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Vulnerability in fusionforge in the shipped Apache configuration, where the web server may execute scripts that the users would have uploaded in their raw SCM repositories (SVN, Git, Bzr...). This issue affects fusionforge: before 5.3+20140506.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Jun 26, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2014

CVE-2014-04696.8Stack-based buffer overflow in a certain Debian patch for xbuffy before 3.3.bl.3.dfsg-9 allows remote attackers to execute arbitrary code viCVE-2014-04707.2super.c in Super 3.30.0 does not check the return value of the setuid function when the -F flag is set, which allows local users to gain priCVE-2014-04715.0Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8 alloCVE-2014-04725.1The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 aCVE-2014-04735.0The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF tokeCVE-2014-047410.0The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.CVE-2014-04756.8Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass FCVE-2014-04763.7The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a CVE-2014-04775.0The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to cCVE-2014-04784.0APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse pCVE-2014-04796.8reportbug before 6.4.4+deb7u1 and 6.5.x before 6.5.0+nmu1 allows remote attackers to execute arbitrary commands via vectors related to compaCVE-2014-04805.8The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 d