CVE-2014-0786

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-200 CWE-310

Affected software

Vendor	Product	Versions
Ecava	IntegraXor	< 4.1.4410

References

http://www.integraxor.com/blog/category/security/vulnerability-note/Vendor Advisory
http://www.integraxor.com/blog/category/security/vulnerability-note/Vendor Advisory
http://www.integraxor.com/blog/category/security/vulnerability-note/Vendor Advisory
http://www.integraxor.com/blog/category/security/vulnerability-note/Vendor Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-14-091-01
https://www.cisa.gov/news-events/ics-advisories/icsa-14-224-01
http://ics-cert.us-cert.gov/advisories/ICSA-14-091-01Patch, US Government Resource
http://www.integraxor.com/blog/category/security/vulnerability-note/Vendor Advisory

Timeline

Published: May 1, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-078710.0Stack-based buffer overflow in WellinTech KingSCADA before 3.1.2.13 allows remote attackers to execute arbitrary code via a crafted packet.CVE-2014-07897.8Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS3 CVE-2014-07916.8Integer overflow in the license_read_scope_list function in libfreerdp/core/license.c in FreeRDP through 1.0.2 allows remote RDP servers to CVE-2014-07927.5Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vecto CVE-2014-07934.3Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for Joomla! allow remote CVE-2014-07944.3SQL injection vulnerability in the JV Comment (com_jvcomment) component before 3.0.3 for Joomla! allows remote authenticated users to execut CVE-2014-08025.8Directory traversal vulnerability in the aokitaka ZIP with Pass application 4.5.7 and earlier, and ZIP with Pass Pro application 6.3.8 and e CVE-2014-08035.8Directory traversal vulnerability in the tetra filer application 2.3.1 and earlier for Android 4.0.3, tetra filer free application 2.3.1 and CVE-2014-08045.8Directory traversal vulnerability in the CGENE Security File Manager Pro application 1.0.6 and earlier, and Security File Manager Trial appl CVE-2014-08055.8Directory traversal vulnerability in the NeoFiler application 5.4.3 and earlier, NeoFiler Free application 5.4.3 and earlier, and NeoFiler L CVE-2014-08064.3The Sleipnir Mobile application 2.12.1 and earlier and Sleipnir Mobile Black Edition application 2.12.1 and earlier for Android provide Geol CVE-2014-08076.4data/class/pages/shopping/LC_Page_Shopping_Deliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, allows remote attackers