CVE-2014-10079

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hidden form value of the HTML source code, which is disclosed because of incorrect processing of an index.php/ trailing slash.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Feb 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-103746.5On Fitbit activity-tracker devices, certain addresses never change. According to the popets-2019-0036.pdf document, this leads to "permanent CVE-2014-103757.5handle_messages in eXtl_tls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header.CVE-2014-103769.8The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection.CVE-2014-103776.1The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.CVE-2014-103786.1The duplicate-post plugin before 2.6 for WordPress has XSS.CVE-2014-103799.8The duplicate-post plugin before 2.6 for WordPress has SQL injection.CVE-2014-103806.1The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.CVE-2014-103818.8The user-domain-whitelist plugin before 1.5 for WordPress has CSRF.CVE-2014-103824.3The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.CVE-2014-103839.8The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.CVE-2014-103849.8The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.CVE-2014-103856.1The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.