CVE-2014-2079

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

X File Explorer (aka xfe) might allow local users to bypass intended access restrictions and gain access to arbitrary files by leveraging failure to use directory masks when creating files on Samba and NFS shares.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2014/02/24/5Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/65748Third Party Advisory, VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739536Mailing List, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1069066Issue Tracking, Patch, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/91519Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2014/02/24/5Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/65748Third Party Advisory, VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739536Mailing List, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1069066Issue Tracking, Patch, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/91519Third Party Advisory, VDB Entry

Timeline

Published: Jul 16, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-20804.3Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to CVE-2014-20817.5Multiple SQL injection vulnerabilities in the login in web_reports/cgi-bin/InfoStation.cgi in Innovative vtls-Virtua before 2013.2.4 and 201 CVE-2014-20848.5Skybox View Appliances with ISO 6.3.33-2.14, 6.3.31-2.14, 6.4.42-2.54, 6.4.45-2.56, and 6.4.46-2.57 does not properly restrict access to the CVE-2014-20879.3Stack-based buffer overflow in the CDownloads_Deleted::UpdateDownload function in Downloads_Deleted.cpp in Free Download Manager 3.9.3 build CVE-2014-20886.5Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrary PHP code by using CVE-2014-20896.8ILIAS 4.4.1 allows remote attackers to execute arbitrary PHP code via an e-mail attachment that leads to creation of a .php file with a cert CVE-2014-20903.5Multiple cross-site scripting (XSS) vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web scr CVE-2014-20913.5Cross-site scripting (XSS) vulnerability in mods/_standard/forums/admin/forum_add.php in ATutor 2.1.1 allows remote authenticated administra CVE-2014-20924.3Cross-site scripting (XSS) vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers CVE-2014-20934.6Untrusted search path vulnerability in Catfish through 0.4.0.3 allows local users to gain privileges via a Trojan horse catfish.py in the cu CVE-2014-20944.6Untrusted search path vulnerability in Catfish through 0.4.0.3, when a Fedora package such as 0.4.0.2-2 is not used, allows local users to g CVE-2014-20954.6Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0, when a Fedora package such as 0.8.2-1 is not used, allows local users to