CVE-2014-2294

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the owa_event parameter to queue.php.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://karmainsecurity.com/KIS-2014-03Third Party Advisory
http://www.openwebanalytics.com/?p=388Patch, Release Notes, Vendor Advisory
https://secuniaresearch.flexerasoftware.com/advisories/56999Permissions Required
https://secuniaresearch.flexerasoftware.com/secunia_research/2014-3/Third Party Advisory
https://www.securityfocus.com/bid/66076Third Party Advisory, VDB Entry
http://karmainsecurity.com/KIS-2014-03Third Party Advisory
http://www.openwebanalytics.com/?p=388Patch, Release Notes, Vendor Advisory
https://secuniaresearch.flexerasoftware.com/advisories/56999Permissions Required
https://secuniaresearch.flexerasoftware.com/secunia_research/2014-3/Third Party Advisory
https://www.securityfocus.com/bid/66076Third Party Advisory, VDB Entry

Timeline

Published: Apr 17, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-22968.8XML external entity (XXE) vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server before 3.4.12.1 and 3.5.x before 3.5.2 CVE-2014-22976.1Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote CVE-2014-22999.3Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 all CVE-2014-23015.0OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive metadata via the inf operations (op=inf) to an object in pub/bscw.cgi CVE-2014-23029.8The installer script in webEdition CMS before 6.2.7-s1 and 6.3.x before 6.3.8-s1 allows remote attackers to conduct PHP Object Injection att CVE-2014-23037.5Multiple SQL injection vulnerabilities in the file browser component (we_fs.php) in webEdition CMS before 6.2.7-s1.2 and 6.3.x through 6.3.8 CVE-2014-23047.5A vulnerability in version 0.90 of the Open Floodlight SDN controller software could result in a denial of service attack and crashing of th CVE-2014-23096.1The ip6_route_add function in net/ipv6/route.c in the Linux kernel through 3.13.6 does not properly count the addition of routes, which allo CVE-2014-23105.0The AgentX subagent in Net-SNMP before 5.4.4 allows remote attackers to cause a denial of service (hang) by sending a multi-object request w CVE-2014-23117.5SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL comman CVE-2014-23125.5The main function in android_main.cpp in thermald allows local users to write to arbitrary files via a symlink attack on /tmp/thermald.pid.CVE-2014-23134.3Directory traversal vulnerability in the Importers plugin in Atlassian JIRA before 6.0.5 allows remote attackers to create arbitrary files v