CVE-2014-2727

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Feb 19, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2014

CVE-2014-27293.5Cross-site scripting (XSS) vulnerability in content.aspx in Ektron CMS 8.7 before 8.7.0.055 allows remote authenticated users to inject arbiCVE-2014-27305.0The XML parser in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013, and Office for Mac 2011, does not properly detect recursion during CVE-2014-27319.3Multiple unspecified vulnerabilities in the integrated web server in Siemens SINEMA Server before 12 SP1 allow remote attackers to execute aCVE-2014-27325.0Multiple directory traversal vulnerabilities in the integrated web server in Siemens SINEMA Server before 12 SP1 allow remote attackers to aCVE-2014-27335.0Siemens SINEMA Server before 12 SP1 allows remote attackers to cause a denial of service (web-interface outage) via crafted HTTP requests toCVE-2014-27345.8The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attacCVE-2014-27355.8WinSCP before 5.5.3, when FTP with TLS is used, does not verify that the server hostname matches a domain name in the subject's Common Name CVE-2014-27367.5Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the (1)CVE-2014-27377.5SQL injection vulnerability in the get_active_session function in the KTAPI_UserSession class in webservice/clienttools/services/mdownload.pCVE-2014-27394.6The cma_req_handler function in drivers/infiniband/core/cma.c in the Linux kernel 3.14.x through 3.14.1 attempts to resolve an RDMA over ConCVE-2014-27417.8nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements,CVE-2014-27427.8Isode M-Link before 16.0v7 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a de
CVE-2014-2727: Critical severity, CVSS 9.8 | Vulnix