CVE-2014-2949

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in the web service in F5 ARX Data Manager 3.0.0 through 3.1.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15310.html?sr=38021626Vendor Advisory
http://www.kb.cert.org/vuls/id/210884Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/68078
http://www.zerodayinitiative.com/advisories/ZDI-14-293/
http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15310.html?sr=38021626Vendor Advisory
http://www.kb.cert.org/vuls/id/210884Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/68078
http://www.zerodayinitiative.com/advisories/ZDI-14-293/

Timeline

Published: Jun 18, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-29507.8Datum Systems SnIP on PSM-500 and PSM-4500 devices does not require authentication for FTP sessions, which allows remote attackers to obtain CVE-2014-295110.0Datum Systems SnIP on PSM-500 and PSM-4500 devices has a hardcoded password of admin for the admin account, which makes it easier for remote CVE-2014-295510.0Raritan PX before 1.5.11 on DPXR20A-16 devices allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using CVE-2014-29569.3ScriptHelperApi in the AVG ScriptHelper ActiveX control in ScriptHelper.exe in AVG Secure Search toolbar before 18.1.7.598 and AVG Safeguard CVE-2014-29576.8The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrar CVE-2014-29599.0logViewer.htm on the Dell ML6000 tape backup system with firmware before i8.2.0.2 (641G.GS103) and the Quantum Scalar i500 tape backup syste CVE-2014-29607.5Vision Critical before 2014-05-30 allows attackers to read arbitrary files via unspecified vectors, as demonstrated by image files and confi CVE-2014-29627.8Absolute path traversal vulnerability in the webproc cgi module on the Belkin N150 F9K1009 v1 router with firmware before 1.00.08 allows rem CVE-2014-29634.3Multiple cross-site scripting (XSS) vulnerabilities in group/control_panel/manage in Liferay Portal 6.1.2 CE GA3, 6.1.X EE, and 6.2.X EE all CVE-2014-29646.9Cobham Aviator 700D and 700E satellite terminals have hardcoded passwords for the (1) debug, (2) prod, (3) do160, and (4) flrp programs, whi CVE-2014-29654.3Cross-site scripting (XSS) vulnerability in auth-settings-x.php in SpamTitan before 6.04 allows remote attackers to inject arbitrary web scr CVE-2014-29665.0The ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode transformations, which allows remote attackers to bypass