CVE-2014-2967

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

Autodesk VRED Professional 2014 before SR1 SP8 allows remote attackers to execute arbitrary code via Python os library calls in Python API commands to the integrated web server.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jul 7, 2014
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2014

CVE-2014-29684.3Cross-site scripting (XSS) vulnerability in the web interface on the Huawei E355 CH1E355SM modem with software 21.157.37.01.910 and Web UI 1CVE-2014-29698.3NETGEAR GS108PE Prosafe Plus switches with firmware 1.2.0.5 have a hardcoded password of debugpassword for the ntgruser account, which allowCVE-2014-29713.5Cross-site scripting (XSS) vulnerability in AddStdLetter.jsp in MicroPact iComplaints before 8.0.2.1.8.8014 allows remote authenticated userCVE-2014-29724.6expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commaCVE-2014-29746.8Cross-site request forgery (CSRF) vulnerability in php/user_account.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack thCVE-2014-29754.3Cross-site scripting (XSS) vulnerability in php/user_account.php in Silver Peak VX before 6.2.4 allows remote attackers to inject arbitrary CVE-2014-29765.0Directory traversal vulnerability in Sixnet SixView Manager 2.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in an HCVE-2014-297710.0Multiple integer signedness errors in the Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB 1.4.13 allowCVE-2014-297810.0The Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB 1.4.4 allows remote attackers to cause a denial ofCVE-2014-29804.3Tools/gdomap.c in gdomap in GNUstep Base 1.24.6 and earlier, when run in daemon mode, does not properly handle the file descriptor for the lCVE-2014-29835.0Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonyCVE-2014-29865.5The vgic_distr_mmio_write function in the virtual guest interrupt controller (GIC) distributor (arch/arm/vgic.c) in Xen 4.4.x, when running
CVE-2014-2967: Critical severity, CVSS 10.0 | Vulnix