CVE-2014-4981

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

LPAR2RRD in 3.5 and earlier allows remote attackers to execute arbitrary commands due to insufficient input sanitization of the web GUI parameters.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://ocert.org/advisories/ocert-2014-005.htmlThird Party Advisory
http://packetstormsecurity.com/files/127593/LPAR2RRD-3.5-4.53-Command-Injection.htmlThird Party Advisory, VDB Entry
http://www.lpar2rrd.com/note453-01.htmVendor Advisory
http://www.openwall.com/lists/oss-security/2014/07/23/6Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/68844Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/94784Third Party Advisory, VDB Entry
http://ocert.org/advisories/ocert-2014-005.htmlThird Party Advisory
http://packetstormsecurity.com/files/127593/LPAR2RRD-3.5-4.53-Command-Injection.htmlThird Party Advisory, VDB Entry
http://www.lpar2rrd.com/note453-01.htmVendor Advisory
http://www.openwall.com/lists/oss-security/2014/07/23/6Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/68844Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/94784Third Party Advisory, VDB Entry

Timeline

Published: Feb 17, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-49829.8LPAR2RRD ≤ 4.53 and ≤ 3.5 has arbitrary command injection on the application server.CVE-2014-49849.8Déjà Vu Crescendo Sales CRM has remote SQL Injection CVE-2014-49863.5Multiple cross-site scripting (XSS) vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x CVE-2014-49874.0server_user_groups.php in phpMyAdmin 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6 allows remote authenticated users to bypass intended acces CVE-2014-49917.8(1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials o CVE-2014-49927.8lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obt CVE-2014-49937.8(1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup_checksum gem 3.0.23 for Ruby CVE-2014-49945.5lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file,CVE-2014-49957.0Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by re CVE-2014-49965.5lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to write to arbitrary files via a symlink attack on /tm CVE-2014-49977.8lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain se CVE-2014-49987.8test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local u