CVE-2014-4998

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2014/07/07/18Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/07/17/5Mailing List, Third Party Advisory
http://www.vapid.dhs.org/advisories/lean-ruport-0.3.8.htmlExploit, Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/07/07/18Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/07/17/5Mailing List, Third Party Advisory
http://www.vapid.dhs.org/advisories/lean-ruport-0.3.8.htmlExploit, Third Party Advisory

Timeline

Published: Jan 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-49997.8vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldump CVE-2014-50007.8The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users CVE-2014-50017.8lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) mysqldump, (2) pg_dump, (3) mysql, and (4) ps CVE-2014-50027.8The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information CVE-2014-50035.5chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary f CVE-2014-50047.8lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtai CVE-2014-50057.5Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrar CVE-2014-50067.5Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrar CVE-2014-50079.8Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Serv CVE-2014-50089.8Snoopy allows remote attackers to execute arbitrary commands.CVE-2014-50099.8Snoopy allows remote attackers to execute arbitrary commands. NOTE: this vulnerability exists due to an incomplete fix for CVE-2014-5008.CVE-2014-50116.5DOMPDF before 0.6.2 allows Information Disclosure.