CVE-2014-5004

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtain sensitive information by listing the process.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2014/07/10/6Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/07/17/5Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/68506Third Party Advisory, VDB Entry
http://www.vapid.dhs.org/advisories/brbackup-0.1.1.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2014/07/10/6Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/07/17/5Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/68506Third Party Advisory, VDB Entry
http://www.vapid.dhs.org/advisories/brbackup-0.1.1.htmlThird Party Advisory

Timeline

Published: Jan 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-50057.5Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrar CVE-2014-50067.5Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrar CVE-2014-50079.8Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Serv CVE-2014-50089.8Snoopy allows remote attackers to execute arbitrary commands.CVE-2014-50099.8Snoopy allows remote attackers to execute arbitrary commands. NOTE: this vulnerability exists due to an incomplete fix for CVE-2014-5008.CVE-2014-50116.5DOMPDF before 0.6.2 allows Information Disclosure.CVE-2014-50126.5DOMPDF before 0.6.2 allows denial of service.CVE-2014-50138.8DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.CVE-2014-50149.8The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to CVE-2014-50155.0bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows r CVE-2014-50164.3Multiple cross-site scripting (XSS) vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers to inject arbitrary web script o CVE-2014-50177.5SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 140618 allows remote a