CVE-2014-5362

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The admin interface in Landesk Management Suite 9.6 and earlier allows remote attackers to conduct remote file inclusion attacks involving ASPX pages from third-party sites via the d parameter to (1) ldms/sm_actionfrm.asp or (2) remote/frm_coremainfrm.aspx; or the (3) top parameter to remote/frm_splitfrm.aspx.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/131496/Landesk-Management-Suite-9.5-RFI-CSRF.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/535286/100/1100/threaded
http://www.securityfocus.com/bid/74190Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032203Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/131496/Landesk-Management-Suite-9.5-RFI-CSRF.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/535286/100/1100/threaded
http://www.securityfocus.com/bid/74190Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032203Third Party Advisory, VDB Entry

Timeline

Published: Sep 19, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-53685.0Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-sourc CVE-2014-53694.3Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote CVE-2014-53707.5Directory traversal vulnerability in the CFChart servlet (com.naryx.tagfusion.cfm.cfchartServlet) in New Atlanta BlueDragon before 7.1.1.185 CVE-2014-53754.0The server in Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0 does not properly validate the message owner matches the submitting us CVE-2014-53764.0Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0, when a pre-generated key is used, does not validate that the requesting user matche CVE-2014-53775.0ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via CVE-2014-53807.5Grand MA 300 allows retrieval of the access PIN from sniffed data.CVE-2014-53819.8Grand MA 300 allows a brute-force attack on the PIN.CVE-2014-53824.3Multiple cross-site scripting (XSS) vulnerabilities in the web interface in Schrack Technik microControl with firmware 1.7.0 (937) allow rem CVE-2014-53836.5SQL injection vulnerability in AlienVault OSSIM before 4.7.0 allows remote authenticated users to execute arbitrary SQL commands via unspeci CVE-2014-53845.0The VIQR module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of ser CVE-2014-53855.0com/salesmanager/central/profile/ProfileAction.java in Shopizer 1.1.5 and earlier does not restrict the number of authentication attempts, w