CVE-2014-6276

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published
Apr 13, 2016
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2014

CVE-2014-627710.0GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attCVE-2014-62788.8GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attCVE-2014-62804.3Multiple cross-site scripting (XSS) vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script or HTML viCVE-2014-62836.5SAP Adaptive Server Enterprise (ASE) 15.7 before SP122 or SP63, 15.5 before ESD#5.4, and 15.0.3 before ESD#4.4 does not properly restrict acCVE-2014-62847.5SAP Adaptive Server Enterprise (ASE) before 15.7 SP132 and 16.0 before 16.0 SP01 allows remote attackers to bypass the challenge and responsCVE-2014-62879.8The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackeCVE-2014-62887.5The powermail extension 2.x before 2.0.11 for TYPO3 allows remote attackers to bypass the CAPTCHA protection mechanism via unspecified vectoCVE-2014-62897.5The Ajax dispatcher for Extbase in the Yet Another Gallery (yag) extension before 3.0.1 and Tools for Extbase development (pt_extbase) extenCVE-2014-62907.5The News (tt_news) extension before 3.5.2 for TYPO3 allows remote attackers to have unspecified impact via vectors related to an "insecure uCVE-2014-62914.3Cross-site scripting (XSS) vulnerability in the Alphabetic Sitemap (alpha_sitemap) extension 0.0.3 and earlier for TYPO3 allows remote attacCVE-2014-62926.4The femanager extension before 1.0.9 for TYPO3 allows remote frontend users to modify or delete the records of other frontend users via unspCVE-2014-62937.5SQL injection vulnerability in the Statistics (ke_stats) extension before 1.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL c
CVE-2014-6276: Medium severity, CVSS 4.3 | Vulnix