CVE-2014-8328

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The default configuration in the Dynamic Content Elements (dce) extension before 0.11.5 for TYPO3 allows remote attackers to obtain sensitive installation environment information by reading the update check request.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://typo3.org/extensions/repository/view/dceVendor Advisory
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-015/Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/97673VDB Entry
http://typo3.org/extensions/repository/view/dceVendor Advisory
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-015/Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/97673VDB Entry

Timeline

Published: Feb 3, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-832910.0Schrack Technik microControl with firmware before 1.7.0 (937) stores sensitive information under the web root with insufficient access contr CVE-2014-83303.5Cross-site scripting (XSS) vulnerability in EspoCRM allows remote authenticated users to inject arbitrary web script or HTML via the Name fi CVE-2014-83316.8Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3236 before E3276sTCPU-V200R002B470D13SP00C00 and E3276sWebUI-V CVE-2014-83334.0The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk consumpti CVE-2014-83346.5The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands vi CVE-2014-83357.8(1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credenti CVE-2014-83366.5The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary CVE-2014-83379.8Unrestricted file upload vulnerability in includes/classes/uploadify-v2.1.4/uploadify.php in HelpDEZk 1.0.1 and earlier allows remote attack CVE-2014-83386.1Cross-site scripting (XSS) vulnerability in vwrooms/js/jsor-jcarousel/examples/special_textscroller.php in the VideoWhisper Webcam plugins f CVE-2014-83397.5SQL injection vulnerability in midroll.php in Nuevolab Nuevoplayer for ClipShare 8.0 and earlier allows remote attackers to execute arbitrar CVE-2014-83407.5SQL injection vulnerability in Php/Functions/log_function.php in phpTrafficA 2.3 and earlier allows remote attackers to execute arbitrary SQ CVE-2014-83467.8The Remote Controls feature on Samsung mobile devices does not validate the source of lock-code data received over a network, which makes it