CVE-2014-8675

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers to obtain a calendar owner's password via a brute-force attack on the embedded password hash.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/132654/Simple-Online-Planning-Tool-1.3.2-XSS-SQL-Injection-Traversal.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Jul/44Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/75726Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/37604/Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/132654/Simple-Online-Planning-Tool-1.3.2-XSS-SQL-Injection-Traversal.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Jul/44Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/75726Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/37604/Third Party Advisory, VDB Entry

Timeline

Published: Aug 31, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-86765.3Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the CVE-2014-86775.3The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existi CVE-2014-86787.8The ConfigSaveServlet servlet in ManageEngine OpUtils before build 71024 allows remote attackers to "disclose" files via a crafted filename,CVE-2014-86805.4The GeoIP functionality in ISC BIND 9.10.0 through 9.10.1 allows remote attackers to cause a denial of service (assertion failure and named CVE-2014-86817.5SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1 CVE-2014-86827.5Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to e CVE-2014-86834.3Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote at CVE-2014-86849.8CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and CVE-2014-86869.8CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption sch CVE-2014-86879.8Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by levera CVE-2014-86887.5An issue was discovered in Telegram Messenger 2.6 for iOS and 1.8.2 for Android. Secret chat messages are available in cleartext in process CVE-2014-86904.3Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1