CVE-2014-8871

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability in hybris Commerce software suite 5.0.3.3 and earlier, 5.0.0.3 and earlier, 5.0.4.4 and earlier, 5.1.0.1 and earlier, 5.1.1.2 and earlier, 5.2.0.3 and earlier, and 5.3.0.1 and earlier.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/130444/Hybris-Commerce-Software-Suite-5.x-File-Disclosure-Traversal.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Feb/63Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/534722/100/1600/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/72681Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/130444/Hybris-Commerce-Software-Suite-5.x-File-Disclosure-Traversal.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Feb/63Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/534722/100/1600/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/72681Third Party Advisory, VDB Entry

Timeline

Published: Aug 28, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-88727.8Improper Verification of Cryptographic Signature in AVM FRITZ!Box 6810 LTE after firmware 5.22, FRITZ!Box 6840 LTE after firmware 5.23, and CVE-2014-887310.0A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-CVE-2014-88745.0The ke_questionnaire extension 2.5.2 and earlier for TYPO3 uses predictable names for the questionnaire answer forms, which makes it easier CVE-2014-88755.0The XML_RPC_cd function in lib/pear/XML/RPC.php in Revive Adserver before 3.0.6 allows remote attackers to cause a denial of service (CPU an CVE-2014-887710.0The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for CVE-2014-88785.9KDE KMail does not encrypt attachments in emails when "automatic encryption" is enabled, which allows remote attackers to obtain sensitive i CVE-2014-88846.1Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux CVE-2014-88868.1AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote attac CVE-2014-88874.0IBM Marketing Operations 7.x and 8.x before 8.5.0.7.2, 8.6.x before 8.6.0.8, 9.0.x before 9.0.0.4.1, 9.1.0.x before 9.1.0.5, and 9.1.1.x bef CVE-2014-88889.8The remote administration interface in D-Link DIR-815 devices with firmware before 2.03.B02 allows remote attackers to execute arbitrary com CVE-2014-88895.3Dropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information via crafted malware or via a drive-by down CVE-2014-88905.1IBM WebSphere Application Server Liberty Profile 8.5.x before 8.5.5.4 allows remote attackers to gain privileges by leveraging the combinati