CVE-2014-9220

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147753.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-02/msg00039.htmlThird Party Advisory
http://openwall.com/lists/oss-security/2014/11/30/2Mailing List, Third Party Advisory
http://www.openvas.org/OVSA20141128.htmlPatch, Vendor Advisory
https://www.alienvault.com/forums/discussion/4415/Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147753.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-02/msg00039.htmlThird Party Advisory
http://openwall.com/lists/oss-security/2014/11/30/2Mailing List, Third Party Advisory
http://www.openvas.org/OVSA20141128.htmlPatch, Vendor Advisory
https://www.alienvault.com/forums/discussion/4415/Third Party Advisory

Timeline

Published: Dec 3, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-92215.0strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted CVE-2014-922210.0AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows remote attackers to ga CVE-2014-922310.0Multiple buffer overflows in AllegroSoft RomPager, as used in Huawei Home Gateway products and other vendors and products, allow remote atta CVE-2014-92243.5Cross-site scripting (XSS) vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critic CVE-2014-92254.0The ajaxswing webui in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Securi CVE-2014-92267.2The management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SD CVE-2014-92274.4Multiple untrusted search path vulnerabilities in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allow local user CVE-2014-92284.9sysplant.sys in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allows local users to cause a denial of service (b CVE-2014-92296.5Multiple SQL injection vulnerabilities in interface PHP scripts in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 CVE-2014-92304.3Cross-site scripting (XSS) vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention (DLP) before 1 CVE-2014-92345.0Directory traversal vulnerability in cgi-bin/sddownload.cgi in D-link IP camera DCS-2103 with firmware 1.0.0 allows remote attackers to read CVE-2014-92356.5Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arb