CVE-2014-9753

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://karmainsecurity.com/KIS-2015-06Exploit, Third Party Advisory
http://seclists.org/fulldisclosure/2015/Nov/11Exploit, Mailing List, Third Party Advisory
http://update.atutor.ca/patch/2_2/2_2-6/patch.xmlBroken Link
http://www.securityfocus.com/archive/1/archive/1/536835/100/0/threadedBroken Link
https://github.com/atutor/ATutor/commit/950a0299954e69b8742cc1f1a632f564435d4d7dPatch, Third Party Advisory
http://karmainsecurity.com/KIS-2015-06Exploit, Third Party Advisory
http://seclists.org/fulldisclosure/2015/Nov/11Exploit, Mailing List, Third Party Advisory
http://update.atutor.ca/patch/2_2/2_2-6/patch.xmlBroken Link
http://www.securityfocus.com/archive/1/archive/1/536835/100/0/threadedBroken Link
https://github.com/atutor/ATutor/commit/950a0299954e69b8742cc1f1a632f564435d4d7dPatch, Third Party Advisory

Timeline

Published: Feb 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-97545.9The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint ident CVE-2014-97557.5The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint ident CVE-2014-97565.0The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash CVE-2014-97579.8The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers CVE-2014-97586.1Cross-site scripting (XSS) vulnerability in Magento E-Commerce Platform 1.9.0.1.CVE-2014-97595.3Incomplete blacklist vulnerability in the config_is_private function in config_api.php in MantisBT 1.3.x before 1.3.0 allows remote attacker CVE-2014-97606.1Cross-site scripting (XSS) vulnerability in the displayLogin function in html/index.php in GOsa allows remote attackers to inject arbitrary CVE-2014-97619.8Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a den CVE-2014-97627.5imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.CVE-2014-97637.5imlib2 before 1.4.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted PNM file CVE-2014-97647.5imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file.CVE-2014-97658.8Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary co