CVE

Id
76822  
CVE No.
CVE-2014-9521  
Status
Candidate  
Description
Unrestricted file upload vulnerability in uploadScript.php in InfiniteWP Admin Panel before 2.4.4, when the allWPFiles query parameter is set, allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the uploads directory, as demonstrated by the .php.swp filename.  
Phase
Assigned (20150105)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
705448 76822 CVE-2014-9521 FULLDISC:20141210 Multiple vulnerabilities in InfiniteWP Admin Panel  View
705449 76822 CVE-2014-9521 URL:http://seclists.org/fulldisclosure/2014/Dec/43  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
18706 JVNDB-2014-007581 Linux Kernel の security/keys/gc.c の key_gc_unused_keys 関数におけるサービス運用妨害 (DoS) の脆弱性 Linux Kernel の security/keys/gc.c 内の key_gc_unused_keys 関数には、競合状態により、サービス運用妨害 (メモリ破損またはパニック) 状態にされるなど、不特定の影響を受ける脆弱性が存在します。 CVE-2014-9529 76822 7.2 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-007581.html  View