NVD

Id
30441  
Name
CVE-2014-1905  
Description
Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename.  
Reject
 
CVSS Version
2  
CVSS Score
10  
Severity
High  
CVSS Base Score
10  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2014-12-29  
Modified Date
2014-12-30  
Seq
2014-1905  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
161064 30441 CVE-2014-1905 https://www.htbridge.com/advisory/HTB23199  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
18560 JVNDB-2014-007435 WordPress 用 VideoWhisper Live Streaming Integration プラグインの ls/vw_snapshots.php における任意の PHP コードを実行される脆弱性 WordPress 用 VideoWhisper Live Streaming Integration プラグインの ls/vw_snapshots.php には、ファイルをアップロードされることにより、任意の PHP コードを実行され、その後、ファイルへアクセスされる脆弱性が存在します。 CVE-2014-1905 69192 CVE-2014-1905 30441 10 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-007435.html 2014-02-06 2015-01-06 View