Search
Find a vulnerability
Search criteria
4 vulnerabilities by livetecs
CVE-2014-2042 (GCVE-0-2014-2042)
Vulnerability from nvd – Published: 2014-04-28 14:00 – Updated: 2024-08-06 09:58
VLAI
EPSS
VEX
Summary
Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory in Uploads/.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/archive/1/531914/100… | mailing-listx_refsource_BUGTRAQ |
| http://seclists.org/fulldisclosure/2014/Apr/260 | mailing-listx_refsource_FULLDISC |
Date Public
2014-04-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:58:16.311Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/531914/100/0/threaded"
},
{
"name": "20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2014/Apr/260"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-04-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory in Uploads/."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/531914/100/0/threaded"
},
{
"name": "20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2014/Apr/260"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-2042",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory in Uploads/."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/531914/100/0/threaded"
},
{
"name": "20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2014/Apr/260"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-2042",
"datePublished": "2014-04-28T14:00:00.000Z",
"dateReserved": "2014-02-19T00:00:00.000Z",
"dateUpdated": "2024-08-06T09:58:16.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-1217 (GCVE-0-2014-1217)
Vulnerability from nvd – Published: 2014-04-28 14:00 – Updated: 2024-08-06 09:34
VLAI
EPSS
VEX
Summary
Livetecs Timelive before 6.2.8 does not properly restrict access to systemsetting.aspx, which allows remote attackers to change configurations and obtain the database connection string and credentials via unspecified vectors.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.portcullis-security.com/security-rese… | x_refsource_MISC |
| http://www.securityfocus.com/archive/1/531911/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.securityfocus.com/bid/67043 | vdb-entryx_refsource_BID |
| http://seclists.org/fulldisclosure/2014/Apr/259 | mailing-listx_refsource_FULLDISC |
Date Public
2014-04-23 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:34:40.365Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1217/"
},
{
"name": "20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/531911/100/0/threaded"
},
{
"name": "67043",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/67043"
},
{
"name": "20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2014/Apr/259"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-04-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Livetecs Timelive before 6.2.8 does not properly restrict access to systemsetting.aspx, which allows remote attackers to change configurations and obtain the database connection string and credentials via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1217/"
},
{
"name": "20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/531911/100/0/threaded"
},
{
"name": "67043",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/67043"
},
{
"name": "20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2014/Apr/259"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-1217",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Livetecs Timelive before 6.2.8 does not properly restrict access to systemsetting.aspx, which allows remote attackers to change configurations and obtain the database connection string and credentials via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1217/",
"refsource": "MISC",
"url": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1217/"
},
{
"name": "20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/531911/100/0/threaded"
},
{
"name": "67043",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/67043"
},
{
"name": "20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2014/Apr/259"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-1217",
"datePublished": "2014-04-28T14:00:00.000Z",
"dateReserved": "2014-01-07T00:00:00.000Z",
"dateUpdated": "2024-08-06T09:34:40.365Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-2042 (GCVE-0-2014-2042)
Vulnerability from cvelistv5 – Published: 2014-04-28 14:00 – Updated: 2024-08-06 09:58
VLAI
EPSS
VEX
Summary
Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory in Uploads/.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/archive/1/531914/100… | mailing-listx_refsource_BUGTRAQ |
| http://seclists.org/fulldisclosure/2014/Apr/260 | mailing-listx_refsource_FULLDISC |
Date Public
2014-04-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:58:16.311Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/531914/100/0/threaded"
},
{
"name": "20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2014/Apr/260"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-04-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory in Uploads/."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/531914/100/0/threaded"
},
{
"name": "20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2014/Apr/260"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-2042",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory in Uploads/."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/531914/100/0/threaded"
},
{
"name": "20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2014/Apr/260"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-2042",
"datePublished": "2014-04-28T14:00:00.000Z",
"dateReserved": "2014-02-19T00:00:00.000Z",
"dateUpdated": "2024-08-06T09:58:16.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-1217 (GCVE-0-2014-1217)
Vulnerability from cvelistv5 – Published: 2014-04-28 14:00 – Updated: 2024-08-06 09:34
VLAI
EPSS
VEX
Summary
Livetecs Timelive before 6.2.8 does not properly restrict access to systemsetting.aspx, which allows remote attackers to change configurations and obtain the database connection string and credentials via unspecified vectors.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.portcullis-security.com/security-rese… | x_refsource_MISC |
| http://www.securityfocus.com/archive/1/531911/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.securityfocus.com/bid/67043 | vdb-entryx_refsource_BID |
| http://seclists.org/fulldisclosure/2014/Apr/259 | mailing-listx_refsource_FULLDISC |
Date Public
2014-04-23 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:34:40.365Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1217/"
},
{
"name": "20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/531911/100/0/threaded"
},
{
"name": "67043",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/67043"
},
{
"name": "20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2014/Apr/259"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-04-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Livetecs Timelive before 6.2.8 does not properly restrict access to systemsetting.aspx, which allows remote attackers to change configurations and obtain the database connection string and credentials via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1217/"
},
{
"name": "20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/531911/100/0/threaded"
},
{
"name": "67043",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/67043"
},
{
"name": "20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2014/Apr/259"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-1217",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Livetecs Timelive before 6.2.8 does not properly restrict access to systemsetting.aspx, which allows remote attackers to change configurations and obtain the database connection string and credentials via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1217/",
"refsource": "MISC",
"url": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1217/"
},
{
"name": "20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/531911/100/0/threaded"
},
{
"name": "67043",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/67043"
},
{
"name": "20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2014/Apr/259"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-1217",
"datePublished": "2014-04-28T14:00:00.000Z",
"dateReserved": "2014-01-07T00:00:00.000Z",
"dateUpdated": "2024-08-06T09:34:40.365Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}