high7.5
CVE-2014-9220
SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone par…
Impact
SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fedoraproject | Fedora | Version 21 |
| Openvas | Openvas Manager | through 4.0.5 Versions 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4 |
| Opensuse | Opensuse | Version 13.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147753.html
- http://lists.opensuse.org/opensuse-updates/2015-02/msg00039.html
- http://openwall.com/lists/oss-security/2014/11/30/2
- http://www.openvas.org/OVSA20141128.html
- https://www.alienvault.com/forums/discussion/4415/
- http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147753.html
- http://lists.opensuse.org/opensuse-updates/2015-02/msg00039.html
- http://openwall.com/lists/oss-security/2014/11/30/2
- http://www.openvas.org/OVSA20141128.html
- https://www.alienvault.com/forums/discussion/4415/