Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2014-0096 | First vendor Publication | 2014-05-31 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0096 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-264 | Permissions, Privileges, and Access Controls |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:24046 | |||
| Oval ID: | oval:org.mitre.oval:def:24046 | ||
| Title: | DEPRECATED: ELSA-2014:0246: gnutls security update (Important) | ||
| Description: | The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS). It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could be accepted by GnuTLS as valid for a site chosen by the attacker. (CVE-2014-0092) The CVE-2014-0092 issue was discovered by Nikos Mavrogiannopoulos of the Red Hat Security Technologies Team. Users of GnuTLS are advised to upgrade to these updated packages, which correct this issue. For the update to take effect, all applications linked to the GnuTLS library must be restarted. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2014:0246-01 CVE-2014-0096 | Version: | 6 |
| Platform(s): | Oracle Linux 6 | Product(s): | gnutls |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2015-06-25 | IAVM : 2015-B-0083 - Multiple Vulnerabilities in IBM Storwize V7000 Unified Severity : Category I - VMSKEY : V0060983 |
| 2014-12-11 | IAVM : 2014-B-0162 - VMware vCenter Server 5.1 Certificate Validation Vulnerability Severity : Category I - VMSKEY : V0057685 |
| 2014-12-11 | IAVM : 2014-B-0159 - VMware vCenter Server Appliance 5.1 Cross-site Scripting Vulnerability Severity : Category II - VMSKEY : V0057687 |
| 2014-12-11 | IAVM : 2014-A-0191 - VMware vCenter Server 5.0 Certificate Validation Vulnerability Severity : Category I - VMSKEY : V0057699 |
| 2014-12-11 | IAVM : 2014-B-0161 - Multiple Vulnerabilities in VMware ESXi 5.1 Severity : Category I - VMSKEY : V0057717 |
| 2014-05-29 | IAVM : 2014-B-0063 - Multiple Vulnerabilities in Apache Tomcat Severity : Category I - VMSKEY : V0051613 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2016-04-18 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3552.nasl - Type : ACT_GATHER_INFO |
| 2016-03-28 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3530.nasl - Type : ACT_GATHER_INFO |
| 2015-12-30 | Name : The remote VMware ESXi host is missing a security-related patch. File : vmware_VMSA-2014-0012_remote.nasl - Type : ACT_GATHER_INFO |
| 2015-06-26 | Name : The remote IBM Storwize device is affected by multiple vulnerabilities. File : ibm_storwize_1_5_0_2.nasl - Type : ACT_GATHER_INFO |
| 2015-05-18 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2015-527.nasl - Type : ACT_GATHER_INFO |
| 2015-05-18 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2015-526.nasl - Type : ACT_GATHER_INFO |
| 2015-03-30 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-084.nasl - Type : ACT_GATHER_INFO |
| 2015-03-19 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-053.nasl - Type : ACT_GATHER_INFO |
| 2015-03-19 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-052.nasl - Type : ACT_GATHER_INFO |
| 2015-02-24 | Name : The remote Fedora host is missing a security update. File : fedora_2015-2109.nasl - Type : ACT_GATHER_INFO |
| 2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_tomcat_20140715.nasl - Type : ACT_GATHER_INFO |
| 2014-12-15 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201412-29.nasl - Type : ACT_GATHER_INFO |
| 2014-12-12 | Name : The remote host has a virtualization management application installed that is... File : vmware_vcenter_vmsa-2014-0012.nasl - Type : ACT_GATHER_INFO |
| 2014-12-12 | Name : The remote host has an update manager installed that is affected by multiple ... File : vmware_vcenter_update_mgr_vmsa-2014-0012.nasl - Type : ACT_GATHER_INFO |
| 2014-12-12 | Name : The remote host has a virtualization appliance installed that is affected by ... File : vmware_vcenter_server_appliance_vmsa-2014-0012.nasl - Type : ACT_GATHER_INFO |
| 2014-12-12 | Name : The remote VMware ESXi 5.1 host is affected by multiple vulnerabilities. File : vmware_esxi_5_1_build_2323236_remote.nasl - Type : ACT_GATHER_INFO |
| 2014-12-06 | Name : The remote VMware ESXi host is missing a security-related patch. File : vmware_VMSA-2014-0012.nasl - Type : ACT_GATHER_INFO |
| 2014-12-03 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL15428.nasl - Type : ACT_GATHER_INFO |
| 2014-11-26 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2014-0012.nasl - Type : ACT_GATHER_INFO |
| 2014-08-14 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_tomcat6-201407-140706.nasl - Type : ACT_GATHER_INFO |
| 2014-07-31 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2302-1.nasl - Type : ACT_GATHER_INFO |
| 2014-07-30 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0827.nasl - Type : ACT_GATHER_INFO |
| 2014-07-24 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-0827.nasl - Type : ACT_GATHER_INFO |
| 2014-07-24 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_81fc1076128611e4bebd000c2980a9f3.nasl - Type : ACT_GATHER_INFO |
| 2014-07-10 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140709_tomcat6_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2014-07-10 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-0865.nasl - Type : ACT_GATHER_INFO |
| 2014-07-10 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-0865.nasl - Type : ACT_GATHER_INFO |
| 2014-07-10 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0865.nasl - Type : ACT_GATHER_INFO |
| 2014-07-08 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2014-0843.nasl - Type : ACT_GATHER_INFO |
| 2014-07-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0835.nasl - Type : ACT_GATHER_INFO |
| 2014-07-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0834.nasl - Type : ACT_GATHER_INFO |
| 2014-05-30 | Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_6_0_41.nasl - Type : ACT_GATHER_INFO |
| 2014-05-30 | Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_8_0_5.nasl - Type : ACT_GATHER_INFO |
| 2014-05-30 | Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_7_0_53.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 12:38:22 |
|
| 2023-11-07 21:45:28 |
|
| 2021-05-04 12:29:24 |
|
| 2021-04-22 01:35:38 |
|
| 2020-05-23 01:50:40 |
|
| 2020-05-23 00:39:18 |
|
| 2019-04-15 21:18:58 |
|
| 2019-04-15 17:18:44 |
|
| 2019-03-25 17:18:58 |
|
| 2019-03-21 21:19:10 |
|
| 2018-10-10 00:19:46 |
|
| 2017-11-15 09:23:50 |
|
| 2017-03-25 12:00:54 |
|
| 2017-01-07 09:25:16 |
|
| 2016-12-08 09:23:29 |
|
| 2016-10-26 09:22:41 |
|
| 2016-10-15 12:03:09 |
|
| 2016-08-23 09:24:48 |
|
| 2016-07-29 09:24:26 |
|
| 2016-04-26 09:25:17 |
|
| 2016-04-19 13:30:03 |
|
| 2016-03-29 13:21:00 |
|
| 2015-10-18 17:22:23 |
|
| 2015-06-27 13:28:46 |
|
| 2015-05-19 13:27:44 |
|
| 2015-04-07 09:26:40 |
|
| 2015-04-02 09:25:42 |
|
| 2015-03-31 13:28:09 |
|
| 2015-03-28 09:25:44 |
|
| 2015-03-26 09:26:12 |
|
| 2015-03-21 00:25:22 |
|
| 2015-03-20 13:28:48 |
|
| 2015-03-20 00:25:15 |
|
| 2015-03-18 09:26:18 |
|
| 2015-03-06 00:22:56 |
|
| 2015-03-03 09:23:08 |
|
| 2015-02-25 13:24:05 |
|
| 2015-01-21 13:26:38 |
|
| 2014-12-16 17:23:49 |
|
| 2014-12-16 13:25:05 |
|
| 2014-12-12 09:22:55 |
|
| 2014-12-04 13:27:57 |
|
| 2014-09-12 21:26:36 |
|
| 2014-09-04 13:25:04 |
|
| 2014-08-15 13:27:43 |
|
| 2014-08-01 13:24:54 |
|
| 2014-07-31 13:25:03 |
|
| 2014-07-25 13:21:38 |
|
| 2014-07-18 09:22:18 |
|
| 2014-07-17 09:22:05 |
|
| 2014-07-11 13:25:06 |
|
| 2014-07-09 13:25:34 |
|
| 2014-06-04 17:21:10 |
|
| 2014-06-03 00:21:01 |
|
| 2014-05-31 17:20:45 |
|
