CVE-2014-1610
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2014-1610
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
MediaWiki 输入验证漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MediaWiki是美国维基媒体（Wikimedia）基金会和MediaWiki志愿者共同开发维护的一套自由免费的基于网络的Wiki引擎，它可用于部署内部的知识管理和内容管理系统。 MediaWiki中存在输入验证漏洞，该漏洞源于thumb.php脚本没有正确过滤‘page’参数。当启用支持上传DjVu或PDF文件时，远程攻击者可借助特制的shell元字符利用该漏洞执行任意命令。以下版本受到影响：MediaWiki 1.22.2之前的1.22.x版本，1.21.5之前的1.21.x版本，1.19.11之前
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2014-1610
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2014-1610
请登录查看更多情报信息。
- https://gerrit.wikimedia.org/r/#/c/110069/x_refsource_MISC
- https://gerrit.wikimedia.org/r/#/c/110215/x_refsource_MISC
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.htmlvendor-advisoryx_refsource_FEDORA
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.htmlvendor-advisoryx_refsource_FEDORA
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.htmlmailing-listx_refsource_MLIST
- https://nvd.nist.gov/vuln/detail/CVE-2014-1610
Same Patch Batch · n/a · 2014-01-30 · 17 CVEs total
| CVE-2013-7303 | SPIP 跨站脚本漏洞 | |
| CVE-2014-1837 | Joomla! StackIdeas Komento组件跨站脚本漏洞 | |
| CVE-2013-7246 | Daum Communications DaumGame ActiveX插件缓冲区溢出漏洞 | |
| CVE-2014-0793 | Joomla! StackIdeas Komento组件跨站脚本漏洞 | |
| CVE-2014-1611 | Drupal Anonymous Posting模块跨站脚本漏洞 | |
| CVE-2014-1612 | Media5 Mediatrix 4402 VoIP Gateway 跨站脚本漏洞 | |
| CVE-2012-3000 | F5 BIG-IP SQL注入漏洞 | |
| CVE-2013-0177 | Apache OFBiz 多个跨站脚本漏洞 | |
| CVE-2013-1376 | Adobe Reader和Acrobat 缓冲区溢出漏洞 | |
| CVE-2013-3084 | Belkin F5D8236-4 Router 未明跨站脚本漏洞 | |
| CVE-2013-3087 | Belkin N900 Router 未明跨站脚本漏洞 | |
| CVE-2013-3090 | Belkin N300 Router 未明跨站脚本漏洞 | |
| CVE-2014-0835 | IBM Security QRadar SIEM 跨站请求伪造漏洞 | |
| CVE-2014-0836 | IBM Security QRadar SIEM 跨站脚本漏洞 | |
| CVE-2014-0837 | IBM Security QRadar SIEM 加密问题漏洞 | |
| CVE-2014-0838 | IBM Security QRadar SIEM 安全漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2014-1610
No comments yet